fix InstallDate regf parsing

fox-it · Oct 23, 2024 · ae15c0a · ae15c0a
1 parent 3a3a769
commit ae15c0a
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/dissect/target/plugins/os/windows/regf/applications.py b/dissect/target/plugins/os/windows/regf/applications.py
@@ -1,3 +1,4 @@
+from datetime import datetime
 from typing import Iterator
 
 from dissect.target.exceptions import UnsupportedPluginError
@@ -45,10 +46,14 @@ def applications(self) -> Iterator[WindowsApplicationRecord]:
         for uninstall in self.keys:
             for app in uninstall.subkeys():
                 values = {value.name: value.value for value in app.values()}
+                install_date = None
+
+                if install_date := values.get("InstallDate"):
+                    install_date = datetime.strptime(install_date, "%Y%m%d")
 
                 yield WindowsApplicationRecord(
                     ts_modified=app.ts,
-                    ts_installed=values.get("InstallDate"),
+                    ts_installed=install_date,
                     name=values.get("DisplayName") or app.name,
                     version=values.get("DisplayVersion"),
                     author=values.get("Publisher"),