UTC vs local timestamp variances in tools

[RduMarais]

EvtxECmd version # I am running EvtxCmd version 1.0.0.0

Describe the bug If I run EvtxCmd at 12:00 without specifying an output file name, the generated file has a name such as 20220615100000_EvtxECmd_Output.csv. If I run it with others EZTools in a powershell loop, all others default output file names are like 20220615120101_LECmd_Output.csv. @ro-olivier identified the same behavior on its end.

To Reproduce The exact command executed is .\EvtxECmd.exe -d .\C\Windows\System32\winevt\Logs\ --csv .\output\EventLogs with a fresh install of all EZTools.

Expected behavior I expect the timestamp to be 20220615100000_EvtxECmd_Output.csv

Additional context My timezone is GMT + 2 / UTC+1

Possible explanation I suspect there are some time conversion between UTC and local timezone that somehow affected also the file name ?

[EricZimmerman]

your message seems to contradict itself. you say the filename is 20220615100000_EvtxECmd_Output.csv then imply that is somehow wrong, and want the filename to be 20220615100000_EvtxECmd_Output.csv, which it already is?

so, do you want all the generated filenames to use UTC time, or local time?

cc @AndrewRathbun

in evtxecmd, that filename is based on this:

var ts = DateTimeOffset.UtcNow;

then its converted to this format for the name of the file:

var outName = $"{ts:yyyyMMddHHmmss}_EvtxECmd_Output.csv";

in LECmd, its

var tsNow = DateTimeOffset.Now;

var outName = $"{tsNow:yyyyMMddHHmmss}_LECmd_Output.csv";

which is local time vs UTC.

i would be much more inclined to change the tools to all be using UTC. JLECmd is also using local time.

[EricZimmerman]

• JLECmd
• LECmd
• RBCmd
• RecentFileCacheParser

are all using local time vs UTC. i will update these now

[EricZimmerman]

this is done

[EricZimmerman]

also, your version is not current. please update to 1.5 asap. i also recommend using .net 6 version as its way faster than net 4.x

[RduMarais]

(I updated my first comment for the typo)

Basically I was just suggesting to have a consistent namespace, which is now the case, so thanks for the very quick fix !

[EricZimmerman]

yea thats my bad. should have all been UTC from the get go. if you notice any others please let me know