Merge pull request #1020 from volatilityfoundation/1019-printkey-timestamps-are-misleadingincorrect

issue #1019 - for subkeys, return the modified time of the subkey its…
2026-09-11 20:27:38 +02:00 · 2023-10-19 10:18:22 +01:00
parent 57924c5da1 a497216beb
commit 806801ea69
1 changed files with 5 additions and 0 deletions
@@ -153,6 +153,11 @@ class PrintKey(interfaces.plugins.PluginInterface):
                    vollog.debug(excp)
                    key_node_name = renderers.UnreadableValue()

+                # if the item is a subkey, use the LastWriteTime of that subkey
+                last_write_time = conversion.wintime_to_datetime(
+                    node.LastWriteTime.QuadPart
+                )
+
                yield (
                    depth,
                    (