[BUG] Chainsaw output getting time adjusted incorrectly

[reece394]

It seems that when outputting chainsaw output it seems to use the local time the event was based on rather than UTC time like the rest of the EZ Tools Suite. As a result the chainsaw output does not line up. Should be standardised to UTC. Found this unusual as the actual original chainsaw csv is in UTC time but the tool converts it to +1 which was correct at the time due to location (UK Time)

Forensic Timeliner:

Original Antivirus CSV:

Timeline Explorer

Doesn't seem to happen when outputting to jsonl

[acquiredsecurity]

Is that occurring only in the AV log ? There's no time stamp adjustment happening in the code. Can you provide a download link for the original file?

[acquiredsecurity]

Can you also verify you're running the latest version? I just tested it locally on sample data and this didn't happen.

[reece394]

I can confirm it happens with all of chainsaws outputs in Forensic Timeliner. Latest featured version was used from releases which was Forensic Timeliner 2.2. Attached is the results of running it as well as the original file. chainsaw.zip

Following command was ran:

ForensicTimeliner.exe --BaseDir C:\chainsaw --ALL --OutputFile C:\chainsaw\ForensicTimeliner.csv --EnableTagger --NoBanner --NoPrompt

I highly suspect it is a regional issue with the device it is running on because when we get to a date where the time zone is not in daylight savings time it displays in UTC as expected.

Here is a dump of the culture info in case that helps trace it too. (Wonder if it is an InvariantCulture issue?)

get-culture | format-list -property *

Parent                         : en
LCID                           : 2057
KeyboardLayoutId               : 2057
Name                           : en-GB
IetfLanguageTag                : en-GB
DisplayName                    : English (United Kingdom)
NativeName                     : English (United Kingdom)
EnglishName                    : English (United Kingdom)
TwoLetterISOLanguageName       : en
ThreeLetterISOLanguageName     : eng
ThreeLetterWindowsLanguageName : ENG
CompareInfo                    : CompareInfo - en-GB
TextInfo                       : TextInfo - en-GB
IsNeutralCulture               : False
CultureTypes                   : SpecificCultures, InstalledWin32Cultures, FrameworkCultures
NumberFormat                   : System.Globalization.NumberFormatInfo
DateTimeFormat                 : System.Globalization.DateTimeFormatInfo
Calendar                       : System.Globalization.GregorianCalendar
OptionalCalendars              : {System.Globalization.GregorianCalendar, System.Globalization.GregorianCalendar}
UseUserOverride                : True
IsReadOnly                     : False


(get-culture).DateTimeFormat | fl -property *


AMDesignator                     : AM
Calendar                         : System.Globalization.GregorianCalendar
DateSeparator                    : /
FirstDayOfWeek                   : Monday
CalendarWeekRule                 : FirstFourDayWeek
FullDateTimePattern              : dd MMMM yyyy HH:mm:ss
LongDatePattern                  : dd MMMM yyyy
LongTimePattern                  : HH:mm:ss
MonthDayPattern                  : d MMMM
PMDesignator                     : PM
RFC1123Pattern                   : ddd, dd MMM yyyy HH':'mm':'ss 'GMT'
ShortDatePattern                 : dd/MM/yyyy
ShortTimePattern                 : HH:mm
SortableDateTimePattern          : yyyy'-'MM'-'dd'T'HH':'mm':'ss
TimeSeparator                    : :
UniversalSortableDateTimePattern : yyyy'-'MM'-'dd HH':'mm':'ss'Z'
YearMonthPattern                 : MMMM yyyy
AbbreviatedDayNames              : {Sun, Mon, Tue, Wed...}
ShortestDayNames                 : {Su, Mo, Tu, We...}
DayNames                         : {Sunday, Monday, Tuesday, Wednesday...}
AbbreviatedMonthNames            : {Jan, Feb, Mar, Apr...}
MonthNames                       : {January, February, March, April...}
IsReadOnly                       : False
NativeCalendarName               : Gregorian Calendar
AbbreviatedMonthGenitiveNames    : {Jan, Feb, Mar, Apr...}
MonthGenitiveNames               : {January, February, March, April...}

[acquiredsecurity]

Thanks for the info! I should be able to fix this quickly I will let you know when it's ready and release a beta for testing.

[sidomir7]

This issue is also present in hayabusa output. So both hayabusa and chainsaw has same problem.
In generated files timestamps are correct. in timeline created by timeliner there is problem.

[acquiredsecurity]

Thanks for the update I haven't gotten to this as I have been working on other projects but I will circle back and try and get to this soon!

[acquiredsecurity]

I have tested this locally and it seems to be fixed. Take a look if you get a chnace and let me know. Sorry for the delay!
I will uplod a beta in the releases with the fix. Haven;t had time to test all features!

[sidomir7]

So I tested it use beta version on same data. Now it looks like all of the event logs data are in local time of machine where Timeline Explorer was run. It can be checked int for example in EvtxeCmd output.

Second screenshot is from version 2.2 are in UTC

Source file generated by EvtxeCmd

In output from Beta version all logs look they are in local timezone.

The best would be if someone else could verify.

[sidomir7]

For my testing I used Desktop Disk Image from this site
https://dfirmadness.com/the-stolen-szechuan-sauce/

[acquiredsecurity]

Thanks for the quick reply. I will work on this today and see what is happening.

[sidomir7]

@acquiredsecurity and also when you check my screenshot there are the duplicit events in timeline for EvtxCMD. Correct should be for that event ID only 3 events. I do not know ho duplicity ocure because even in source evtx file are only 3 events.

[acquiredsecurity]

Thanks I will consider looking into the event duplication but for now fixing the native timestamp issues is the priority.

[acquiredsecurity]

Added a new release that hopefully solves some of the issue with timestamps issues we're having in this thread. Tested on my end and it appears to be working Let me know! I also tested in that evidence sample and all the dates times match.

[sidomir7]

I downloaded new release and for me still my local time in EvtxCMD.

I will test on different pc.

[sidomir7]

Tested on different PC with same result