diff --git a/volatility/framework/objects/utility.py b/volatility/framework/objects/utility.py index 77c8c7910..187cf515a 100644 --- a/volatility/framework/objects/utility.py +++ b/volatility/framework/objects/utility.py @@ -42,9 +42,13 @@ def array_of_pointers(array: objects.Array, return array.cast("array", count = count, subtype = subtype_pointer) -def wintime_to_datetime(wintime: objects.Struct) -> typing.Union[renderers.NotApplicableValue, datetime.datetime]: +def wintime_to_datetime(wintime: objects.Struct) -> typing.Union[ + interfaces.renderers.BaseAbsentValue, datetime.datetime]: unix_time = wintime.QuadPart // 10000000 if unix_time == 0: return renderers.NotApplicableValue() unix_time = unix_time - 11644473600 - return datetime.datetime.utcfromtimestamp(unix_time) + try: + return datetime.datetime.utcfromtimestamp(unix_time) + except ValueError: + return renderers.UnparsableValue()