diff --git a/test/plugins/windows/windows.py b/test/plugins/windows/windows.py index 4272b64d2..0f44ba533 100644 --- a/test/plugins/windows/windows.py +++ b/test/plugins/windows/windows.py @@ -58,6 +58,14 @@ class TestWindowsPslist: } assert test_volatility.match_output_row(expected_row, json.loads(out)) +class TestWindowsTimeliner: + def test_windows_specific_timeliner(self, volatility, python): + image = WindowsSamples.WINDOWSXP_GENERIC.value.path + rc, out, _err = test_volatility.runvol_plugin( + "timeliner.Timeliner", image, volatility, python + ) + assert rc == 0 + assert out.count(b"\n") > 10 class TestWindowsPsscan: def test_windows_specific_psscan(self, volatility, python):