Plaso: the parser column is not the source code

The parser is one module

A timeline row can name the parser that emitted it, such as a prefetch parser or a Chrome history parser. That name is which module ran. It is narrower than the family the row belongs to.

If the parser cell is empty, write “parser not on this row.” Do not fill it with the short family code.

The short code is the family

The short source code groups rows: a file-system family, a registry family, a web-history family. Several parsers can sit in one family. Citing only the code does not say which parser produced the row.

Citing only the parser does not say you reviewed the rest of that family. A Chrome history parser row is not every browser artifact in the store.

What to file

File the parser name and the source code as two fields, plus display_name if you are naming the artifact. A sentence about “which tool read this” uses the parser. A sentence about “which family” uses the code.

Worked case: a family code read as one parser

A lab row shows source code WEBHIST and parser chrome history, display_name a History file. A draft says the web-history family means only that Chrome parser ran, so Firefox rows cannot exist. The store summary still lists another web-history parser with a count above zero.

The note quotes WEBHIST as the family and chrome history as the parser on this row. The other parser’s count is a different module in the same family. This row does not erase it.

Snippet

source code: WEBHIST
parser on this row: chrome history
display_name: a History file
other web-history parser count: above zero
write: this row is one parser
not: the family is only that parser

Diagram

Family and parser are different columns

The code groups. The parser names the module.

Source code
The family, such as web history. Several parsers can share it.
Parser
The module that produced this row.
Another parser in the family
A different row or a different count. Not cancelled by this one.
Empty parser cell
Say it was not on the row. Do not copy the code into it.

Check yourself

1. A row’s parser is chrome history and its source code is WEBHIST. What is chrome history?

2. Another web-history parser still has a count. What does this Chrome row imply about it?

3. The parser cell is empty and the source code is REG. What do you write for the parser?