RecentFileCache.bcf parser

RecentFileCache_parser.py

import binascii
import struct

class REC():
    def __init__(self):
        self.signature = b'\xfe\xff\xee\xff\x11\x22\x00\x00\x03\x00\x00\x00\x01\x00\x00\x00'
        self.data = open("RecentFileCache.bcf","rb").read()
        self.data_size = len(self.data)
        self.offset = 20

    def run(self):
        # https://github.com/libyal/assorted/blob/master/documentation/RecentFileCache.bcf%20format.asciidoc
        if self.signature == self.data[:16]:
            print("checksum : {}".format(self.data[16:20]))
        
            while self.offset < self.data_size:
                string_length = struct.unpack("<L",self.data[self.offset:self.offset+4])[0]
                string = self.data[self.offset+4:self.offset+4+string_length*2+2] # +2 == null byte (2bytes utf-16)
                print("string : {}".format(string.decode("utf-16-le")))
                self.offset = self.offset+4+string_length*2+2 # +2 == null byte (2bytes utf-16)

if __name__ == '__main__':
    a = REC()
    a.run()