def _ProcessAMCacheFileKey(self, am_entry, parser_mediator):
    """"Parses an Amcache Root/File key for events.

    Args:
      am_entry (pyregf.key): amcache File key.
      parser_mediator (ParserMediator): mediates interactions between parsers
          and other components, such as storage and dfvfs.
    """
    amcache_datetime = am_entry.get_value_by_name(
        self._AMCACHE_DATETIME).get_data_as_integer()
    event_data = AmcacheEventData()

    event_data.full_path = am_entry.get_value_by_name(
        self._AMCACHE_FULL_PATH).get_data_as_string()
    # Strip off the 4 leading zero's from the sha1 hash.
    event_data.sha1 = am_entry.get_value_by_name(
        self._AMCACHE_SHA1).get_data_as_string()[4:]

    productname = am_entry.get_value_by_name(self._AMCACHE_PRODUCTNAME)
    if productname:
      event_data.productname = productname.get_data_as_string()

    companyname = am_entry.get_value_by_name(self._AMCACHE_COMPANYNAME)
    if companyname:
      event_data.companyname = companyname.get_data_as_string()

    fileversion = am_entry.get_value_by_name(self._AMCACHE_FILEVERSION)
    if fileversion:
      event_data.fileversion = fileversion.get_data_as_string()

    languagecode = am_entry.get_value_by_name(self._AMCACHE_LANGUAGECODE)
    if languagecode:
      event_data.languagecode = languagecode.get_data_as_integer()

    filesize = am_entry.get_value_by_name(self._AMCACHE_FILESIZE)
    if filesize:
      event_data.filesize = filesize.get_data_as_integer()

    filedescription = am_entry.get_value_by_name(self._AMCACHE_FILEDESCRIPTION)
    if filedescription:
      event_data.filedescription = filedescription.get_data_as_string()

    linkerts = am_entry.get_value_by_name(self._AMCACHE_LINKERTS)
    if linkerts:
      event_data.linkerts = linkerts.get_data_as_integer()

    lastmodifiedts = am_entry.get_value_by_name(self._AMCACHE_LASTMODIFIEDTS)
    if lastmodifiedts:
      event_data.lastmodifiedts = lastmodifiedts.get_data_as_integer()

    createdts = am_entry.get_value_by_name(self._AMCACHE_CREATEDTS)
    if createdts:
      event_data.createdts = createdts.get_data_as_integer()

    programid = am_entry.get_value_by_name(self._AMCACHE_PROGRAMID)
    if programid:
      event_data.programid = programid.get_data_as_string()

    event = time_events.DateTimeValuesEvent(
        filetime.Filetime(amcache_datetime),
        definitions.TIME_DESCRIPTION_MODIFICATION)
    parser_mediator.ProduceEventWithEventData(event, event_data)

    if event_data.createdts:
      event = time_events.DateTimeValuesEvent(
          filetime.Filetime(event_data.createdts),
          definitions.TIME_DESCRIPTION_CREATION)
      parser_mediator.ProduceEventWithEventData(event, event_data)

    if event_data.lastmodifiedts:
      event = time_events.DateTimeValuesEvent(
          filetime.Filetime(event_data.lastmodifiedts),
          definitions.TIME_DESCRIPTION_MODIFICATION)
      parser_mediator.ProduceEventWithEventData(event, event_data)

    if event_data.linkerts:
      event = time_events.DateTimeValuesEvent(
          posix_time.PosixTime(event_data.linkerts),
          definitions.TIME_DESCRIPTION_CHANGE)
      parser_mediator.ProduceEventWithEventData(event, event_data)
def _ProcessAMCacheFileKey ( self , am_entry , parser_mediator ) : amcache_datetime = am_entry . get_value_by_name ( self . _AMCACHE_DATETIME ) . get_data_as_integer ( ) event_data = AmcacheEventData ( ) event_data . full_path = am_entry . get_value_by_name ( self . _AMCACHE_FULL_PATH ) . get_data_as_string ( ) event_data . sha1 = am_entry . get_value_by_name ( self . _AMCACHE_SHA1 ) . get_data_as_string ( ) [ 4 : ] productname = am_entry . get_value_by_name ( self . _AMCACHE_PRODUCTNAME ) if productname : event_data . productname = productname . get_data_as_string ( ) companyname = am_entry . get_value_by_name ( self . _AMCACHE_COMPANYNAME ) if companyname : event_data . companyname = companyname . get_data_as_string ( ) fileversion = am_entry . get_value_by_name ( self . _AMCACHE_FILEVERSION ) if fileversion : event_data . fileversion = fileversion . get_data_as_string ( ) languagecode = am_entry . get_value_by_name ( self . _AMCACHE_LANGUAGECODE ) if languagecode : event_data . languagecode = languagecode . get_data_as_integer ( ) filesize = am_entry . get_value_by_name ( self . _AMCACHE_FILESIZE ) if filesize : event_data . filesize = filesize . get_data_as_integer ( ) filedescription = am_entry . get_value_by_name ( self . _AMCACHE_FILEDESCRIPTION ) if filedescription : event_data . filedescription = filedescription . get_data_as_string ( ) linkerts = am_entry . get_value_by_name ( self . _AMCACHE_LINKERTS ) if linkerts : event_data . linkerts = linkerts . get_data_as_integer ( ) lastmodifiedts = am_entry . get_value_by_name ( self . _AMCACHE_LASTMODIFIEDTS ) if lastmodifiedts : event_data . lastmodifiedts = lastmodifiedts . get_data_as_integer ( ) createdts = am_entry . get_value_by_name ( self . _AMCACHE_CREATEDTS ) if createdts : event_data . createdts = createdts . get_data_as_integer ( ) programid = am_entry . get_value_by_name ( self . _AMCACHE_PROGRAMID ) if programid : event_data . programid = programid . get_data_as_string ( ) event = time_events . DateTimeValuesEvent ( filetime . Filetime ( amcache_datetime ) , definitions . TIME_DESCRIPTION_MODIFICATION ) parser_mediator . ProduceEventWithEventData ( event , event_data ) if event_data . createdts : event = time_events . DateTimeValuesEvent ( filetime . Filetime ( event_data . createdts ) , definitions . TIME_DESCRIPTION_CREATION ) parser_mediator . ProduceEventWithEventData ( event , event_data ) if event_data . lastmodifiedts : event = time_events . DateTimeValuesEvent ( filetime . Filetime ( event_data . lastmodifiedts ) , definitions . TIME_DESCRIPTION_MODIFICATION ) parser_mediator . ProduceEventWithEventData ( event , event_data ) if event_data . linkerts : event = time_events . DateTimeValuesEvent ( posix_time . PosixTime ( event_data . linkerts ) , definitions . TIME_DESCRIPTION_CHANGE ) parser_mediator . ProduceEventWithEventData ( event , event_data )
Parses an Amcache Root/File key for events.

    Args:
      am_entry (pyregf.key): amcache File key.
      parser_mediator (ParserMediator): mediates interactions between parsers
          and other components, such as storage and dfvfs.