google / grr

GRR Rapid Response: remote live forensics for incident response

Home Page:https://grr-doc.readthedocs.io/

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Files in archives generated by ApiGetFlowFilesArchiveHandler have incorrect "Date modified" metadata

simstoykov opened this issue · comments

Environment

Describe the issue
I am utilizing the GetFilesArchiveMappings flow functionality, which adds archive-generation capabilities to a flow for collected files on the server. The implementation seems to be here:
https://github.com/google/grr/blob/master/grr/server/grr_response_server/gui/api_plugins/flow.py#L638

The issue is that "Date modified" metadata of files in the archive seems to be set incorrectly to "Jan 1, 1980, 12:00 AM":
image

Output from ls:

simstoykov@penguin:~/C_4d10af5f6739f473_F1A7616E8AECA377_OsqueryFlow/osquery_collected_files/usr/local/google/home/simstoykov$ ls -lh
total 24K
-rw------- 1 simstoykov simstoykov 1.0K Jan  1  1980 fr1.txt
-rw------- 1 simstoykov simstoykov 1.0K Jan  1  1980 hard_test_file.txt
-rw------- 1 simstoykov simstoykov 1.0K Jan  1  1980 names_generated.txt
-rw------- 1 simstoykov simstoykov 1.0K Jan  1  1980 names_original.txt
-rw------- 1 simstoykov simstoykov 1.0K Jan  1  1980 sym_test_file.txt
-rw------- 1 simstoykov simstoykov 1.0K Jan  1  1980 test_file.txt