PySpark Plaso Release 2019 A tool for distributed extraction of timestamps from various files using extractors adapted from the Plaso engine to Apache Spark.

Public Member Functions | List of all members
plaso.tarzan.app.extractors.pe.PE Class Reference
Inheritance diagram for plaso.tarzan.app.extractors.pe.PE:
[legend]
Collaboration diagram for plaso.tarzan.app.extractors.pe.PE:
[legend]

## Public Member Functions
def | filter (cls, path)
def | extract (cls, path)
Public Member Functions inherited from plaso.tarzan.app.extractors.extractor.Extractor
def | get_name (cls)
def | get_description (cls)

## Detailed Description

    Extract events from Portable Executable (PE) files.

## Member Function Documentation

## ◆ extract()

def plaso.tarzan.app.extractors.pe.PE.extract | ( |  | cls,
|  |  | path
| ) |  |

    Extract events from a PE file in the given path.
    :param path: the path of the file to extract
    :return: a lit of events

Reimplemented from plaso.tarzan.app.extractors.extractor.Extractor.

## ◆ filter()

def plaso.tarzan.app.extractors.pe.PE.filter | ( |  | cls,
|  |  | path
| ) |  |

    Check is the file-path is a file-path of a PE file.
    For the filename extensions see https://en.wikipedia.org/wiki/Portable_Executable
    :param path: the file-path to check
    :return: True iff it is a PE file

Reimplemented from plaso.tarzan.app.extractors.extractor.Extractor.

The documentation for this class was generated from the following file:

- /home/rychly/repos/pyspark-plaso/src/plaso/tarzan/app/extractors/pe.py