Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Don't handle missing timestamps as error #3

Merged
merged 3 commits into from
Feb 27, 2024
Merged

Don't handle missing timestamps as error #3

merged 3 commits into from
Feb 27, 2024

Conversation

janstarke
Copy link
Contributor

@janstarke janstarke commented Feb 27, 2024

There might be situations in which some OS doesn't have support for certain timestamps in a filesystem (e.g. https://doc.rust-lang.org/src/std/sys/unix/fs.rs.html#590) . This should not be an error which leads to program abort. Consider you wanted to analyze a prefetch file, then a missing creation date of the file wouldn't stop you from displaying all other information relating to this file.

fixes dfir-dd/dfir-toolkit#26

@SecSamDev
Copy link
Collaborator

I see it well, the only thing is that a logging system is already incorporated internally, there is no need to use "log". You can directly use the debug, warning, error macros provided by the framework itself.

@SecSamDev SecSamDev self-assigned this Feb 27, 2024
@SecSamDev SecSamDev merged commit 9c0e916 into ForensicRS:main Feb 27, 2024
2 checks passed
@janstarke
Copy link
Contributor Author

Please keep in mind that this change works fully correct since Rust 1.78 (see rust-lang/rust#121691). In previous versions of Rust, missing timestamps are not always handled as Unsupported, so your code will return an Error, instead of Ok(None). If this is of importance for your projects, you should add rust-version = "1.78" to your Cargo.toml

@SecSamDev
Copy link
Collaborator

Oh well, I don't think it's a good idea to limit the Rust version right now.
So I'll change the StdFS metadata to set None when an error is returned.
Thank you

@janstarke
Copy link
Contributor Author

Think was another solution I was thinking about. You could filter for Error::Uncategorized with the message "creation time is not available for the filesystem", which is hard coded. This way, you won't lose other errors that might possibly occur

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

pf2bodyfile | Creation time is not available
2 participants