updates

common/src/windows.rs

@@ -1006,7 +1006,7 @@ pub struct NetworkConnectivityInfo {
  pub interface_luid: i64,
  pub l2_profile_id: i64,
  pub connected_time: i32,
- pub connect_start_time: i64,
+ pub connect_start_time: String,
  pub l2_profile_flags: i32,
 }
 

core/src/artifacts/os/windows/ese/tables.rs

@@ -16,7 +16,7 @@ use crate::{
  nom_unsigned_two_bytes, Endian,
  },
  strings::extract_ascii_utf16_string,
- time::{filetime_to_unixepoch, ole_automationtime_to_unixepoch},
+ time::{filetime_to_unixepoch, ole_automationtime_to_unixepoch, unixepoch_to_iso},
  uuid::format_guid_le_bytes,
  },
 };
@@ -207,15 +207,14 @@ fn column_data_to_string<'a>(
  if flags.contains(&ColumnFlags::NotNull) {
  let (input, filetime_data) = nom_unsigned_eight_bytes(data, Endian::Le)?;
  let filetime = filetime_to_unixepoch(&filetime_data);
- let value = format!("{filetime}");
- (input, value)
+
+ (input, unixepoch_to_iso(&filetime))
  } else {
  let (input, float_data) = take(size_of::<u64>())(data)?;
  let (_, float_value) = le_f64(float_data)?;
  let oletime = ole_automationtime_to_unixepoch(&float_value);
 
- let value = format!("{oletime}");
- (input, value)
+ (input, unixepoch_to_iso(&oletime))
  }
  }
  ColumnType::LongBinary | ColumnType::Binary => {

core/src/artifacts/os/windows/registry/keys/data.rs

@@ -4,6 +4,7 @@ use crate::{
  encoding::base64_encode_standard,
  nom_helper::{nom_unsigned_four_bytes, nom_unsigned_two_bytes, Endian},
  strings::{extract_multiline_utf16_string, extract_utf16_string},
+ time::{filetime_to_unixepoch, unixepoch_to_iso},
  },
 };
 use log::error;
@@ -86,7 +87,8 @@ pub(crate) fn parse_qword_filetime(
 
  let value = if filetime {
  let (_, value) = le_u64(allocated_data)?;
- format!("{value}")
+ let reg_time = filetime_to_unixepoch(&value);
+ unixepoch_to_iso(&reg_time)
  } else {
  let (_, value) = le_i64(allocated_data)?;
  format!("{value}")
@@ -349,7 +351,7 @@ mod tests {
  ];
 
  let (_, result) = parse_qword_filetime(&test_data, 0, 8, true).unwrap();
- assert_eq!(result, "132160996147660000");
+ assert_eq!(result, "2019-10-21T02:46:54.000Z");
  }
 
  #[test]

core/src/artifacts/os/windows/srum/tables/application.rs

@@ -42,8 +42,7 @@ pub(crate) fn parse_application(
  app.auto_inc_id = column.column_data.parse::<i32>().unwrap_or_default();
  }
  "TimeStamp" => {
- app.timestamp =
- unixepoch_to_iso(&column.column_data.parse::<i64>().unwrap_or_default());
+ app.timestamp.clone_from(&column.column_data);
  }
  "AppId" => {
  if let Some(value) = lookups.get(&column.column_data) {
@@ -193,8 +192,7 @@ pub(crate) fn parse_app_timeline(
  energy.auto_inc_id = column.column_data.parse::<i32>().unwrap_or_default();
  }
  "TimeStamp" => {
- energy.timestamp =
- unixepoch_to_iso(&column.column_data.parse::<i64>().unwrap_or_default());
+ energy.timestamp.clone_from(&column.column_data);
  }
  "AppId" => {
  if let Some(value) = lookups.get(&column.column_data) {
@@ -382,8 +380,7 @@ pub(crate) fn parse_vfu_provider(
  app.auto_inc_id = column.column_data.parse::<i32>().unwrap_or_default();
  }
  "TimeStamp" => {
- app.timestamp =
- unixepoch_to_iso(&column.column_data.parse::<i64>().unwrap_or_default());
+ app.timestamp.clone_from(&column.column_data);
  }
  "AppId" => {
  if let Some(value) = lookups.get(&column.column_data) {

core/src/artifacts/os/windows/srum/tables/energy.rs

@@ -1,4 +1,7 @@
-use crate::{artifacts::os::windows::srum::error::SrumError, utils::time::unixepoch_to_iso};
+use crate::{
+ artifacts::os::windows::srum::error::SrumError,
+ utils::time::{filetime_to_unixepoch, unixepoch_to_iso},
+};
 use common::windows::{EnergyInfo, EnergyUsage, TableDump};
 use log::error;
 use serde_json::Value;
@@ -25,8 +28,7 @@ pub(crate) fn parse_energy(
  energy.auto_inc_id = column.column_data.parse::<i32>().unwrap_or_default();
  }
  "TimeStamp" => {
- energy.timestamp =
- unixepoch_to_iso(&column.column_data.parse::<i64>().unwrap_or_default());
+ energy.timestamp.clone_from(&column.column_data);
  }
  "AppId" => {
  if let Some(value) = lookups.get(&column.column_data) {
@@ -86,8 +88,7 @@ pub(crate) fn parse_energy_usage(
  match column.column_name.as_str() {
  "AutoIncId" => energy.auto_inc_id = column.column_data.parse::<i32>().unwrap(),
  "TimeStamp" => {
- energy.timestamp =
- unixepoch_to_iso(&column.column_data.parse::<i64>().unwrap_or_default());
+ energy.timestamp.clone_from(&column.column_data);
  }
  "AppId" => {
  if let Some(value) = lookups.get(&column.column_data) {
@@ -104,8 +105,9 @@ pub(crate) fn parse_energy_usage(
  energy.user_id.clone_from(&column.column_data);
  }
  "EventTimestamp" => {
- energy.event_timestamp =
- unixepoch_to_iso(&column.column_data.parse::<i64>().unwrap_or_default());
+ energy.event_timestamp = unixepoch_to_iso(&filetime_to_unixepoch(
+ &column.column_data.parse::<u64>().unwrap_or_default(),
+ ));
  }
  "StateTransition" => {
  energy.state_transition = column.column_data.parse::<i32>().unwrap();

core/src/artifacts/os/windows/srum/tables/network.rs

@@ -1,4 +1,7 @@
-use crate::{artifacts::os::windows::srum::error::SrumError, utils::time::unixepoch_to_iso};
+use crate::{
+ artifacts::os::windows::srum::error::SrumError,
+ utils::time::{filetime_to_unixepoch, unixepoch_to_iso},
+};
 use common::windows::{NetworkConnectivityInfo, NetworkInfo, TableDump};
 use log::error;
 use serde_json::Value;
@@ -29,8 +32,8 @@ pub(crate) fn parse_network(
  network.auto_inc_id = column.column_data.parse::<i32>().unwrap_or_default();
  }
  "TimeStamp" => {
- network.timestamp =
-   unixepoch_to_iso(&column.column_data.parse::<i64>().unwrap_or_default());
+ network.timestamp.clone_from(&column.column_data);
+ // unixepoch_to_iso(&column.column_data.parse::<i64>().unwrap_or_default());
  }
  "AppId" => {
  if let Some(value) = lookups.get(&column.column_data) {
@@ -96,7 +99,7 @@ pub(crate) fn parse_network_connectivity(
  l2_profile_id: 0,
  l2_profile_flags: 0,
  connected_time: 0,
- connect_start_time: 0,
+ connect_start_time: String::new(),
  };
 
  for column in rows {
@@ -105,8 +108,8 @@ pub(crate) fn parse_network_connectivity(
  network.auto_inc_id = column.column_data.parse::<i32>().unwrap_or_default();
  }
  "TimeStamp" => {
- network.timestamp =
-  unixepoch_to_iso(&column.column_data.parse::<i64>().unwrap_or_default());
+ network.timestamp.clone_from(&column.column_data);
+ //unixepoch_to_iso(&column.column_data.parse::<i64>().unwrap_or_default());
  }
  "AppId" => {
  if let Some(value) = lookups.get(&column.column_data) {
@@ -136,8 +139,9 @@ pub(crate) fn parse_network_connectivity(
  network.connected_time = column.column_data.parse::<i32>().unwrap_or_default();
  }
  "ConnectStartTime" => {
- network.connect_start_time =
- column.column_data.parse::<i64>().unwrap_or_default();
+ network.connect_start_time = unixepoch_to_iso(&filetime_to_unixepoch(
+ &column.column_data.parse::<u64>().unwrap_or_default(),
+ ));
  }
  _ => continue,
  }

core/src/artifacts/os/windows/srum/tables/notifications.rs

@@ -1,4 +1,4 @@
-use crate::{artifacts::os::windows::srum::error::SrumError, utils::time::unixepoch_to_iso};
+use crate::artifacts::os::windows::srum::error::SrumError;
 use common::windows::{NotificationInfo, TableDump};
 use log::error;
 use serde_json::Value;
@@ -27,8 +27,7 @@ pub(crate) fn parse_notification(
  notif.auto_inc_id = column.column_data.parse::<i32>().unwrap_or_default();
  }
  "TimeStamp" => {
- notif.timestamp =
- unixepoch_to_iso(&column.column_data.parse::<i64>().unwrap_or_default());
+ notif.timestamp.clone_from(&column.column_data);
  }
  "AppId" => {
  if let Some(value) = lookups.get(&column.column_data) {