l2t_csv: output in second precision?

[MariasStory]

Description of problem:

I don't see microseconds in MFT data while doing psort of plaso file to csv.

Command line and arguments:

psort.py -w output.csv input.plaso

Source data:

From MFT export:
/thumbcache_sr.db","2013-04-30 17:31:06.640667","2013-04-30 17:31:06.640667" ...

In csv file:
04/30/2013,17:31:06,UTC,MACB,FILE,NTFS Content Modification Time,Content Modification Time; Creation Time; Last Access Time; Metadata Modification Time,- /thumbcache_sr.db

Plaso version:

20180528

Operating system Plaso is running on:

linux

Installation method:

• installed from [l2tbinaries][https://github.com/log2timeline/l2tbinaries] master branch

[Onager]

The dynamic output format, which is the default CSV output format you're referring to here outputs time according to ISO8601, which doesn't support microseconds directly. It does support fractional time values, which we could use to represent values more precise than a second, but this requires some work in dfdatetime.

If you need sub-second precision, you can try the json output modules which have the date in Plaso's internal representation of microseconds since the Unix epoch , or xlsx which uses the native Excel format.

[MariasStory]

Hi @Onager,
If I am right, the time format is defined in the file l2t_csv.py in line 163:

    time_string = '{0:02d}:{1:02d}:{2:02d}'.format(
        date_use.hour, date_use.minute, date_use.second)

There should be microseconds somewhere.

I guess this will work:

    time_string = '{0:02d}:{1:02d}:{2:02d}.{3:06d}'.format(
        date_use.hour, date_use.minute, date_use.second, date_use.micro_seconds)

Please check it.

[MariasStory]

Hi, I did some tests and the simple modification of the format string did not work for me.
Someone else have an idea?

[joachimmetz]

Duplicate of #2132