Created parser for Apple IPS files.#4688
Conversation
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #4688 +/- ##
==========================================
+ Coverage 84.94% 84.97% +0.03%
==========================================
Files 436 440 +4
Lines 39250 39431 +181
==========================================
+ Hits 33342 33508 +166
- Misses 5908 5923 +15 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
|
Could someone please take another look at this PR? |
|
@rick-slin thanks for the reminder. I'll try to take a look as soon as time permits, but note things are busy on my end. |
|
Rebased with HEAD of origin main |
|
I don't understand what needs to be fixed. What is a "non-mergeable pull request "? |
do you mean the message in Don't worry about it, could be a fluke in the CI interaction, I'll have a look when I have time |
|
Yes. This is what I meant. Thanks. |
joachimmetz
force-pushed
the
ips
branch
2 times, most recently
from
5b2118c to
1d63290
Compare
|
@rick-slin FYI I'll start looking at merging this after the March release |
|
Yeah, no rush obviously. I just noticed that one of your last commits fixed an issue I was encountering in the CI tests. |
joachimmetz
force-pushed
the
ips
branch
3 times, most recently
from
271c16a to
2e6fe5c
Compare
| fraction_float = float(f"0.{parsed_timestamp['fraction']}") | ||
| milliseconds = round(fraction_float * 1000) | ||
|
|
||
| time_element_object = dfdatetime_time_elements.TimeElementsInMilliseconds( |
There was a problem hiding this comment.
note to self see if TimeElementsWithFractionOfSecond can be used instead
There was a problem hiding this comment.
Looks like the fraction of second value is either 2 or 4 digits. @rick-slin can you confirm this based on other samples ?
I recommend we preserve the precision here to prevent misrepresentation, also see https://osdfir.blogspot.com/2021/10/pearls-and-pitfalls-of-timeline-analysis.html
When time permits I'll make some tweaks to dfDateTime to support 10 ms and 100 us intervals
There was a problem hiding this comment.
I couldn't find an ips file with a timestamp with something other than 10 ms precision (hundredth of seconds). Where did you encounter one with 100 us precision? I checked on three iPhones (iOS 14, 15, and 16) and a MacBook.
I see your point about preserving granularity.
|
Rebased with current HEAD |
2 participants
One line description of pull request
Created parser for Apple IPS files as well as an IPS parser plugin for recoverylogd-[...].ips files.
Description:
Created parser for Apple IPS files as well as an IPS parser plugin for recoverylogd-[...].ips files.
Related issue (if applicable): fixes #<4102>
Notes:
All contributions to Plaso undergo code review.
This makes sure that the code has appropriate test coverage and conforms to the
Plaso style guide.
One of the maintainers will examine your code, and may request changes. Check off the items below in
order, and then a maintainer will review your code.
Checklist: