/usr/lib/python2.7/dist-packages/dfdatetime/filetime.py is in python-dfdatetime 20180110-1.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 | # -*- coding: utf-8 -*-
"""FILETIME timestamp implementation."""
from __future__ import unicode_literals
from dfdatetime import definitions
from dfdatetime import interface
class Filetime(interface.DateTimeValues):
"""FILETIME timestamp.
The FILETIME timestamp is a 64-bit integer that contains the number
of 100th nano seconds since 1601-01-01 00:00:00.
Do not confuse this with the FILETIME structure that consists of
2 x 32-bit integers and is presumed to be unsigned.
Attributes:
is_local_time (bool): True if the date and time value is in local time.
precision (str): precision of the date and time value, which should
be one of the PRECISION_VALUES in definitions.
timestamp (int): FILETIME timestamp.
"""
# The difference between Jan 1, 1601 and Jan 1, 1970 in seconds.
_FILETIME_TO_POSIX_BASE = 11644473600
_UINT64_MAX = (1 << 64) - 1
def __init__(self, timestamp=None):
"""Initializes a FILETIME timestamp.
Args:
timestamp (Optional[int]): FILETIME timestamp.
"""
super(Filetime, self).__init__()
self.precision = definitions.PRECISION_100_NANOSECONDS
self.timestamp = timestamp
def CopyFromDateTimeString(self, time_string):
"""Copies a FILETIME timestamp from a date and time string.
Args:
time_string (str): date and time value formatted as:
YYYY-MM-DD hh:mm:ss.######[+-]##:##
Where # are numeric digits ranging from 0 to 9 and the seconds
fraction can be either 3 or 6 digits. The time of day, seconds
fraction and time zone offset are optional. The default time zone
is UTC.
Raises:
ValueError: if the time string is invalid or not supported.
"""
date_time_values = self._CopyDateTimeFromString(time_string)
year = date_time_values.get('year', 0)
month = date_time_values.get('month', 0)
day_of_month = date_time_values.get('day_of_month', 0)
hours = date_time_values.get('hours', 0)
minutes = date_time_values.get('minutes', 0)
seconds = date_time_values.get('seconds', 0)
if year < 1601:
raise ValueError('Year value not supported: {0!s}.'.format(year))
self.timestamp = self._GetNumberOfSecondsFromElements(
year, month, day_of_month, hours, minutes, seconds)
self.timestamp += self._FILETIME_TO_POSIX_BASE
self.timestamp *= definitions.MICROSECONDS_PER_SECOND
self.timestamp += date_time_values.get('microseconds', 0)
self.timestamp *= self._100NS_PER_MICROSECOND
self.is_local_time = False
def CopyToStatTimeTuple(self):
"""Copies the FILETIME timestamp to a stat timestamp tuple.
Returns:
tuple[int, int]: a POSIX timestamp in seconds and the remainder in
100 nano seconds or (None, None) on error.
"""
if (self.timestamp is None or self.timestamp < 0 or
self.timestamp > self._UINT64_MAX):
return None, None
timestamp, remainder = divmod(self.timestamp, self._100NS_PER_SECOND)
timestamp -= self._FILETIME_TO_POSIX_BASE
return timestamp, remainder
def CopyToDateTimeString(self):
"""Copies the FILETIME timestamp to a date and time string.
Returns:
str: date and time value formatted as:
YYYY-MM-DD hh:mm:ss.#######
"""
if (self.timestamp is None or self.timestamp < 0 or
self.timestamp > self._UINT64_MAX):
return
timestamp, remainder = divmod(self.timestamp, self._100NS_PER_SECOND)
number_of_days, hours, minutes, seconds = self._GetTimeValues(timestamp)
year, month, day_of_month = self._GetDateValues(
number_of_days, 1601, 1, 1)
return '{0:04d}-{1:02d}-{2:02d} {3:02d}:{4:02d}:{5:02d}.{6:07d}'.format(
year, month, day_of_month, hours, minutes, seconds, remainder)
def GetPlasoTimestamp(self):
"""Retrieves a timestamp that is compatible with plaso.
Returns:
int: a POSIX timestamp in microseconds or None on error.
"""
if (self.timestamp is None or self.timestamp < 0 or
self.timestamp > self._UINT64_MAX):
return
timestamp, _ = divmod(self.timestamp, self._100NS_PER_MICROSECOND)
return timestamp - (
self._FILETIME_TO_POSIX_BASE * definitions.MICROSECONDS_PER_SECOND)
|