(self)
return ('NtfsTimestomp Analyzer done, found {0:d} timestomped events'
                .format(timestomps))
Entry point for the analyzer.

        Returns:
            String with summary of the analyzer result.
Entry point for the analyzer.
Entry point for the analyzer .
def run(self):
        """Entry point for the analyzer.

        Returns:
            String with summary of the analyzer result.
        """

        query = 'attribute_type:48 OR attribute_type:16'

        return_fields = ['attribute_type', 'timestamp_desc',
                         'file_reference', 'timestamp']

        events = self.event_stream(
            query_string=query, return_fields=return_fields)

        # Dict timestamp_type + "&" + file_ref -> FileInfo
        file_infos = dict()

        for event in events:
            attribute_type = event.source.get('attribute_type')
            file_ref = event.source.get('file_reference')
            timestamp_type = event.source.get('timestamp_desc')
            timestamp = event.source.get('timestamp')

            if not attribute_type or not timestamp_type:
                continue

            if attribute_type not in [self.FILE_NAME, self.STD_INFO]:
                continue

            key = '{0:s}&{1:s}'.format(timestamp_type, str(file_ref))

            if key not in file_infos:
                file_infos[key] = FileInfo()

            file_info = file_infos[key]
            file_info.file_reference = file_ref
            file_info.timestamp_desc = timestamp_type

            if attribute_type == self.STD_INFO:
                file_info.std_info_timestamp = timestamp
                file_info.std_info_event = event

            if attribute_type == self.FILE_NAME:
                file_info.file_names.append((event, timestamp))

        timestomps = 0
        for file_info in file_infos.values():
            if self.is_suspicious(file_info):
                timestomps = timestomps + 1

        if timestomps > 0:
            self.sketch.add_view(
                view_name='NtfsTimestomp', analyzer_name=self.NAME,
                query_string='_exists_:time_delta or _exists:time_deltas')

        return ('NtfsTimestomp Analyzer done, found {0:d} timestomped events'
                .format(timestomps))
def run ( self ) : query = 'attribute_type:48 OR attribute_type:16' return_fields = [ 'attribute_type' , 'timestamp_desc' , 'file_reference' , 'timestamp' ] events = self . event_stream ( query_string = query , return_fields = return_fields ) # Dict timestamp_type + "&" + file_ref -> FileInfo file_infos = dict ( ) for event in events : attribute_type = event . source . get ( 'attribute_type' ) file_ref = event . source . get ( 'file_reference' ) timestamp_type = event . source . get ( 'timestamp_desc' ) timestamp = event . source . get ( 'timestamp' ) if not attribute_type or not timestamp_type : continue if attribute_type not in [ self . FILE_NAME , self . STD_INFO ] : continue key = '{0:s}&{1:s}' . format ( timestamp_type , str ( file_ref ) ) if key not in file_infos : file_infos [ key ] = FileInfo ( ) file_info = file_infos [ key ] file_info . file_reference = file_ref file_info . timestamp_desc = timestamp_type if attribute_type == self . STD_INFO : file_info . std_info_timestamp = timestamp file_info . std_info_event = event if attribute_type == self . FILE_NAME : file_info . file_names . append ( ( event , timestamp ) ) timestomps = 0 for file_info in file_infos . values ( ) : if self . is_suspicious ( file_info ) : timestomps = timestomps + 1 if timestomps > 0 : self . sketch . add_view ( view_name = 'NtfsTimestomp' , analyzer_name = self . NAME , query_string = '_exists_:time_delta or _exists:time_deltas' ) return ( 'NtfsTimestomp Analyzer done, found {0:d} timestomped events' . format ( timestomps ) )