Add a filename to STANDARD_INFORMATION timeline entries

Author: dgmcdona

volatility3/framework/plugins/windows/mftscan.py

@@ -234,17 +234,24 @@ def _generator(self):
             )
 
     def generate_timeline(self):
-        for row in self._generator():
-            _depth, row_data = row
-
-            # Only Output FN Records
-            if row_data[6] in ("FILE_NAME", "STANDARD_INFORMATION"):
-                filename = row_data[-1]
-                description = f"MFT {row_data[6]} entry for {filename}"
-                yield (description, timeliner.TimeLinerType.CREATED, row_data[7])
-                yield (description, timeliner.TimeLinerType.MODIFIED, row_data[8])
-                yield (description, timeliner.TimeLinerType.CHANGED, row_data[9])
-                yield (description, timeliner.TimeLinerType.ACCESSED, row_data[10])
+        for record in self.enumerate_mft_records(
+            self.context, self.config_path, self.config["primary"]
+        ):
+            fname = record.longest_filename()
+
+            for _, item in self.parse_standard_information_records(record):
+                description = f"MFT {item.attribute_type} entry for {fname}"
+                yield (description, timeliner.TimeLinerType.CREATED, item.created)
+                yield (description, timeliner.TimeLinerType.MODIFIED, item.modified)
+                yield (description, timeliner.TimeLinerType.CHANGED, item.updated)
+                yield (description, timeliner.TimeLinerType.ACCESSED, item.accessed)
+
+            for _, item in self.parse_filename_records(record):
+                description = f"MFT {item.attribute_type} entry for {item.filename}"
+                yield (description, timeliner.TimeLinerType.CREATED, item.created)
+                yield (description, timeliner.TimeLinerType.MODIFIED, item.modified)
+                yield (description, timeliner.TimeLinerType.CHANGED, item.updated)
+                yield (description, timeliner.TimeLinerType.ACCESSED, item.accessed)
 
     def run(self):
         return renderers.TreeGrid(