-
When files are deleted, some tools have the capability to capture the time the file was deleted. This value would best be stored as "deletedTime" in the existing File class. See [Plaso's Filestat modu…
-
Hi! I would like to know if it is possible to disable the scanning of the entire surface of the hard disk and that the Autopsy only uses the information of the MFT to visualize the metadata (dates of …
-
From [Microsoft Docs](https://docs.microsoft.com/en-us/windows/win32/fileio/change-journals):
> [T]he NTFS file system maintains an update sequence number (USN) change journal. When any change is m…
m1435 updated
2 years ago
-
**Describe the bug**
trying to add plaso timeline, the file is uploaded but cannot index
[2023-09-21 11:03:02,418] timesketch_importer.importer_frontend/INFO Using cached credentials.
[2023-09-21 …
-
I have 2 hard drives on a machine and I run Hoarder -a for a test I was doing.
I get information about the NTFS of Disk D:\ which is empty but for some reason it can't parse my disk C:\
This is take…
-
When reading a $MFT scan for orphaned $FILE_NAME attributes of attribute list MFT entries for path reconstruction. See https://github.com/log2timeline/plaso/issues/3840 for more context.
* how to b…
-
l2tbinaries: have master/stable test use latest plaso tagged version instead of HEAD
* [x] ~~update travis ci configuration~~
* ~~issue with shallow cloned git on Travis~~
* [ ] update appveyor…
-
News feed lapa - Teksts Choose a workout plan to achieve your fitness goals!
Mainās uz Choose a workout plan to reach the finish line faster!
Teksta krāsa #17E5FE
-
While working on packaging latest `plaso` for Gentoo, I think I see two python modules (`idna`,`cffi`) which are not referenced in any code, yet they are installed by some of the scripts. I suggest to…
-
**Description of problem:**
Not really new problem, but was reported before?
After numerous tries on various versions of plaso, with latest nsrlsvr (1.7.0 released), the process will stop halfway th…