sydp

Getting errors with pyfsxfs_file_entry_get_extended_attributes. ``` ERROR: testFileEntryExistsByPathSpec (vfs.overlay_file_system.OverlayFileSystemTestWithXFS) Test the file entry exists by path specification functionality. ---------------------------------------------------------------------- Traceback (most recent call last): File "/__w/dfvfs/dfvfs/tests/vfs/overlay_file_system.py", line 191, in testFileEntryExistsByPathSpec self.assertFalse(file_system.FileEntryExistsByPathSpec(path_spec))...

@rgayon @joachimmetz As discussed oob, i can take a look at this (re-using docker explorer to add support in dfVFS)

When a file is "deleted" in a layer of the overlay, the driver sets the character device bit and the device number (st_dev) to 0,0. "A whiteout is created as...

> @sydp you likely want to add it to > > https://github.com/log2timeline/dfvfs/blob/4a84328e889a75612658d0a1217220f1187154ef/dfvfs/vfs/ext_file_entry.py#L22 > > But you would need to check what the behavior on other file systems is and what...

https://source.chromium.org/chromium/chromium/src/+/master:components/sessions/core/

+1 to this feature. Agree it would be useful to have a configurable timezone as a dropdown or setting such that the displayed datetimes are in localtime.

> @sydp what is the status of this PR? As discussed, setting this to blocked as more research into the file format is needed.

Yes, I'll take a look at generating some test data in the next few weeks and implement a dtfabric definition.

Checked the logs folder on a Windows 11 instance running OneDrive version 22.141.0703.0002 and there is now a "general.keystore" file. Contents example: ``` [{"CreatedTime" : ,"Key" : ,"Version" : 1}]...

Might be of interest for MIME type matching: https://github.com/trailofbits/polyfile#libmagic-implementation