Velocidex
Ignore timetamps with epoch 0
timestamp(epoch=0) (where 0 is coming from VQL) results in something like "0001-01-01T00:53:28+00:53". Although this is obviously an invalid timestamp, it still steals a non-significant time from the analyst scanning cells. – It takes a moment to verify that a non-empty cell contains an invalid timestamp, and these moments add up. In my own artifacts, I add a conditional that only calls timestamp() if the input is valid, otherwise return NULL. However, it would be great if timestamp(epoch=0) would return NULL instead of a valid timestamp string with a nonsensical timestamp.
This is a good question. Actually the 0 time is always exactly 0001-01-01T00:00:00Z (your example has timezone of 53 min past UTC which is unusual :-).
Replacing the time with NULL is possible but this will mess up the time comparison - for example, a filter like WHERE Timestamp < now() will return false because NULL compared to anything is false.
If this is a GUI issue we can hide those times in the GUI but keep the underlying data.
The issue is that the invalid value is presented as a fairly long string that takes time to visually scan/parse. I didn't really consider the data manipulation part of it, so you are right, it is a GUI-only issue.