WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-09 03:07:40 +02:00
Code Issues Packages Projects Releases Wiki Activity

Linux: Boottime timeliner: Rollback timeliner event type changes and use the created time for the boot time plugin

Browse Source
This commit is contained in:
Gustavo Moreira
2024-10-29 13:46:19 +11:00
parent 1651ecb1d7
commit 4895af47bd
2 changed files with 3 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/linux/boottime.py
+1 -1
View File
@@ -88,7 +88,7 @@ class Boottime(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface)
):
description = f"System boot time for time namespace {time_namespace_id}"
yield description, timeliner.TimeLinerType.BOOTTIME, boottime
yield description, timeliner.TimeLinerType.CREATED, boottime
def run(self):
columns = [
volatility3/framework/plugins/timeliner.py
+2 -11
View File
@@ -23,7 +23,6 @@ class TimeLinerType(enum.IntEnum):
MODIFIED = 2
ACCESSED = 3
CHANGED = 4
BOOTTIME = 5
class TimeLinerInterface(metaclass=abc.ABCMeta):
@@ -172,10 +171,6 @@ class Timeliner(interfaces.plugins.PluginInterface):
TimeLinerType.CHANGED,
renderers.NotApplicableValue(),
),
times.get(
TimeLinerType.BOOTTIME,
renderers.NotApplicableValue(),
),
],
)
)
@@ -183,11 +178,11 @@ class Timeliner(interfaces.plugins.PluginInterface):
# Write each entry because the body file doesn't need to be sorted
if fp:
times = self.timeline[(plugin_name, item)]
# Body format is: MD5|name|inode|mode_as_string|UID|GID|size|atime|mtime|ctime|crtime|boottime
# Body format is: MD5|name|inode|mode_as_string|UID|GID|size|atime|mtime|ctime|crtime
if self._any_time_present(times):
fp.write(
"|{} - {}|0|0|0|0|0|{}|{}|{}|{}|{}\n".format(
"|{} - {}|0|0|0|0|0|{}|{}|{}|{}\n".format(
plugin_name,
self._sanitize_body_format(item),
self._text_format(
@@ -202,9 +197,6 @@ class Timeliner(interfaces.plugins.PluginInterface):
self._text_format(
times.get(TimeLinerType.CREATED, "0")
),
self._text_format(
times.get(TimeLinerType.BOOTTIME, "0")
),
)
)
except Exception as e:
@@ -328,7 +320,6 @@ class Timeliner(interfaces.plugins.PluginInterface):
("Modified Date", datetime.datetime),
("Accessed Date", datetime.datetime),
("Changed Date", datetime.datetime),
("Boot Date", datetime.datetime),
],
generator=self._generator(plugins_to_run),
)