Migrate construct-based parsers to use dtfabric

[joachimmetz]

Migrate construct-based parsers to use dtfabric. This will improve Python 3 compatibility.

Also see: https://github.com/log2timeline/plaso/projects/14

• chrome_cache
  • generate specimens (https://github.com/dfirlabs/crhome-specimens)
  • Migrated Chrome cache construct-based plugin to use dtfabric #1893 #2075
• mac_keychain
  • construct parser has limited format support
  • analyse format: https://github.com/libyal/dtformats/blob/master/documentation/MacOS%20keychain%20database%20file%20format.asciidoc
• systemd_journal
• asl
  • https://codereview.appspot.com/347900043/
  • also see: Improve ASL parser #530
• bsm
  • https://codereview.appspot.com/359740043/
  • dtfabric update Version check of idna failing on Travis-CI MacOS l2tdevtools#419
  • 359740043: Migrated BSM construct-based parser to use dtfabric #1893 #1972
• cups_ipp
  • https://codereview.appspot.com/347800043/
• firefox_cache
  • generate specimens (https://github.com/dfirlabs/firefox-specimens)
  • also address FirefoxCacheParser skips blocks #2066
  • Migrated winreg Firefox cache construct-based plugin to use dtfabric #1893 #2070
• fseventsd
  • Migrate fsevents parser to dtfabric #1925
  • Migrated fsevents parser to dtfabric. Resolves #1925 #2032
• java_idx
  • https://codereview.appspot.com/346090043
• ntfs
  • https://codereview.appspot.com/341360044
• pls_recall
  • https://codereview.appspot.com/347890043
• recycler
  • https://codereview.appspot.com/348940043/
  • current parser has a bug? that unsets the ANSI original filename:

    plaso/plaso/parsers/recycler.py

    Line 190 in 12454e4

    ascii_filename = None

• safari_cookies
  • https://codereview.appspot.com/348840043/
• utmp
  • https://codereview.appspot.com/343950043/
• utmpx
  • https://codereview.appspot.com/341360043/
• winjob
  • https://codereview.appspot.com/346040043/
• winrestore
  • Added basic dtFabric support functions
  • https://codereview.appspot.com/347790043/
• Windows Registry parser plugins:
  • sam_users
    • https://codereview.appspot.com/365740043/
  • mrulistex
    • Migrated winreg MRUListEx construct-based plugin to use dtfabric #1893 #2035 (depends on Migrated winreg MRUList construct-based plugin to use dtfabric #1893 #2030)
  • networks
    • https://codereview.appspot.com/343320043
  • task_scheduler
    • https://codereview.appspot.com/346870043/
  • mrulist
    • Migrated winreg MRUList construct-based plugin to use dtfabric #1893 #2030
  • bagmru
    • Migrated winreg BagMRU construct-based plugin to use dtfabric #1893 #2036 (depends on Migrated winreg MRUListEx construct-based plugin to use dtfabric #1893 #2035)
  • programscache
    • Migrated winreg ProgramCache construct-based plugin to use dtfabric #1893 #2042
  • appcompatcache
    • Migrated winreg AppCompatCache construct-based plugin to use dtfabric #1893 #2043
  • shutdown
    • https://codereview.appspot.com/367740043
  • userassist
    • https://codereview.appspot.com/344990043/
• OLE CF parser plugins:
  • automatic_destinations
    • https://codereview.appspot.com/341390044
• Clean up
  • have plaso parsers use dtFormats - maybe something for the future
  • Move IsText Clean up: Move IsText #1958
  • Remove lib.binary which is no longer used
    • Removed no longer used lib.binary #1893 #2044
  • also address chrome_cache_parser: add version 2.1 format support #16
  • cups ipp: improvements: Refactor CUPS IPP parser #538
• ESE database plugins
  • plaso/parsers/esedb_plugins/interface.py
  • plaso/parsers/esedb_plugins/srum.py
  • Migrated ESE database construct-based plugins to use dtfabric #1893 #2143
• Plist plugins
  • plaso/parsers/plist_plugins/timemachine.py
  • Migrated timemachine construct-based plist plugin to use dtfabric #1893 #2144
• custom_destinations.py
  • Migrated custom destinations construct-based parser to use dtfabric #1893 #2146
• remove construct as a dependency
  • Removed construct as a dependency #2141

[Onager]

Adding this to June milestone, as we'll do a bunch of work on this for that release.

[joachimmetz]

Completed with e7402a2