def ExamineEvent(self, mediator, event):
    """Analyzes an event.

    Args:
      mediator (AnalysisMediator): mediates interactions between analysis
          plugins and other components, such as storage and dfvfs.
      event (EventObject): event to examine.
    """
    # Only interested in filesystem events.
    if event.data_type != 'fs:stat':
      return

    filename = getattr(event, 'filename', None)
    if not filename:
      return

    # Determine if we have a Chrome extension ID.
    if 'chrome' not in filename.lower():
      return

    if not self._sep:
      self._sep = self._GetPathSegmentSeparator(filename)

    if '{0:s}Extensions{0:s}'.format(self._sep) not in filename:
      return

    # Now we have extension IDs, let's check if we've got the
    # folder, nothing else.
    paths = filename.split(self._sep)
    if paths[-2] != 'Extensions':
      return

    extension_identifier = paths[-1]
    if extension_identifier == 'Temp':
      return

    # Get the user and ID.
    user = mediator.GetUsernameForPath(filename)

    # We still want this information in here, so that we can
    # manually deduce the username.
    if not user:
      if len(filename) > 25:
        user = 'Not found ({0:s}...)'.format(filename[0:25])
      else:
        user = 'Not found ({0:s})'.format(filename)

    extension_string = self._GetTitleFromChromeWebStore(extension_identifier)
    if not extension_string:
      extension_string = extension_identifier

    self._results.setdefault(user, [])
    if (extension_string, extension_identifier) not in self._results[user]:
      self._results[user].append((extension_string, extension_identifier))
def ExamineEvent ( self , mediator , event ) : if event . data_type != 'fs:stat' : return filename = getattr ( event , 'filename' , None ) if not filename : return if 'chrome' not in filename . lower ( ) : return if not self . _sep : self . _sep = self . _GetPathSegmentSeparator ( filename ) if '{0:s}Extensions{0:s}' . format ( self . _sep ) not in filename : return paths = filename . split ( self . _sep ) if paths [ - 2 ] != 'Extensions' : return extension_identifier = paths [ - 1 ] if extension_identifier == 'Temp' : return user = mediator . GetUsernameForPath ( filename ) if not user : if len ( filename ) > 25 : user = 'Not found ({0:s}...)' . format ( filename [ 0 : 25 ] ) else : user = 'Not found ({0:s})' . format ( filename ) extension_string = self . _GetTitleFromChromeWebStore ( extension_identifier ) if not extension_string : extension_string = extension_identifier self . _results . setdefault ( user , [ ] ) if ( extension_string , extension_identifier ) not in self . _results [ user ] : self . _results [ user ] . append ( ( extension_string , extension_identifier ) )
Analyzes an event.

    Args:
      mediator (AnalysisMediator): mediates interactions between analysis
          plugins and other components, such as storage and dfvfs.
      event (EventObject): event to examine.