diff --git a/volatility3/framework/plugins/linux/boottime.py b/volatility3/framework/plugins/linux/boottime.py index eeee418f8..8f63ee7f8 100644 --- a/volatility3/framework/plugins/linux/boottime.py +++ b/volatility3/framework/plugins/linux/boottime.py @@ -88,7 +88,7 @@ class Boottime(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface) ): description = f"System boot time for time namespace {time_namespace_id}" - yield description, timeliner.TimeLinerType.BOOTTIME, boottime + yield description, timeliner.TimeLinerType.CREATED, boottime def run(self): columns = [ diff --git a/volatility3/framework/plugins/timeliner.py b/volatility3/framework/plugins/timeliner.py index 70da0c4fb..c754e43ef 100644 --- a/volatility3/framework/plugins/timeliner.py +++ b/volatility3/framework/plugins/timeliner.py @@ -23,7 +23,6 @@ class TimeLinerType(enum.IntEnum): MODIFIED = 2 ACCESSED = 3 CHANGED = 4 - BOOTTIME = 5 class TimeLinerInterface(metaclass=abc.ABCMeta): @@ -172,10 +171,6 @@ class Timeliner(interfaces.plugins.PluginInterface): TimeLinerType.CHANGED, renderers.NotApplicableValue(), ), - times.get( - TimeLinerType.BOOTTIME, - renderers.NotApplicableValue(), - ), ], ) ) @@ -183,11 +178,11 @@ class Timeliner(interfaces.plugins.PluginInterface): # Write each entry because the body file doesn't need to be sorted if fp: times = self.timeline[(plugin_name, item)] - # Body format is: MD5|name|inode|mode_as_string|UID|GID|size|atime|mtime|ctime|crtime|boottime + # Body format is: MD5|name|inode|mode_as_string|UID|GID|size|atime|mtime|ctime|crtime if self._any_time_present(times): fp.write( - "|{} - {}|0|0|0|0|0|{}|{}|{}|{}|{}\n".format( + "|{} - {}|0|0|0|0|0|{}|{}|{}|{}\n".format( plugin_name, self._sanitize_body_format(item), self._text_format( @@ -202,9 +197,6 @@ class Timeliner(interfaces.plugins.PluginInterface): self._text_format( times.get(TimeLinerType.CREATED, "0") ), - self._text_format( - times.get(TimeLinerType.BOOTTIME, "0") - ), ) ) except Exception as e: @@ -328,7 +320,6 @@ class Timeliner(interfaces.plugins.PluginInterface): ("Modified Date", datetime.datetime), ("Accessed Date", datetime.datetime), ("Changed Date", datetime.datetime), - ("Boot Date", datetime.datetime), ], generator=self._generator(plugins_to_run), )