EricZimmerman/evtx

Integer as string

forensenellanebbia opened this issue · 3 comments

Is there a way to consider a value as integer instead of string? My goal is to write a map that shows the remaining battery percentage (RemainingCapacity/FullChargeCapacity)*100 based on the following event:

<Event>
  <System>
    <Provider Name="Microsoft-Windows-Kernel-Power" Guid="331c3b3a-2005-44c2-ac5e-77220c37d6b4" />
    <EventID>105</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>100</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000404</Keywords>
    <TimeCreated SystemTime="2020-09-22 16:23:18.0478843" />
    <EventRecordID>5495</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="17436" />
    <Channel>System</Channel>
    <Computer>MYPC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="AcOnline">False</Data>
    <Data Name="RemainingCapacity">56293</Data>
    <Data Name="FullChargeCapacity">62654</Data>
  </EventData>
</Event>

Appears to be a duplicate issue. Assuming #98 was a typo?

Appears to be a duplicate issue. Assuming #98 was a typo?

Sorry, I didn't notice I sent it twice.

Honestly, you could prob still make a Map for this and make the data in PayloadData1, for instance, something that's turnkey to copy/paste into Google or any other search engine. That way, the Map is made, and the visibility is given to the examiner about the artifacts available. It's better than nothing IMO!