startbootstrap icon indicating copy to clipboard operation
startbootstrap copied to clipboard

Create a dateless helper for logs with date-less timestamps

Open rick-slin opened this issue 1 year ago • 7 comments

Describe the problem:

Some log files do not have the date in their timestamp. This is the case for ps.txt log files in MacOS/iOS for example. I wish to create a dateless_helper modeled on the yearless helper.

rick-slin avatar Jun 22 '23 11:06 rick-slin

@rick-slin given several short-comings in https://github.com/log2timeline/plaso/pull/4699 working on an alternative

  • [x] ~~changed year less log helper to date less log helper - https://github.com/log2timeline/plaso/pull/4851~~
  • [x] ~~change dtDateTime to support delta date - https://github.com/log2timeline/dfdatetime/pull/280~~
  • [x] ~~change timeliner to handle a full date instead of just year - https://github.com/log2timeline/plaso/pull/4854~~
  • [ ] change date less helper interface to be used by ps.txt log file parser
    • ~~_SetEstimatedDate to estimate the date based on the file entry, will set the granularity to no-date - https://github.com/log2timeline/plaso/pull/4859~~
    • _UpdateDate to update the date based on the time observed in the log format

joachimmetz avatar Mar 29 '24 09:03 joachimmetz

@rick-slin let me know when you have a draft PR for the ps.txt log parser, this will help finalize adding _UpdateDate to the date less helper interface

joachimmetz avatar Mar 31 '24 11:03 joachimmetz

I should have time later this week.

rick-slin avatar Mar 31 '24 11:03 rick-slin

@rick-slin thanks no hurry, mostly a heads up that most of the "plumbing" should be there now

joachimmetz avatar Mar 31 '24 12:03 joachimmetz

@joachimmetz I've created a draft for the ps.txt parser. It includes two different uses of the DateLessLogFormatHelper. See #4861

rick-slin avatar Apr 04 '24 17:04 rick-slin

@rick-slin thanks, I'll try to take a look over the weekend.

joachimmetz avatar Apr 04 '24 17:04 joachimmetz

Interesting format, so what are the cases here (STARTED TIME):

  • 23Feb22 192:14.05 (date)
  • Fri11AM 0:00.37 (date-less, relative day)
  • 9:14AM 0:00.09 (date-less, today)

joachimmetz avatar Apr 06 '24 07:04 joachimmetz