Created parser for Apple IPS files. #4688
Conversation
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #4688 +/- ##
==========================================
- Coverage 85.21% 85.20% -0.02%
==========================================
Files 428 431 +3
Lines 38826 38818 -8
==========================================
- Hits 33084 33073 -11
- Misses 5742 5745 +3 ☔ View full report in Codecov by Sentry. |
|
Could someone please take another look at this PR? |
|
@rick-slin thanks for the reminder. I'll try to take a look as soon as time permits, but note things are busy on my end. |
|
Rebased with HEAD of origin main |
|
I don't understand what needs to be fixed. What is a "non-mergeable pull request "? |
do you mean the message in Don't worry about it, could be a fluke in the CI interaction, I'll have a look when I have time |
|
Yes. This is what I meant. Thanks. |
joachimmetz
force-pushed
the
ips
branch
2 times, most recently
from
5b2118c to
1d63290
Compare
|
@rick-slin FYI I'll start looking at merging this after the March release |
|
Yeah, no rush obviously. I just noticed that one of your last commits fixed an issue I was encountering in the CI tests. |
joachimmetz
force-pushed
the
ips
branch
2 times, most recently
from
37a7a1c to
271c16a
Compare
| fraction_float = float(f"0.{parsed_timestamp['fraction']}") | ||
| milliseconds = round(fraction_float * 1000) | ||
|
|
||
| time_element_object = dfdatetime_time_elements.TimeElementsInMilliseconds( |
There was a problem hiding this comment.
note to self see if TimeElementsWithFractionOfSecond can be used instead
There was a problem hiding this comment.
Looks like the fraction of second value is either 2 or 4 digits. @rick-slin can you confirm this based on other samples ?
I recommend we preserve the precision here to prevent misrepresentation, also see https://osdfir.blogspot.com/2021/10/pearls-and-pitfalls-of-timeline-analysis.html
When time permits I'll make some tweaks to dfDateTime to support 10 ms and 100 us intervals
There was a problem hiding this comment.
I couldn't find an ips file with a timestamp with something other than 10 ms precision (hundredth of seconds). Where did you encounter one with 100 us precision? I checked on three iPhones (iOS 14, 15, and 16) and a MacBook.
I see your point about preserving granularity.
One line description of pull request
Created parser for Apple IPS files as well as an IPS parser plugin for recoverylogd-[...].ips files.
Description:
Created parser for Apple IPS files as well as an IPS parser plugin for recoverylogd-[...].ips files.
Related issue (if applicable): fixes #<4102>
Notes:
All contributions to Plaso undergo code review.
This makes sure that the code has appropriate test coverage and conforms to the
Plaso style guide.
One of the maintainers will examine your code, and may request changes. Check off the items below in
order, and then a maintainer will review your code.
Checklist: