From a0ca33b284e41471b56dc6c0dc4e15f39f30383e Mon Sep 17 00:00:00 2001 From: David McDonald Date: Fri, 4 Apr 2025 11:29:48 -0500 Subject: [PATCH] Also yield STANDARD_INFORMATION timestamps in timeliner --- volatility3/framework/plugins/windows/mftscan.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/windows/mftscan.py b/volatility3/framework/plugins/windows/mftscan.py index e7390d699..bce832d5e 100644 --- a/volatility3/framework/plugins/windows/mftscan.py +++ b/volatility3/framework/plugins/windows/mftscan.py @@ -238,9 +238,9 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): _depth, row_data = row # Only Output FN Records - if row_data[6] == "FILE_NAME": + if row_data[6] in ("FILE_NAME", "STANDARD_INFORMATION"): filename = row_data[-1] - description = f"MFT FILE_NAME entry for {filename}" + description = f"MFT {row_data[6]} entry for {filename}" yield (description, timeliner.TimeLinerType.CREATED, row_data[7]) yield (description, timeliner.TimeLinerType.MODIFIED, row_data[8]) yield (description, timeliner.TimeLinerType.CHANGED, row_data[9])