# Buggy code
def __init__(
    self,
    timestamp,
    timestamp_description,
    cache_directories,
    msiecf_item,
    recovered=False,
):
    """Initializes the event.

    Args:
      timestamp: The timestamp value.
      timestamp_description: The usage string describing the timestamp.
      cache_directories: A list of cache directory names.
      msiecf_item: The MSIECF item (pymsiecf.url).
      recovered: Boolean value to indicate the item was recovered, False
                 by default.
    """
    super(MsiecfUrlEvent, self).__init__(timestamp, timestamp_description)

    self.recovered = recovered
    self.offset = msiecf_item.offset

    self.url = msiecf_item.location
    self.number_of_hits = msiecf_item.number_of_hits
    self.cached_filename = msiecf_item.filename
    self.cached_file_size = msiecf_item.cached_file_size

    self.cache_directory_index = msiecf_item.cache_directory_index
    if (
        msiecf_item.cache_directory_index >= 0
        and msiecf_item.cache_directory_index < len(cache_directories)
    ):
        self.cache_directory_name = cache_directories[msiecf_item.cache_directory_index]

    if msiecf_item.type and msiecf_item.data:
        if msiecf_item.type == "cache":
            if msiecf_item.data[:4] == b"HTTP":
                self.http_headers = msiecf_item.data[:-1]


# Traceback (UnicodeDecodeError)
$ psort.py -o L2tcsv analyst018.db -w l2t_csv
[INFO] Data files will be loaded from /usr/share/plaso by default.
Traceback (most recent call last):
File "/usr/bin/psort.py", line 646, in <module>
if not Main():
File "/usr/bin/psort.py", line 641, in Main
tool.ProcessStorage()
File "/usr/bin/psort.py", line 593, in ProcessStorage
self._ProcessStorage()
File "/usr/bin/psort.py", line 236, in _ProcessStorage
time_slice=time_slice, use_time_slicer=self._use_time_slicer)
File "/usr/lib/python2.7/dist-packages/plaso/frontend/psort.py", line 422, in ProcessStorage
analysis_queues=event_queue_producers)
File "/usr/lib/python2.7/dist-packages/plaso/output/interface.py", line 241, in __exit__
self.End()
File "/usr/lib/python2.7/dist-packages/plaso/output/interface.py", line 233, in End
self.Flush()
File "/usr/lib/python2.7/dist-packages/plaso/output/interface.py", line 198, in Flush
self._output_module.WriteEvent(event_object)
File "/usr/lib/python2.7/dist-packages/plaso/output/interface.py", line 55, in WriteEvent
self.WriteEventBody(event_object)
File "/usr/lib/python2.7/dist-packages/plaso/output/l2t_csv.py", line 77, in WriteEventBody
event_object)
File "/usr/lib/python2.7/dist-packages/plaso/output/mediator.py", line 122, in GetFormattedMessages
return event_formatter.GetMessages(self._formatter_mediator, event_object)
File "/usr/lib/python2.7/dist-packages/plaso/formatters/msiecf.py", line 34, in GetMessages
event_values[u'http_headers'] = http_headers.replace(u'\r\n', u' - ')
UnicodeDecodeError: 'ascii' codec can't decode byte 0xde in position 115: ordinal not in range(128)

# Fixed code
def __init__(
    self,
    timestamp,
    timestamp_description,
    cache_directories,
    msiecf_item,
    http_headers="",
    recovered=False,
):
    """Initializes the event.

    Args:
      timestamp: the timestamp which is an integer containing the number
                 of micro seconds since January 1, 1970, 00:00:00 UTC.
      timestamp_description: the usage string for the timestamp value.
      cache_directories: a list of cache directory names.
      msiecf_item: the MSIECF item (pymsiecf.url).
      http_headers: a string containing the HTTP headers.
      recovered: a boolean value to indicate the item was recovered.
    """
    super(MsiecfUrlEvent, self).__init__(timestamp, timestamp_description)

    self.cache_directory_index = msiecf_item.cache_directory_index
    self.cached_filename = msiecf_item.filename
    self.cached_file_size = msiecf_item.cached_file_size
    self.http_headers = http_headers
    self.number_of_hits = msiecf_item.number_of_hits
    self.offset = msiecf_item.offset
    self.recovered = recovered
    self.url = msiecf_item.location

    if (
        msiecf_item.cache_directory_index >= 0
        and msiecf_item.cache_directory_index < len(cache_directories)
    ):
        self.cache_directory_name = cache_directories[msiecf_item.cache_directory_index]