[sleuthkit-developers] Need assistance with timestamp conversions

[Chandapiwa M. Mpuchane-M. <cmp...@un...>]

I am new to python and Autopsy Sleuthkit, and i am having a proplem with
converting a timestamp to local time such that it would work in Autopsy. Im
developing an extension module using python for a .db source file.

I have attached the my .py file and word document with the screenshot
showing my output result on Autopsy. I have included my sample database as
well.


The problem is on the Date Time and Start Date Time. The TSK_COMMENT AND
TSK_DECRIPTION field show the right info, but since its data type does not
match with the datetime, I get an error message if i use it to set my
TSK_DATETIME.

Your help will be really appreciated,


Kind Regards

Chandapiwa Monica Mpuchane-Molefha
Graduate Student
University of Nebraska at Omaha
MS in Management Information Systems