> On Wed, Aug 10, 2011 at 01:24:05PM -0700, Alex Nelson wrote:
>> These changes are bringing the hivexml program into a file system
>> analysis suite that deals with many different file system types,
>> each with their own timestamp recording quirks, and even some file
>> formats which have yet more quirks. We think that ISO 8601 is the
>> best umbrella output format, with an additional XML attribute noting
>> the time granularity (like FAT's 2-second and 1-day granularities).
>> That's why we're outputting strings in C, which, yes, feels wrong,
>> but simplifies parsing outside of the scope of hivexml. We're
>> dealing with the time presentation proactively.
>
> Reading this over again, I think you may be confusing how the hivex
> API/library returns the data and how hivexml displays the data. The
> two are completely different things. You can have hivexml displaying
> the data as an ISO 8601 string (in fact, I would say that is a very
> good choice). But that does not in any way require that the C API
> returns a string.
Ah, understood. Ok, in that case I'm fine with changing things as you suggested.
Next patch coming soon.
Please, please, please don't return the Windows time. Python does not
have a library or function for dealing with the Windows time, but it
does handle ISO 8601. And UNIX epoch. And a quick search for Perl
doesn't show anything for Windows timestamp in the top 5, but also has
a module for ISO8601.
Elizabeth