WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-17 20:35:40 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add a filename to STANDARD_INFORMATION timeline entries

Browse Source
This commit is contained in:
David McDonald
2025-04-04 17:46:46 -05:00
parent a0ca33b284
commit 39b3e76efc
1 changed files with 17 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/windows/mftscan.py
+17 -10
View File
@@ -234,17 +234,24 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
)
def generate_timeline(self):
for row in self._generator():
_depth, row_data = row
for record in self.enumerate_mft_records(
self.context, self.config_path, self.config["primary"]
):
fname = record.longest_filename()
# Only Output FN Records
if row_data[6] in ("FILE_NAME", "STANDARD_INFORMATION"):
filename = row_data[-1]
description = f"MFT {row_data[6]} entry for {filename}"
yield (description, timeliner.TimeLinerType.CREATED, row_data[7])
yield (description, timeliner.TimeLinerType.MODIFIED, row_data[8])
yield (description, timeliner.TimeLinerType.CHANGED, row_data[9])
yield (description, timeliner.TimeLinerType.ACCESSED, row_data[10])
for _, item in self.parse_standard_information_records(record):
description = f"MFT {item.attribute_type} entry for {fname}"
yield (description, timeliner.TimeLinerType.CREATED, item.created)
yield (description, timeliner.TimeLinerType.MODIFIED, item.modified)
yield (description, timeliner.TimeLinerType.CHANGED, item.updated)
yield (description, timeliner.TimeLinerType.ACCESSED, item.accessed)
for _, item in self.parse_filename_records(record):
description = f"MFT {item.attribute_type} entry for {item.filename}"
yield (description, timeliner.TimeLinerType.CREATED, item.created)
yield (description, timeliner.TimeLinerType.MODIFIED, item.modified)
yield (description, timeliner.TimeLinerType.CHANGED, item.updated)
yield (description, timeliner.TimeLinerType.ACCESSED, item.accessed)
def run(self):
return renderers.TreeGrid(