Open rick-slin opened 1 year ago
@rick-slin given several short-comings in https://github.com/log2timeline/plaso/pull/4699 working on an alternative
_SetEstimatedDate
to estimate the date based on the file entry, will set the granularity to no-date - https://github.com/log2timeline/plaso/pull/4859_UpdateDate
to update the date based on the time observed in the log format@rick-slin let me know when you have a draft PR for the ps.txt log parser, this will help finalize adding _UpdateDate
to the date less helper interface
I should have time later this week.
@rick-slin thanks no hurry, mostly a heads up that most of the "plumbing" should be there now
@joachimmetz I've created a draft for the ps.txt parser. It includes two different uses of the DateLessLogFormatHelper. See #4861
@rick-slin thanks, I'll try to take a look over the weekend.
Interesting format, so what are the cases here (STARTED TIME):
Describe the problem:
Some log files do not have the date in their timestamp. This is the case for ps.txt log files in MacOS/iOS for example. I wish to create a dateless_helper modeled on the yearless helper.