search

sepinf-inc / IPED

IPED Digital Forensic Tool. It is an open source software that can be used to process and analyze digital evidence, often seized at crime scenes by law enforcement or in a corporate investigation by private examiners.
Other
886 stars 211 forks source link

Parser for vlc-qt-interface.ini files #2034

Closed Descadeirado closed 3 months ago

Descadeirado commented 6 months ago

I would like to ask for a new feature. It would be a parserr for the vlc-qt-interface.ini file, that has data like the most recent opened files with the application.

Thanks!

lfcnassif commented 4 months ago

Hi @Descadeirado, could you share some samples with me to help testing #2085?

Descadeirado commented 4 months ago

Sure, tomorrow i'll contact you.

Em qui., 15 de fev. de 2024, 22:07, Luis Filipe Nassif < @.***> escreveu:

Hi @Descadeirado https://github.com/Descadeirado, could youb share some samples with me to help testing #2085 https://github.com/sepinf-inc/IPED/pull/2085?

— Reply to this email directly, view it on GitHub https://github.com/sepinf-inc/IPED/issues/2034#issuecomment-1947585932, or unsubscribe https://github.com/notifications/unsubscribe-auth/AQOCYZ2YB6W2MZDD6TR5V4LYT2WLHAVCNFSM6AAAAABBFORP7CVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTSNBXGU4DKOJTGI . You are receiving this because you were mentioned.Message ID: @.***>

lfcnassif commented 3 months ago

@Descadeirado I'm reviewing the initial parser @marcus6n wrote. Do you know what date format is used by those VLC files? We need to properly convert them: https://github.com/sepinf-inc/IPED/pull/2085#issuecomment-2008356923

wladimirleite commented 3 months ago

Do you know what date format is used by those VLC files?

These are not dates. It is the time (in milliseconds) inside the video of the last skip destination point (0 if there was no skip). I would say that it is not useful in most of the cases.

lfcnassif commented 3 months ago

These are not dates. It is the time (in milliseconds) inside the video of the last skip destination point (0 if there was no skip). I would say that it is not useful in most of the cases.

Thank you @wladimirleite! Just saw your reply now. Then, I'll possibly remove them, thanks.