From 96a1f3f64275a183ba22e86f49bf6a31170c0454 Mon Sep 17 00:00:00 2001
From: Erik Schamper <1254028+Schamper@users.noreply.github.com>
Date: Mon, 14 Nov 2022 17:31:43 +0100
Subject: [PATCH] Fix birthtime if not present (#10)

(DIS-1659)
---
 dissect/ffs/ffs.py | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/dissect/ffs/ffs.py b/dissect/ffs/ffs.py
index 7d6e3ff..3d30f71 100644
--- a/dissect/ffs/ffs.py
+++ b/dissect/ffs/ffs.py
@@ -186,7 +186,7 @@ def atime(self):
 
     @cached_property
     def atime_ns(self):
-        return (self.inode.di_atime * 1000000000) + self.inode.di_atimensec
+        return (self.inode.di_atime * 1_000_000_000) + self.inode.di_atimensec
 
     @cached_property
     def mtime(self):
@@ -194,7 +194,7 @@ def mtime(self):
 
     @cached_property
     def mtime_ns(self):
-        return (self.inode.di_mtime * 1000000000) + self.inode.di_mtimensec
+        return (self.inode.di_mtime * 1_000_000_000) + self.inode.di_mtimensec
 
     @cached_property
     def ctime(self):
@@ -202,15 +202,19 @@ def ctime(self):
 
     @cached_property
     def ctime_ns(self):
-        return (self.inode.di_ctime * 1000000000) + self.inode.di_ctimensec
+        return (self.inode.di_ctime * 1_000_000_000) + self.inode.di_ctimensec
 
     @cached_property
     def btime(self):
-        return ts.from_unix_ns(self.btime_ns)
+        if btime_ns := self.btime_ns:
+            return ts.from_unix_ns(btime_ns)
+        return None
 
     @cached_property
     def btime_ns(self):
-        return (self.inode.di_birthtime * 1000000000) + self.inode.di_birthnsec
+        if hasattr(self.inode, "di_birthtime"):
+            return (self.inode.di_birthtime * 1_000_000_000) + self.inode.di_birthnsec
+        return None
 
     @cached_property
     def link(self):