Skip to content

IIS plugin: date / time parsing error #1411

@twiggler

Description

@twiggler

On dissect.version 3.20.1,

the [line](

return datetime.strptime(f"{date_str} {time_str}", "%m/%d/%Y %H:%M:%S").replace(tzinfo=tzinfo)
(
return datetime.strptime(f"{date_str} {time_str}", "%m/%d/%Y %H:%M:%S").replace(tzinfo=tzinfo)
))

return datetime.strptime(f"{date_str} {time_str}", "%<REDACTED PATH>%<REDACTED PATH>%Y %H:%M:%S").replace(tzinfo=tzinfo)

gives a ValueError("time data %r does not match format %r" %).

Investigate how to make the time parsing more resilient.
Maybe there are occasionally leading spaces?

Check if the date/time string format is determined by the local sys settings

*Update: It appears the affected log files are UTF-16 encoded, which we don´t handle correctly.*

Metadata

Metadata

Assignees

Labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions