(self, file_info)
return suspicious
Compares timestamps to detect timestomping.

        Args:
            file_info: FileInfo object for event to look at.

        Returns:
            Boolean, true if timestomping was detected.
Compares timestamps to detect timestomping.
Compares timestamps to detect timestomping .
def is_suspicious(self, file_info):
        """Compares timestamps to detect timestomping.

        Args:
            file_info: FileInfo object for event to look at.

        Returns:
            Boolean, true if timestomping was detected.

        """
        if not file_info.std_info_event or not file_info.file_names:
            return False

        suspicious = True
        diffs = []

        for fn in file_info.file_names:
            diff = fn[1] - file_info.std_info_timestamp
            diffs.append(diff)

            if abs(diff) > self.threshold:
                fn[0].add_attributes({'time_delta': diff})
            else:
                suspicious = False
                break

        if suspicious:
            for fn in file_info.file_names:
                fn[0].commit()

            file_info.std_info_event.add_attributes({'time_deltas': diffs})
            file_info.std_info_event.commit()

        return suspicious
def is_suspicious ( self , file_info ) : if not file_info . std_info_event or not file_info . file_names : return False suspicious = True diffs = [ ] for fn in file_info . file_names : diff = fn [ 1 ] - file_info . std_info_timestamp diffs . append ( diff ) if abs ( diff ) > self . threshold : fn [ 0 ] . add_attributes ( { 'time_delta' : diff } ) else : suspicious = False break if suspicious : for fn in file_info . file_names : fn [ 0 ] . commit ( ) file_info . std_info_event . add_attributes ( { 'time_deltas' : diffs } ) file_info . std_info_event . commit ( ) return suspicious