Skip to content

Commit 27e6cf7

Browse files
author
casework
committed
Set Skype timestamps to 'sentTime'
1 parent 993c67f commit 27e6cf7

File tree

5 files changed

+1064
-1072
lines changed

5 files changed

+1064
-1072
lines changed

case_plaso/event_exporters/skype.py

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -113,10 +113,10 @@ def export_event(self, event):
113113
trace = self.document.create_trace()
114114
pb = trace.create_property_bundle(
115115
'Message',
116-
unknownTime=lib.convert_timestamp(event.timestamp), # This is probably sent time, but we can't be sure.
116+
# TODO: Confirm the difference between a sentTime and createdTime for message.
117+
sentTime=lib.convert_timestamp(event.timestamp),
117118
messageText=getattr(event, 'text', None))
118119

119-
120120
# Add author.
121121
# The developer of this parser, connected the diplayname to the author username.
122122
display_name, _, username = event.from_account.rpartition(' ')
@@ -158,6 +158,5 @@ def export_event(self, event):
158158
trace.create_property_bundle(
159159
'Message',
160160
participant=contact,
161-
unknownTime=lib.convert_timestamp(event.timestamp) # TODO: Figure out meaning. (its probably created or sent time)
162-
)
161+
sentTime=lib.convert_timestamp(event.timestamp))
163162

0 commit comments

Comments
 (0)