LibForensics v0.3 API Documentation¶

Contents:

• 1. Framework Core
  • 1.1. lf.dec — Digital Evidence Containers
  • 1.2. lf.dtypes — Data Types
  • 1.3. lf.dtypes.ctypes — Extract native ctypes types
  • 1.4. lf.time — Converters for various time formats
• 2. Common Microsoft Windows Functionality
  • 2.1. lf.win.dtypes — Common Microsoft Windows data types
  • 2.2. lf.win.ctypes — Common Microsoft Windows ctypes
  • 2.3. lf.win.objects — Common Microsoft Windows objects and converters
  • 2.4. lf.win.consts.font — Windows font constants
  • 2.5. lf.win.consts.fs — Generic file system constants
  • 2.6. lf.win.consts.lcid — Locale ID (LCID) constants
  • 2.7. lf.win.consts.npt — Constants for network provider types
  • 2.8. lf.win.consts.hotkey — Hot key constants
  • 2.9. lf.win.consts.vkcode — Virtual key code constants
  • 2.10. lf.win.codepage — Microsoft Windows OEM code pages 720 and 858
  • 2.11. lf.win.codepage.consts — Code page constants
  • 2.12. lf.win.con.objects — Windows console objects
  • 2.13. lf.win.con.consts — Windows console constants
  • 2.14. lf.win.con.dtypes — Windows console data types
  • 2.15. lf.win.con.ctypes — Windows console ctypes
• 3. Windows Shell Artifacts
  • 3.1. lf.win.shell.objects — Objects for Windows shell artifacts
  • 3.2. lf.win.shell.consts.csidl — Constants for CSIDLs
  • 3.3. lf.win.shell.consts.knownfolders — Constants for Vista Known Folders
  • 3.4. lf.win.shell.consts.showwin — Window state contants
  • 3.5. lf.win.shell.link — Shell link (.lnk) files
  • 3.6. lf.win.shell.link.consts — Link file constants
  • 3.7. lf.win.shell.link.dtypes — Data types for working with link files
  • 3.8. lf.win.shell.link.ctypes — Link file ctypes
  • 3.9. lf.win.shell.recyclebin — Recycle bin (INFO2)
  • 3.10. lf.win.shell.recyclebin.dtypes — Data types for Recycle bin files
  • 3.11. lf.win.shell.recyclebin.ctypes — Recycle bin ctypes
  • 3.12. lf.win.shell.thumbsdb — Thumbnail cache (thumbs.db) files
  • 3.13. lf.win.shell.thumbsdb.dtypes — Data types for thumbs.db files
  • 3.14. lf.win.shell.thumbsdb.ctypes — Thumbs.db ctypes
• 4. OLE Artifacts
  • 4.1. lf.win.ole.varenum — Enumerations for OLE variant data types
  • 4.2. lf.win.ole.cfb — OLE structured storage (compound file binary)
  • 4.3. lf.win.ole.cfb.consts — OLE structured storage constants
  • 4.4. lf.win.ole.cfb.dtypes — OLE structured storage data types
  • 4.5. lf.win.ole.cfb.ctypes — OLE structured storage ctypes
  • 4.6. lf.win.ole.ps — OLE property sets
  • 4.7. lf.win.ole.ps.consts — Constants for OLE property sets
  • 4.8. lf.win.ole.ps.dtypes — OLE property set data types
  • 4.9. lf.win.ole.ps.ctypes — OLE property set ctypes
• 5. Microsoft Office Artifacts
  • 5.1. lf.apps.msoffice.shared — Shared Microsoft Office artifacts
  • 5.2. lf.apps.msoffice.shared.consts — Shared Microsoft Office constants
  • 5.3. lf.apps.msoffice.shared.dtypes — Shared Microsoft Office data types
  • 5.4. lf.apps.msoffice.shared.ctypes — Shared Microsoft Office ctypes

Indices and tables¶

• Index
• Module Index
• Search Page