From fda6aa2bf4e9f2f2503572fc7821e46e30baea67 Mon Sep 17 00:00:00 2001 From: Alex Ebadirad Date: Tue, 1 May 2012 13:23:52 -0700 Subject: [PATCH] epoch time for registry extraction Signed-off-by: Alex Ebadirad --- .../autopsy/recentactivity/ExtractRegistry.java | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractRegistry.java b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractRegistry.java index 068b2be531..fa21200c5a 100644 --- a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractRegistry.java +++ b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractRegistry.java @@ -7,6 +7,8 @@ package org.sleuthkit.autopsy.recentactivity; import java.io.File; import java.io.*; import java.sql.ResultSet; +import java.text.ParseException; +import java.text.SimpleDateFormat; import java.util.*; import java.util.logging.Level; import java.util.logging.Logger; @@ -210,13 +212,21 @@ public void getregistryfiles(List image, IngestImageWorkerController con Iterator iterator = types.iterator(); while (iterator.hasNext()) { - String time = ""; + String etime = ""; String context = ""; Element tempnode = iterator.next(); // Element tempnode = types.get(i); context = tempnode.getName(); Element timenode = tempnode.getChild("time"); - time = timenode.getTextTrim(); + etime = timenode.getTextTrim(); + Long time = null; + try{ + Long epochtime = new SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ss.SSS'Z'").parse(etime).getTime(); + time = epochtime.longValue(); + } + catch(ParseException e){ + logger.log(Level.SEVERE, "ExtractIE::parsePascosResults() -> ", e.getMessage()); + } Element artroot = tempnode.getChild("artifacts"); List artlist = artroot.getChildren(); String winver = "";