WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-07 18:27:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Also yield STANDARD_INFORMATION timestamps in timeliner

Browse Source
This commit is contained in:
David McDonald
2025-04-04 11:30:27 -05:00
parent b15e9104e8
commit a0ca33b284
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/windows/mftscan.py
+2 -2
View File
@@ -238,9 +238,9 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
_depth, row_data = row
# Only Output FN Records
if row_data[6] == "FILE_NAME":
if row_data[6] in ("FILE_NAME", "STANDARD_INFORMATION"):
filename = row_data[-1]
description = f"MFT FILE_NAME entry for {filename}"
description = f"MFT {row_data[6]} entry for {filename}"
yield (description, timeliner.TimeLinerType.CREATED, row_data[7])
yield (description, timeliner.TimeLinerType.MODIFIED, row_data[8])
yield (description, timeliner.TimeLinerType.CHANGED, row_data[9])