Timestamp info report padronization

[patrickdalla]

Hi @keydet89,

I you are aware from IPED project thread, I've been trying to extract timestamps from RegRipper reports. The times representation seems well standardized, but it has been very difficult to identify a good, little and straightforward term that describes the event with which this timestamp is associated. Even in TLN reports.

This is very useful for timestamps filtering, grouping an representation in timeline chart.

Also, not every plugins that extract timestamps, has its TLN plugin counterpart.

So, it would be very useful to standardize the format and require from plugin developers this descriptive term associated with the timestamp entry.

Thanks

[keydet89]

... it has been very difficult to identify a good, little and straightforward term that describes the event with
which this timestamp is associated. Even in TLN reports.

This is because context regarding keys and values varies. The only single consistent time stamp value meaning is the key LastWrite time.

...not every plugins that extract timestamps, has its TLN plugin counterpart.

Of course not. One example is the Run key...the only time stamp available is the key LastWrite time, so while a RegRipper plugin will extract the various values for viewing, the regtime.exe application is used to list all keys by their respective LastWrite times.

...it would be very useful to standardize the format and require from plugin developers this descriptive term
associated with the timestamp entry.

How would you recommend doing this? Keep in mind that doing so might "break" other tools that output their data in the 5-field TLN format.

[patrickdalla]

"How would you recommend doing this?"
This can be simple, like putting this straightforward descriptive term at the start of description between brackets. This would be enough for my purpose.

[keydet89]

...putting this straightforward descriptive term...

Which term? What "term" are you referring to?

[patrickdalla]

This term is the one I need. I could not find a easy way to identify it. That is the main purpose of this issue, to easy the extraction not only of the timestamp, but of a straightforward term that best describes the event associated with the timestamp being extracted.
I don't know it and it is content specific. So each plugin developer should determine which is the term.
The suggestion is to specify a way to 'mark' this term the plugin developer chose, so it can easily be identified by timeline tools.

[patrickdalla]

For instance: As it was more dificult to identify this term from TLN reports, I extracted them (in IPED project) from normal RegRipper reports based on the plugin name used to extract them and any word that precedes the timestamp in the same line that it occurs in RegRipper normal report.
A sample of the term extraction results follows:

This are inferred terms, and may be not the best. The plugin developer would be the best one to choose this term, we only need to specify how to mark it as to be possible to computationally identify it in the report (like the suggestion I've made).

[keydet89]

So, the short version is that you're looking for a descriptive term to be placed at the beginning of the Description field, in some standardized format that easily parsed by other tools?

[patrickdalla]

yes

[patrickdalla]

All this entries, once filtered grouped and identified, leads to the RegRipper report once the analyst identify it as potentially relevant and needs more details of it.

[keydet89]

I'm going to have to really think about this...I haven't updated RRv3.0 in almost 3 yrs, and have instead focused my efforts on a newer version, one with more capabilities and content...and many more plugins. I'll have to determine if I want to put in the effort to make this modification to a version I'm not entirely interested in supporting, now that it's been embedded in a commercial product (I found that out by accident).

[patrickdalla]

No problem. This can easy not only this tool. PS.: IPED is not a commercial product. Em sex., 19 de mai. de 2023 07:51, H. Carvey ***@***.***> escreveu:

…

I'm going to have to really think about this...I haven't updated RRv3.0 in almost 3 yrs, and have instead focused my efforts on a newer version, one with more capabilities and content...and many more plugins. I'll have to determine if I want to put in the effort to make this modification to a version I'm not entirely interested in supporting, now that it's been embedded in a commercial product (I found that out by accident). — Reply to this email directly, view it on GitHub <#56 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AG247S54BOB2WJ2FBAC66LTXG5NDLANCNFSM6AAAAAAYDUGX7U> . You are receiving this because you authored the thread.Message ID: ***@***.***>