{"action":"created","issue":{"url":"https://api.github.com/repos/williballenthin/INDXParse/issues/18","labels_url":"https://api.github.com/repos/williballenthin/INDXParse/issues/18/labels{/name}","comments_url":"https://api.github.com/repos/williballenthin/INDXParse/issues/18/comments","events_url":"https://api.github.com/repos/williballenthin/INDXParse/issues/18/events","html_url":"https://github.com/williballenthin/INDXParse/issues/18","id":55624650,"number":18,"title":"get_file_info.py skips timeline creation when si is None","user":{"login":"hiddenillusion","id":1418309,"avatar_url":"https://avatars.githubusercontent.com/u/1418309?v=3","gravatar_id":"","url":"https://api.github.com/users/hiddenillusion","html_url":"https://github.com/hiddenillusion","followers_url":"https://api.github.com/users/hiddenillusion/followers","following_url":"https://api.github.com/users/hiddenillusion/following{/other_user}","gists_url":"https://api.github.com/users/hiddenillusion/gists{/gist_id}","starred_url":"https://api.github.com/users/hiddenillusion/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hiddenillusion/subscriptions","organizations_url":"https://api.github.com/users/hiddenillusion/orgs","repos_url":"https://api.github.com/users/hiddenillusion/repos","events_url":"https://api.github.com/users/hiddenillusion/events{/privacy}","received_events_url":"https://api.github.com/users/hiddenillusion/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-01-27T14:33:50Z","updated_at":"2015-01-27T18:02:58Z","closed_at":"2015-01-27T18:02:58Z","body":"Within get_timeline_entries() of get_file_info.py, the current code returns of either si or fn is None :\r\n\r\n```\r\ndef get_timeline_entries(record):\r\n    entries = []\r\n    si = record.standard_information()\r\n    if si is None:\r\n        return entries\r\n    fn = record.filename_information()\r\n    if fn is None:\r\n        return entries\r\n    filename = fn.filename()\r\n    entries.extend(create_safe_timeline_entries(si, \"$SI\", filename))\r\n```\r\n\r\nIf there are other *ATTR_TYPE.FILENAME_INFORMATION* attributes (POSIX, Win32 etc.) then those details are still displayed under the Filenames output, however, they'll be skipped for the timeline generation:\r\n\r\n```\r\n>python INDXParse-master\\get_file_info.py $MFT 95072\r\nMFT Record: 95072\r\nPath: \\path\\to\\annoying_file.dll\r\nMetadata:\r\n  Active: 1\r\n  Type: file\r\n  Flags:\r\n  $SI Modified:\r\n  $SI Accessed:\r\n  $SI Changed:\r\n  $SI Birthed:\r\n  Owner ID:\r\n  Security ID:\r\n  Quota charged:\r\n  USN:\r\nFilenames:\r\n  Type: POSIX\r\n    Name: annoying_file.dll\r\n    Flags: archive\r\n    Logical size: 22528\r\n    Physical size: 24576\r\n    Modified: 2009-07-14 01:15:35.102999\r\n    Accessed: 2009-07-13 23:47:38.328463\r\n    Changed: 2013-11-14 00:14:50.541977\r\n    Birthed: 2009-07-13 23:47:38.328463 \r\n    Parent reference: 12562\r\n    Parent sequence number: 1\r\n...\r\nINDX root entries: <none>\r\nINDX root slack entries: <none>\r\n Timeline:\r\nActive strings:\r\n  ASCII strings:\r\n    FILE0\r\n  Unicode strings:\r\n    annoying_file.dll\r\n    annoying_file.dll\r\n    annoying_file.dll\r\n    annoying_file.dll\r\nSlack strings:\r\n  ASCII strings:\r\n  Unicode strings:\r\n```\r\n\r\nProposed solution is just to consolidate those into one check and extend the entries list if both si and fn are present vs. just returning - this way you still continue the timeline creation.\r\n\r\n```\r\ndef get_timeline_entries(record):\r\n    entries = []\r\n    si = record.standard_information()\r\n    fn = record.filename_information()\r\n\r\n    if si and fn:   \r\n        filename = fn.filename()        \r\n        entries.extend(create_safe_timeline_entries(si, \"$SI\", filename))\r\n```\r\n\r\n```\r\n>python INDXParse-master\\get_file_info.py $MFT 95072\r\nMFT Record: 95072\r\nPath: \\path\\to\\annoying_file.dll\r\nMetadata:\r\n  Active: 1\r\n  Type: file\r\n  Flags:\r\n  $SI Modified:\r\n  $SI Accessed:\r\n  $SI Changed:\r\n  $SI Birthed:\r\n  Owner ID:\r\n  Security ID:\r\n  Quota charged:\r\n  USN:\r\nFilenames:\r\n  Type: POSIX\r\n    Name: annoying_file.dll\r\n    Flags: archive\r\n    Logical size: 22528\r\n    Physical size: 24576\r\n    Modified: 2009-07-14 01:15:35.102999\r\n    Accessed: 2009-07-13 23:47:38.328463\r\n    Changed: 2013-11-14 00:14:50.541977\r\n    Birthed: 2009-07-13 23:47:38.328463\r\n    Parent reference: 12562\r\n    Parent sequence number: 1\r\n...\r\nINDX root entries: <none>\r\nINDX root slack entries: <none>\r\n Timeline:\r\n  2009-07-13 23:47:38.328463    birthed     $FN     annoying_file.dll\r\n  2009-07-13 23:47:38.328463    accessed    $FN     annoying_file.dll\r\n  2009-07-13 23:47:38.328463    birthed     $FN     annoying_file.dll\r\n  2009-07-13 23:47:38.328463    accessed    $FN     annoying_file.dll\r\n  2009-07-13 23:47:38.328463    birthed     $FN     annoying_file.dll\r\n  2009-07-13 23:47:38.328463    accessed    $FN     annoying_file.dll\r\n  2009-07-13 23:47:38.328463    birthed     $FN     annoying_file.dll\r\n  2009-07-13 23:47:38.328463    accessed    $FN     annoying_file.dll\r\n  2009-07-14 01:15:35.102999    modified    $FN     annoying_file.dll\r\n  2009-07-14 01:15:35.102999    modified    $FN     annoying_file.dll\r\n  2009-07-14 01:15:35.102999    modified    $FN     annoying_file.dll\r\n  2009-07-14 01:15:35.102999    modified    $FN     annoying_file.dll\r\n  2013-11-14 00:14:50.479576    changed     $FN     annoying_file.dll\r\n  2013-11-14 00:14:50.541977    changed     $FN     annoying_file.dll\r\n  2013-11-14 00:14:50.541977    changed     $FN     annoying_file.dll\r\n  2013-11-14 00:14:50.557577    changed     $FN     annoying_file.dll\r\nActive strings:\r\n  ASCII strings:\r\n    FILE0\r\n  Unicode strings:\r\n    annoying_file.dll\r\n    annoying_file.dll\r\n    annoying_file.dll\r\n    annoying_file.dll\r\nSlack strings:\r\n  ASCII strings:\r\n  Unicode strings:\r\n```\r\n\r\nThis is mostly just an FYI but I figured I'd bring it up because it sparked a thought of maybe using of of these other timestamps if one of the $SI's is malformed/corrupt\r\n"},"comment":{"url":"https://api.github.com/repos/williballenthin/INDXParse/issues/comments/71695858","html_url":"https://github.com/williballenthin/INDXParse/issues/18#issuecomment-71695858","issue_url":"https://api.github.com/repos/williballenthin/INDXParse/issues/18","id":71695858,"user":{"login":"williballenthin","id":156560,"avatar_url":"https://avatars.githubusercontent.com/u/156560?v=3","gravatar_id":"","url":"https://api.github.com/users/williballenthin","html_url":"https://github.com/williballenthin","followers_url":"https://api.github.com/users/williballenthin/followers","following_url":"https://api.github.com/users/williballenthin/following{/other_user}","gists_url":"https://api.github.com/users/williballenthin/gists{/gist_id}","starred_url":"https://api.github.com/users/williballenthin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/williballenthin/subscriptions","organizations_url":"https://api.github.com/users/williballenthin/orgs","repos_url":"https://api.github.com/users/williballenthin/repos","events_url":"https://api.github.com/users/williballenthin/events{/privacy}","received_events_url":"https://api.github.com/users/williballenthin/received_events","type":"User","site_admin":false},"created_at":"2015-01-27T18:02:58Z","updated_at":"2015-01-27T18:02:58Z","body":"closed in 5a31cb7e467b9f52c1de7de1a3eab2c149bbd63a"}}