Module Expr Str Import alias Import alias ImportFrom alias ImportFrom alias ImportFrom alias ImportFrom alias ImportFrom alias ImportFrom alias identifier ImportFrom alias ImportFrom alias ImportFrom alias ClassDef bases AttributeLoad NameLoad attr body Assign NameStore AttributeLoad NameLoad attr decorator_list ClassDef bases AttributeLoad NameLoad attr body Expr Str Assign NameStore Str Assign NameStore NameLoad Assign NameStore BinOpAdd AttributeLoad AttributeLoad NameLoad attr attr Str FunctionDef arguments args NameParam defaults body Expr Str Expr Call AttributeLoad AttributeLoad NameLoad attr attr Str Num Expr Call AttributeLoad AttributeLoad NameLoad attr attr Str ListLoad If AttributeLoad AttributeLoad AttributeLoad NameLoad attr attr attr body Expr Call AttributeLoad AttributeLoad AttributeLoad NameLoad attr attr attr AttributeLoad AttributeLoad AttributeLoad NameLoad attr attr attr If CompareIsNot AttributeLoad AttributeLoad NameLoad attr attr NameLoad body Assign AttributeStore AttributeLoad NameLoad attr attr Call AttributeLoad AttributeLoad NameLoad attr attr AttributeLoad AttributeLoad AttributeLoad NameLoad attr attr attr Str keyword AttributeLoad NameLoad attr If UnaryOpNot AttributeLoad AttributeLoad NameLoad attr attr body Assign AttributeStore AttributeLoad NameLoad attr attr Call AttributeLoad NameLoad attr AttributeLoad AttributeLoad AttributeLoad NameLoad attr attr attr If UnaryOpNot AttributeLoad AttributeLoad NameLoad attr attr body Raise Call AttributeLoad NameLoad attr Str Assign NameStore ListLoad Str If AttributeLoad AttributeLoad AttributeLoad NameLoad attr attr attr body Expr Call AttributeLoad NameLoad attr Str For NameStore AttributeLoad AttributeLoad NameLoad attr attr body For NameStore NameLoad body Expr Call AttributeLoad NameLoad attr Str keyword ListLoad Call AttributeLoad AttributeLoad NameLoad attr attr NameLoad NameLoad keyword AttributeLoad AttributeLoad AttributeLoad NameLoad attr attr attr keyword Call AttributeLoad NameLoad attr keyword AttributeLoad AttributeLoad AttributeLoad NameLoad attr attr attr keyword Str decorator_list Call AttributeLoad NameLoad attr keyword Str FunctionDef arguments args NameParam NameParam defaults body Expr Str If NameLoad body For NameStore NameLoad body Assign NameStore Call AttributeLoad AttributeLoad NameLoad attr attr AttributeLoad AttributeLoad NameLoad attr attr keyword AttributeLoad NameLoad attr Assign NameStore Call AttributeLoad NameLoad attr NameLoad Assign NameStore Num For TupleStore NameStore NameStore NameStore NameStore NameStore NameStore Call AttributeLoad NameLoad attr body AugAssignAdd NameStore Num Assign NameStore BinOpMod Str TupleLoad Call AttributeLoad AttributeLoad NameLoad attr attr BinOpDiv NameLoad Num NameLoad NameLoad NameLoad NameLoad NameLoad If CompareIsNot AttributeLoad AttributeLoad NameLoad attr attr NameLoad body Expr Call AttributeLoad AttributeLoad AttributeLoad NameLoad attr attr attr BinOpAdd Call AttributeLoad NameLoad attr NameLoad Str Expr Call AttributeLoad NameLoad attr Str NameLoad AttributeLoad AttributeLoad AttributeLoad NameLoad attr attr attr Call AttributeLoad AttributeLoad AttributeLoad NameLoad attr attr attr AugAssignAdd AttributeStore AttributeLoad NameLoad attr attr NameLoad decorator_list Call AttributeLoad NameLoad attr FunctionDef arguments args NameParam NameParam defaults body Expr Str Assign NameStore Call AttributeLoad AttributeLoad NameLoad attr attr AttributeLoad NameLoad attr keyword AttributeLoad NameLoad attr Assign NameStore Call AttributeLoad NameLoad attr AttributeLoad AttributeLoad NameLoad attr attr Assign NameStore Call AttributeLoad NameLoad attr NameLoad NameLoad If UnaryOpNot NameLoad body Expr Call AttributeLoad NameLoad attr Call AttributeLoad Str attr NameLoad Return Assign NameStore ListLoad If CompareEq NameLoad Str body Assign NameStore Str For NameStore ListLoad Str Str body Expr Call AttributeLoad NameLoad attr Call AttributeLoad NameLoad attr keyword AttributeLoad AttributeLoad NameLoad attr attr keyword NameLoad orelse If CompareEq NameLoad Str body Assign NameStore Str For NameStore ListLoad Str Str body Expr Call AttributeLoad NameLoad attr Call AttributeLoad NameLoad attr keyword AttributeLoad NameLoad attr keyword NameLoad orelse If CompareEq NameLoad Str body Assign NameStore Str For NameStore ListLoad Str Str body Expr Call AttributeLoad NameLoad attr Call AttributeLoad NameLoad attr keyword AttributeLoad NameLoad attr keyword NameLoad orelse Raise Call NameLoad Str Return NameLoad decorator_list decorator_list ClassDef bases AttributeLoad NameLoad attr body Assign NameStore AttributeLoad NameLoad attr decorator_list ClassDef bases AttributeLoad NameLoad attr body Expr Str Assign NameStore Str Assign NameStore NameLoad Assign NameStore BinOpAdd AttributeLoad AttributeLoad NameLoad attr attr Str FunctionDef arguments args NameParam defaults body Expr Str Expr Call AttributeLoad AttributeLoad NameLoad attr attr Str Num Expr Call AttributeLoad AttributeLoad NameLoad attr attr Str ListLoad If AttributeLoad AttributeLoad NameLoad attr attr body Expr Call AttributeLoad AttributeLoad AttributeLoad NameLoad attr attr attr AttributeLoad AttributeLoad NameLoad attr attr orelse Assign AttributeStore AttributeLoad NameLoad attr attr Call AttributeLoad NameLoad attr AttributeLoad AttributeLoad NameLoad attr attr If UnaryOpNot AttributeLoad AttributeLoad NameLoad attr attr body Raise Call AttributeLoad NameLoad attr Str If CompareIsNot AttributeLoad AttributeLoad NameLoad attr attr NameLoad body Assign AttributeStore AttributeLoad NameLoad attr attr Call AttributeLoad AttributeLoad NameLoad attr attr AttributeLoad AttributeLoad AttributeLoad NameLoad attr attr attr Str keyword AttributeLoad NameLoad attr Assign NameStore Str For NameStore AttributeLoad AttributeLoad NameLoad attr attr body Expr Call AttributeLoad NameLoad attr Str keyword ListLoad Call AttributeLoad AttributeLoad NameLoad attr attr NameLoad Str NameLoad keyword AttributeLoad AttributeLoad AttributeLoad NameLoad attr attr attr keyword Call AttributeLoad NameLoad attr keyword AttributeLoad AttributeLoad AttributeLoad NameLoad attr attr attr keyword Str decorator_list Call AttributeLoad NameLoad attr keyword Str FunctionDef arguments args NameParam NameParam defaults body Expr Str If NameLoad body For NameStore NameLoad body Assign NameStore Call AttributeLoad AttributeLoad NameLoad attr attr AttributeLoad AttributeLoad NameLoad attr attr keyword AttributeLoad NameLoad attr Assign NameStore Call AttributeLoad NameLoad attr NameLoad Assign NameStore Num For TupleStore NameStore NameStore NameStore NameStore Call AttributeLoad NameLoad attr body AugAssignAdd NameStore Num Assign NameStore BinOpMod Str TupleLoad Call AttributeLoad AttributeLoad NameLoad attr attr BinOpDiv NameLoad Num NameLoad NameLoad NameLoad If CompareIsNot AttributeLoad AttributeLoad NameLoad attr attr NameLoad body Expr Call AttributeLoad AttributeLoad AttributeLoad NameLoad attr attr attr BinOpAdd Call AttributeLoad NameLoad attr NameLoad Str Expr Call AttributeLoad NameLoad attr Str NameLoad AttributeLoad AttributeLoad NameLoad attr attr Call AttributeLoad AttributeLoad AttributeLoad NameLoad attr attr attr AugAssignAdd AttributeStore AttributeLoad NameLoad attr attr NameLoad decorator_list Call AttributeLoad NameLoad attr FunctionDef arguments args NameParam NameParam defaults body Expr Str Assign NameStore Call AttributeLoad AttributeLoad NameLoad attr attr AttributeLoad NameLoad attr keyword AttributeLoad NameLoad attr Assign NameStore Call AttributeLoad NameLoad attr AttributeLoad AttributeLoad NameLoad attr attr Assign NameStore Call AttributeLoad NameLoad attr NameLoad NameLoad If UnaryOpNot NameLoad body Expr Call AttributeLoad NameLoad attr Call AttributeLoad Str attr NameLoad Return Assign NameStore ListLoad If CompareEq NameLoad Str body Assign NameStore Str Expr Call AttributeLoad NameLoad attr Call AttributeLoad NameLoad attr keyword AttributeLoad AttributeLoad NameLoad attr attr orelse If CompareEq NameLoad Str body Assign NameStore Str Expr Call AttributeLoad NameLoad attr Call AttributeLoad NameLoad attr keyword AttributeLoad NameLoad attr orelse If CompareEq NameLoad Str body Assign NameStore Str Expr Call AttributeLoad NameLoad attr Call AttributeLoad NameLoad attr keyword AttributeLoad NameLoad attr orelse Raise Call NameLoad Str Return NameLoad decorator_list decorator_list Assign NameStore Dict Str Str Str Dict Str Str ListLoad Str ListLoad Str Str Dict Str Str Str ListLoad Str Str ListLoad Str ListLoad Str Str Str Dict Str Str ListLoad Str ListLoad Str Str ClassDef bases AttributeLoad NameLoad attr body Assign NameStore AttributeLoad NameLoad attr decorator_list ClassDef bases AttributeLoad NameLoad attr body Expr Str Assign NameStore Str Assign NameStore NameLoad Assign NameStore BinOpAdd AttributeLoad AttributeLoad NameLoad attr attr Str FunctionDef arguments args NameParam defaults body Expr Str Assign NameStore Call AttributeLoad AttributeLoad NameLoad attr attr AttributeLoad NameLoad attr keyword AttributeLoad NameLoad attr Assign NameStore Call AttributeLoad NameLoad attr AttributeLoad AttributeLoad NameLoad attr attr Assign NameStore Call AttributeLoad NameLoad attr NameLoad Expr Call AttributeLoad AttributeLoad NameLoad attr attr Str ListLoad If AttributeLoad AttributeLoad NameLoad attr attr body AugAssignAdd AttributeStore AttributeLoad NameLoad attr attr Call AttributeLoad NameLoad attr Str ListLoad If AttributeLoad AttributeLoad NameLoad attr attr body AugAssignAdd AttributeStore AttributeLoad NameLoad attr attr Call AttributeLoad NameLoad attr Str ListLoad If AttributeLoad AttributeLoad NameLoad attr attr body AugAssignAdd AttributeStore AttributeLoad NameLoad attr attr Call AttributeLoad NameLoad attr Str ListLoad If UnaryOpNot AttributeLoad AttributeLoad NameLoad attr attr body Raise Call AttributeLoad NameLoad attr BinOpMod Str NameLoad Expr Call AttributeLoad AttributeLoad NameLoad attr attr Str ListLoad For NameStore AttributeLoad AttributeLoad NameLoad attr attr body Assign NameStore Call AttributeLoad NameLoad attr NameLoad NameLoad If UnaryOpNot NameLoad body Raise Call AttributeLoad NameLoad attr BinOpMod Str NameLoad Expr Call AttributeLoad AttributeLoad AttributeLoad NameLoad attr attr attr NameLoad Expr Call AttributeLoad NameLoad attr keyword Str decorator_list Call AttributeLoad NameLoad attr keyword Str FunctionDef arguments args NameParam defaults body Expr Str Assign NameStore Call AttributeLoad AttributeLoad NameLoad attr attr AttributeLoad NameLoad attr keyword AttributeLoad NameLoad attr If CompareIsNot AttributeLoad AttributeLoad NameLoad attr attr NameLoad body Expr Call AttributeLoad AttributeLoad AttributeLoad NameLoad attr attr attr Call AttributeLoad AttributeLoad AttributeLoad AttributeLoad NameLoad attr attr attr attr Call AttributeLoad Str attr AttributeLoad AttributeLoad NameLoad attr attr Assign NameStore ListComp BinOpMod Str TupleLoad AttributeLoad NameLoad attr AttributeLoad NameLoad attr comprehension NameStore AttributeLoad AttributeLoad NameLoad attr attr Assign NameStore ListComp Call AttributeLoad NameLoad attr Str comprehension NameStore NameLoad Assign NameStore Call AttributeLoad NameLoad attr keyword AttributeLoad AttributeLoad AttributeLoad NameLoad attr attr attr keyword Call AttributeLoad NameLoad attr keyword AttributeLoad AttributeLoad NameLoad attr attr keyword AttributeLoad AttributeLoad AttributeLoad NameLoad attr attr attr For NameStore AttributeLoad AttributeLoad NameLoad attr attr body Assign NameStore Call AttributeLoad NameLoad attr NameLoad NameLoad keyword NameLoad For NameStore NameLoad body Expr Call AttributeLoad NameLoad attr Str keyword ListLoad Call AttributeLoad AttributeLoad NameLoad attr attr NameLoad Str keyword AttributeLoad AttributeLoad AttributeLoad NameLoad attr attr attr keyword ListLoad NameLoad keyword Call AttributeLoad NameLoad attr keyword AttributeLoad AttributeLoad AttributeLoad NameLoad attr attr attr keyword Str decorator_list Call AttributeLoad NameLoad attr keyword Str FunctionDef arguments args NameParam NameParam defaults body Expr Str For NameStore NameLoad body Expr Call AttributeLoad NameLoad attr AttributeLoad NameLoad attr decorator_list Call AttributeLoad NameLoad attr decorator_list
N/A N/A Flow to recover history files. N/A datetime N/A os grr.lib aff4 grr.lib flow grr.lib flow_utils grr.lib utils grr.lib.flows.general file_finder grr.lib.rdfvalues structs rdf_structs grr.parsers chrome_history grr.parsers firefox3_history grr.proto flows_pb2 ChromeHistoryArgs N/A N/A rdf_structs RDFProtoStruct N/A N/A protobuf N/A flows_pb2 ChromeHistoryArgs N/A ChromeHistory N/A N/A flow GRRFlow N/A N/A Retrieve and analyze the chrome history for a machine.

  Default directories as per:
    http://www.chromium.org/user-experience/user-data-directory

  Windows XP
  Google Chrome:
  c:\Documents and Settings\<username>\Local Settings\Application Data\
    Google\Chrome\User Data\Default

  Windows 7 or Vista
  c:\Users\<username>\AppData\Local\Google\Chrome\User Data\Default

  Mac OS X
  /Users/<user>/Library/Application Support/Google/Chrome/Default

  Linux
  /home/<user>/.config/google-chrome/Default
   N/A category /Browser/ N/A args_type ChromeHistoryArgs N/A behaviours N/A N/A N/A flow GRRFlow behaviours BASIC Start N/A N/A self N/A N/A N/A Determine the Chrome directory. N/A N/A N/A N/A self state Register hist_count 0 N/A N/A N/A N/A self state Register history_paths N/A N/A N/A N/A N/A self state args history_path N/A N/A N/A N/A N/A N/A self state history_paths append N/A N/A N/A self state args history_path N/A N/A N/A N/A self runner output None N/A N/A N/A N/A self runner output N/A N/A N/A aff4 FACTORY Create N/A N/A N/A self runner output urn VFSAnalysisFile token N/A self token N/A N/A N/A N/A self state history_paths N/A N/A N/A N/A self state history_paths N/A N/A self GuessHistoryPaths N/A N/A N/A self state args username N/A N/A N/A N/A self state history_paths N/A N/A N/A N/A flow FlowError Could not find valid History paths. N/A filenames N/A History N/A N/A N/A N/A self state args get_archive N/A N/A N/A N/A filenames append Archived History N/A path N/A N/A self state history_paths N/A N/A fname filenames N/A N/A N/A N/A self CallFlow FileFinder paths N/A N/A N/A N/A os path join path fname pathtype N/A N/A N/A self state args pathtype action N/A N/A file_finder FileFinderAction action_type N/A N/A N/A file_finder FileFinderAction Action DOWNLOAD next_state ParseFiles N/A N/A N/A flow StateHandler next_state ParseFiles ParseFiles N/A N/A self responses N/A N/A N/A Take each file we retrieved and get the history from it. N/A responses N/A N/A response responses N/A N/A fd N/A N/A N/A aff4 FACTORY Open N/A N/A response stat_entry aff4path token N/A self token N/A hist N/A N/A chrome_history ChromeParser fd N/A count 0 N/A N/A epoch64 dtype url dat1 dat2 dat3 N/A N/A hist Parse N/A N/A count 1 N/A str_entry N/A %s %s %s %s %s %s N/A N/A N/A N/A datetime datetime utcfromtimestamp N/A epoch64 1000000.0 url dat1 dat2 dat3 dtype N/A N/A N/A N/A self runner output None N/A N/A N/A N/A N/A N/A self runner output write N/A N/A N/A utils SmartStr str_entry N/A N/A N/A self Log Wrote %d Chrome History entries for user %s from %s count N/A N/A N/A self state args username N/A N/A N/A N/A response stat_entry pathspec Basename N/A N/A N/A self state hist_count count N/A N/A N/A flow StateHandler GuessHistoryPaths N/A N/A self username N/A N/A N/A Take a user and return guessed full paths to History files.

    Args:
      username: Username as string.

    Returns:
      A list of strings containing paths to look for history files in.

    Raises:
      OSError: On invalid system in the Schema
     N/A client N/A N/A N/A aff4 FACTORY Open N/A self client_id token N/A self token N/A system N/A N/A client Get N/A N/A client Schema SYSTEM N/A user_info N/A N/A flow_utils GetUserInfo client username N/A N/A user_info N/A N/A N/A N/A self Error N/A N/A Could not find homedir for user {0} format username N/A N/A paths N/A N/A N/A system Windows N/A N/A path {app_data}\{sw}\User Data\Default\ N/A sw_path N/A Google\Chrome Chromium N/A N/A N/A N/A paths append N/A N/A path format app_data N/A N/A user_info special_folders local_app_data sw sw_path N/A N/A N/A system Linux N/A N/A path {homedir}/.config/{sw}/Default/ N/A sw_path N/A google-chrome chromium N/A N/A N/A N/A paths append N/A N/A path format homedir N/A user_info homedir sw sw_path N/A N/A N/A system Darwin N/A N/A path {homedir}/Library/Application Support/{sw}/Default/ N/A sw_path N/A Google/Chrome Chromium N/A N/A N/A N/A paths append N/A N/A path format homedir N/A user_info homedir sw sw_path N/A N/A N/A OSError Invalid OS for Chrome History N/A paths N/A N/A FirefoxHistoryArgs N/A N/A rdf_structs RDFProtoStruct N/A N/A protobuf N/A flows_pb2 FirefoxHistoryArgs N/A FirefoxHistory N/A N/A flow GRRFlow N/A N/A Retrieve and analyze the Firefox history for a machine.

  Default directories as per:
    http://www.forensicswiki.org/wiki/Mozilla_Firefox_3_History_File_Format

  Windows XP
    C:\Documents and Settings\<username>\Application Data\Mozilla\
      Firefox\Profiles\<profile folder>\places.sqlite

  Windows Vista
    C:\Users\<user>\AppData\Roaming\Mozilla\Firefox\Profiles\
      <profile folder>\places.sqlite

  GNU/Linux
    /home/<user>/.mozilla/firefox/<profile folder>/places.sqlite

  Mac OS X
    /Users/<user>/Library/Application Support/Firefox/Profiles/
      <profile folder>/places.sqlite
   N/A category /Browser/ N/A args_type FirefoxHistoryArgs N/A behaviours N/A N/A N/A flow GRRFlow behaviours BASIC Start N/A N/A self N/A N/A N/A Determine the Firefox history directory. N/A N/A N/A N/A self state Register hist_count 0 N/A N/A N/A N/A self state Register history_paths N/A N/A N/A N/A self args history_path N/A N/A N/A N/A N/A N/A self state history_paths append N/A N/A self args history_path N/A N/A N/A N/A self state history_paths N/A N/A self GuessHistoryPaths N/A N/A self args username N/A N/A N/A N/A self state history_paths N/A N/A N/A N/A flow FlowError Could not find valid History paths. N/A N/A N/A N/A self runner output None N/A N/A N/A N/A self runner output N/A N/A N/A aff4 FACTORY Create N/A N/A N/A self runner output urn VFSAnalysisFile token N/A self token N/A filename places.sqlite N/A path N/A N/A self state history_paths N/A N/A N/A N/A self CallFlow FileFinder paths N/A N/A N/A N/A os path join path **2 filename pathtype N/A N/A N/A self state args pathtype action N/A N/A file_finder FileFinderAction action_type N/A N/A N/A file_finder FileFinderAction Action DOWNLOAD next_state ParseFiles N/A N/A N/A flow StateHandler next_state ParseFiles ParseFiles N/A N/A self responses N/A N/A N/A Take each file we retrieved and get the history from it. N/A responses N/A N/A response responses N/A N/A fd N/A N/A N/A aff4 FACTORY Open N/A N/A response stat_entry aff4path token N/A self token N/A hist N/A N/A firefox3_history Firefox3History fd N/A count 0 N/A N/A epoch64 dtype url dat1 N/A N/A hist Parse N/A N/A count 1 N/A str_entry N/A %s %s %s %s N/A N/A N/A N/A datetime datetime utcfromtimestamp N/A epoch64 1000000.0 url dat1 dtype N/A N/A N/A N/A self runner output None N/A N/A N/A N/A N/A N/A self runner output write N/A N/A N/A utils SmartStr str_entry N/A N/A N/A self Log Wrote %d Firefox History entries for user %s from %s count N/A N/A self args username N/A N/A N/A N/A response stat_entry pathspec Basename N/A N/A N/A self state hist_count count N/A N/A N/A flow StateHandler GuessHistoryPaths N/A N/A self username N/A N/A N/A Take a user and return guessed full paths to History files.

    Args:
      username: Username as string.

    Returns:
      A list of strings containing paths to look for history files in.

    Raises:
      OSError: On invalid system in the Schema
     N/A fd N/A N/A N/A aff4 FACTORY Open N/A self client_id token N/A self token N/A system N/A N/A fd Get N/A N/A fd Schema SYSTEM N/A user_info N/A N/A flow_utils GetUserInfo fd username N/A N/A user_info N/A N/A N/A N/A self Error N/A N/A Could not find homedir for user {0} format username N/A N/A paths N/A N/A N/A system Windows N/A N/A path {app_data}\Mozilla\Firefox\Profiles/ N/A N/A N/A paths append N/A N/A path format app_data N/A N/A user_info special_folders app_data N/A N/A N/A system Linux N/A N/A path {homedir}/.mozilla/firefox/ N/A N/A N/A paths append N/A N/A path format homedir N/A user_info homedir N/A N/A N/A system Darwin N/A N/A path {homedir}/Library/Application Support/Firefox/Profiles/ N/A N/A N/A paths append N/A N/A path format homedir N/A user_info homedir N/A N/A N/A OSError Invalid OS for Chrome History N/A paths N/A N/A N/A BROWSER_PATHS N/A Linux Windows Darwin N/A Firefox Chrome N/A /home/{username}/.mozilla/firefox/ N/A {homedir}/.config/google-chrome/ {homedir}/.config/chromium/ N/A Chrome Firefox IE N/A {local_app_data}\Google\Chrome\User Data\ {local_app_data}\Chromium\User Data\ N/A {local_app_data}\Mozilla\Firefox\Profiles\ N/A {cache}\ {cache}\Low\ {app_data}\Microsoft\Windows\ N/A Firefox Chrome N/A {homedir}/Library/Application Support/Firefox/Profiles/ N/A {homedir}/Library/Application Support/Google/Chrome/ {homedir}/Library/Application Support/Chromium/ CacheGrepArgs N/A N/A rdf_structs RDFProtoStruct N/A N/A protobuf N/A flows_pb2 CacheGrepArgs N/A CacheGrep N/A N/A flow GRRFlow N/A N/A Grep the browser profile directories for a regex.

  This will check Chrome, Firefox and Internet Explorer profile directories.
  Note that for each directory we get a maximum of 50 hits returned.
   N/A category /Browser/ N/A args_type CacheGrepArgs N/A behaviours N/A N/A N/A flow GRRFlow behaviours BASIC Start N/A N/A self N/A N/A N/A Redirect to start on the workers and not in the UI. N/A client N/A N/A N/A aff4 FACTORY Open N/A self client_id token N/A self token N/A system N/A N/A client Get N/A N/A client Schema SYSTEM N/A paths N/A N/A BROWSER_PATHS get system N/A N/A N/A N/A self state Register all_paths N/A N/A N/A N/A self args check_chrome N/A N/A N/A N/A self state all_paths N/A N/A paths get Chrome N/A N/A N/A N/A self args check_ie N/A N/A N/A N/A self state all_paths N/A N/A paths get IE N/A N/A N/A N/A self args check_firefox N/A N/A N/A N/A self state all_paths N/A N/A paths get Firefox N/A N/A N/A N/A N/A self state all_paths N/A N/A N/A N/A flow FlowError N/A Unsupported system %s for CacheGrep system N/A N/A N/A N/A self state Register users N/A N/A user N/A N/A self args grep_users N/A N/A user_info N/A N/A flow_utils GetUserInfo client user N/A N/A user_info N/A N/A N/A N/A flow FlowError N/A No such user %s user N/A N/A N/A N/A N/A self state users append user_info N/A N/A N/A self CallState next_state StartRequests N/A N/A N/A flow StateHandler next_state StartRequests StartRequests N/A N/A self N/A N/A N/A Generate and send the Find requests. N/A client N/A N/A N/A aff4 FACTORY Open N/A self client_id token N/A self token N/A N/A N/A N/A self runner output None N/A N/A N/A N/A N/A N/A self runner output Set N/A N/A N/A N/A N/A self runner output Schema DESCRIPTION N/A N/A CacheGrep for {0} format N/A N/A self args data_regex N/A usernames N/A N/A %s\%s N/A N/A u userdomain N/A u username N/A u N/A N/A self state users N/A usernames N/A N/A N/A u lstrip \ N/A u usernames N/A condition N/A N/A file_finder FileFinderCondition condition_type N/A N/A N/A file_finder FileFinderCondition Type CONTENTS_REGEX_MATCH contents_regex_match N/A N/A file_finder FileFinderContentsRegexMatchCondition regex N/A N/A self args data_regex mode N/A N/A N/A file_finder FileFinderContentsRegexMatchCondition Mode FIRST_HIT N/A path N/A N/A self state all_paths N/A N/A full_paths N/A N/A flow_utils InterpolatePath path client users usernames N/A full_path full_paths N/A N/A N/A N/A self CallFlow FileFinder paths N/A N/A N/A N/A os path join full_path **5 pathtype N/A N/A N/A self state args pathtype conditions N/A condition action N/A N/A file_finder FileFinderAction action_type N/A N/A N/A file_finder FileFinderAction Action DOWNLOAD next_state HandleResults N/A N/A N/A flow StateHandler next_state HandleResults HandleResults N/A N/A self responses N/A N/A N/A Take each file we retrieved and add it to the collection. N/A response responses N/A N/A N/A N/A self SendReply N/A response stat_entry N/A N/A N/A flow StateHandler N/A