def _ParseRecords(self, parser_mediator, evtx_file):
    """Parses Windows XML EventLog (EVTX) records.

    Args:
      parser_mediator (ParserMediator): mediates interactions between parsers
          and other components, such as storage and dfvfs.
      evtx_file (pyevt.file): Windows XML EventLog (EVTX) file.
    """
    # To handle errors when parsing a Windows XML EventLog (EVTX) file in the
    # most granular way the following code iterates over every event record.
    # The call to evt_file.get_record() and access to members of evt_record
    # should be called within a try-except.

    for record_index in range(evtx_file.number_of_records):
      if parser_mediator.abort:
        break

      try:
        evtx_record = evtx_file.get_record(record_index)
        self._ParseRecord(parser_mediator, record_index, evtx_record)

      except IOError as exception:
        parser_mediator.ProduceExtractionWarning(
            'unable to parse event record: {0:d} with error: {1!s}'.format(
                record_index, exception))

    for record_index in range(evtx_file.number_of_recovered_records):
      if parser_mediator.abort:
        break

      try:
        evtx_record = evtx_file.get_recovered_record(record_index)
        self._ParseRecord(
            parser_mediator, record_index, evtx_record, recovered=True)

      except IOError as exception:
        parser_mediator.ProduceExtractionWarning((
            'unable to parse recovered event record: {0:d} with error: '
            '{1!s}').format(record_index, exception))
def _ParseRecords ( self , parser_mediator , evtx_file ) : for record_index in range ( evtx_file . number_of_records ) : if parser_mediator . abort : break try : evtx_record = evtx_file . get_record ( record_index ) self . _ParseRecord ( parser_mediator , record_index , evtx_record ) except IOError as exception : parser_mediator . ProduceExtractionWarning ( 'unable to parse event record: {0:d} with error: {1!s}' . format ( record_index , exception ) ) for record_index in range ( evtx_file . number_of_recovered_records ) : if parser_mediator . abort : break try : evtx_record = evtx_file . get_recovered_record ( record_index ) self . _ParseRecord ( parser_mediator , record_index , evtx_record , recovered = True ) except IOError as exception : parser_mediator . ProduceExtractionWarning ( ( 'unable to parse recovered event record: {0:d} with error: ' '{1!s}' ) . format ( record_index , exception ) )
Parses Windows XML EventLog (EVTX) records.

    Args:
      parser_mediator (ParserMediator): mediates interactions between parsers
          and other components, such as storage and dfvfs.
      evtx_file (pyevt.file): Windows XML EventLog (EVTX) file.