|
| 1 | +Working with Records |
| 2 | +==================== |
| 3 | + |
| 4 | +This section describes how to work with records. Records are the fundamental data structure in ``dissect`` and are |
| 5 | +used to describe forensic evidence and artefacts in a structured way. They can be read from and written to various |
| 6 | +sources and formats. |
| 7 | + |
| 8 | +Writing Records with rdump |
| 9 | +-------------------------- |
| 10 | + |
| 11 | +The easiest way to write records is by using the :doc:`/tools/rdump` tool. It allows you to read records from any |
| 12 | +source, filter them, and write them to a new destination. |
| 13 | + |
| 14 | +The output format is determined by the ``-w/--writer`` argument. You can specify a filename, and ``rdump`` will |
| 15 | +automatically detect the desired output format and compression based on the file extension. |
| 16 | + |
| 17 | +For example, to write records to a gzip-compressed file, you can use: |
| 18 | + |
| 19 | +.. code-block:: console |
| 20 | +
|
| 21 | + $ rdump <source> -w output.rec.gz |
| 22 | +
|
| 23 | +Writing Records with Python |
| 24 | +--------------------------- |
| 25 | + |
| 26 | +For more advanced use-cases, you can use the :class:`flow.record.RecordWriter` class in your own Python scripts. This |
| 27 | +gives you full control over how and where records are written. |
| 28 | + |
| 29 | +The ``RecordWriter`` is best used as a context manager. It takes a URI as its main argument, which specifies the |
| 30 | +adapter and any options to use. |
| 31 | + |
| 32 | +Here's an example of writing records to a JSON file: |
| 33 | + |
| 34 | +.. code-block:: python |
| 35 | +
|
| 36 | + from flow.record import RecordWriter, Record |
| 37 | +
|
| 38 | + records = [ |
| 39 | + Record(myfield="value1"), |
| 40 | + Record(myfield="value2"), |
| 41 | + ] |
| 42 | +
|
| 43 | + with RecordWriter("jsonfile://output.json?indent=2") as writer: |
| 44 | + for record in records: |
| 45 | + writer.write(record) |
| 46 | +
|
| 47 | +Adapters |
| 48 | +-------- |
| 49 | + |
| 50 | +The ``RecordWriter`` uses adapters to write to different formats. The adapter is selected based on the scheme of the |
| 51 | +URI passed to the ``RecordWriter``. |
| 52 | + |
| 53 | +Some common adapters include: |
| 54 | + |
| 55 | +* ``file``: The default record stream format. |
| 56 | +* ``csvfile``: For writing CSV files. |
| 57 | +* ``jsonfile``: For writing JSON or JSONL files. |
| 58 | +* ``line``: For writing to the console in a human-readable format. |
| 59 | + |
| 60 | +You can get a full list of available adapters by running ``rdump --list-adapters``. |
| 61 | + |
| 62 | +.. seealso:: |
| 63 | + |
| 64 | + For more information about the ``flow.record`` library, please refer to the :doc:`/projects/flow.record` page. |
0 commit comments