AmCacheParser.py 文件源码

def make_windows_timestamp_value_getter(value_name):
    """
    return a function that fetches the value from the registry key
      as a Windows timestamp.
    """
    f = make_value_getter(value_name)
    def _value_getter(key):
        try:
            if key[0].get_value_by_name(value_name) != None:
                return parse_windows_timestamp(key[0].get_value_by_name(value_name).get_data_as_integer() or 0)
            else: return datetime.min
        except ValueError:
            return datetime.min
    return _value_getter