Don't handle missing timestamps as error#3
Don't handle missing timestamps as error#3SecSamDev merged 3 commits intoForensicRS:mainfrom janstarke:main
Conversation
|
I see it well, the only thing is that a logging system is already incorporated internally, there is no need to use "log". You can directly use the debug, warning, error macros provided by the framework itself. |
|
Please keep in mind that this change works fully correct since Rust 1.78 (see rust-lang/rust#121691). In previous versions of Rust, missing timestamps are not always handled as |
|
Oh well, I don't think it's a good idea to limit the Rust version right now. |
|
Think was another solution I was thinking about. You could filter for |
There might be situations in which some OS doesn't have support for certain timestamps in a filesystem (e.g. https://doc.rust-lang.org/src/std/sys/unix/fs.rs.html#590) . This should not be an error which leads to program abort. Consider you wanted to analyze a prefetch file, then a missing creation date of the file wouldn't stop you from displaying all other information relating to this file.
fixes dfir-dd/dfir-toolkit#26