log2timeline / plaso

Super timeline all the things
https://plaso.readthedocs.io
Apache License 2.0
1.72k stars 348 forks source link

Create a dateless helper for logs with date-less timestamps #4697

Open rick-slin opened 1 year ago

rick-slin commented 1 year ago

Describe the problem:

Some log files do not have the date in their timestamp. This is the case for ps.txt log files in MacOS/iOS for example. I wish to create a dateless_helper modeled on the yearless helper.

joachimmetz commented 6 months ago

@rick-slin given several short-comings in https://github.com/log2timeline/plaso/pull/4699 working on an alternative

joachimmetz commented 6 months ago

@rick-slin let me know when you have a draft PR for the ps.txt log parser, this will help finalize adding _UpdateDate to the date less helper interface

rick-slin commented 6 months ago

I should have time later this week.

joachimmetz commented 6 months ago

@rick-slin thanks no hurry, mostly a heads up that most of the "plumbing" should be there now

rick-slin commented 6 months ago

@joachimmetz I've created a draft for the ps.txt parser. It includes two different uses of the DateLessLogFormatHelper. See #4861

joachimmetz commented 6 months ago

@rick-slin thanks, I'll try to take a look over the weekend.

joachimmetz commented 6 months ago

Interesting format, so what are the cases here (STARTED TIME):