10 May 2020

Missleading psort.py (plaso) timezone paremeter


psort.py -z Singapore  -o l2tcsv -w result.csv  input_data.plaso



psort.py has '-z' option which is for timezone parameter.

But it will not convert the time to the preferred timezone, instead it just put the label.


For example if we run the command with '-z UTC' , it will result as:
     04/15/2020,23:59:26,UTC, ........

And if we run the psort command with  -z Singopore, the result is:
   04/15/2020,23:59:26,Singapore, .....


The timestamp is exactly same.


No comments:

Post a Comment

Terima kasih