From 90a3829ee766f3ef5530ef061389e7f343ba96b8 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 15 May 2025 17:28:26 -0500 Subject: [PATCH] Windows Timeliner: Add basic test This is enough to ensure that the return code is nonzero and there was some valid output. --- test/plugins/windows/windows.py | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/test/plugins/windows/windows.py b/test/plugins/windows/windows.py index 4272b64d2..0f44ba533 100644 --- a/test/plugins/windows/windows.py +++ b/test/plugins/windows/windows.py @@ -58,6 +58,14 @@ class TestWindowsPslist: } assert test_volatility.match_output_row(expected_row, json.loads(out)) +class TestWindowsTimeliner: + def test_windows_specific_timeliner(self, volatility, python): + image = WindowsSamples.WINDOWSXP_GENERIC.value.path + rc, out, _err = test_volatility.runvol_plugin( + "timeliner.Timeliner", image, volatility, python + ) + assert rc == 0 + assert out.count(b"\n") > 10 class TestWindowsPsscan: def test_windows_specific_psscan(self, volatility, python):