evtxtools 1.12.1

tools for the analysis of evtx files
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47

use std::fmt::Display;

use chrono::{DateTime, Utc};

use super::Process;

#[derive(Eq, PartialEq, Hash, Clone)]
pub (crate) struct UniquePid {
    timestamp: DateTime<Utc>,
    pid: u64
}

impl From<&Process> for UniquePid {
    fn from(process: &Process) -> Self {
        Self {
            timestamp: process.timestamp,
            pid: process.new_process_id
        }
    }
}

impl Display for UniquePid {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        write!(f, "PID '{}' started at {}", self.pid, self.timestamp.to_rfc3339_opts(chrono::SecondsFormat::Secs, true))
    }
}

impl UniquePid {
    pub fn timestamp(&self) -> &DateTime<Utc> {
        &self.timestamp
    }
}

impl Ord for UniquePid {
    fn cmp(&self, other: &Self) -> std::cmp::Ordering {
        self.timestamp.cmp(&other.timestamp)
    }
}
impl PartialOrd for UniquePid {
    fn partial_cmp(&self, other: &Self) -> Option<std::cmp::Ordering> {
        if self.pid != other.pid {
            None
        } else {
            Some(self.timestamp.cmp(&other.timestamp))
        }
    }
}