From abd3d495dd3719571a0f001057d4ccdc32874b6f Mon Sep 17 00:00:00 2001
From: Jan Starke <jan.starke@posteo.de>
Date: Tue, 27 Feb 2024 11:54:15 +0100
Subject: [PATCH 01/35] add zip2bodyfile

---
 Cargo.lock                   | 177 ++++++++++++++++++++++++++++++++++-
 Cargo.toml                   |  13 ++-
 src/bin/zip2bodyfile/cli.rs  |  29 ++++++
 src/bin/zip2bodyfile/main.rs |  59 ++++++++++++
 4 files changed, 274 insertions(+), 4 deletions(-)
 create mode 100644 src/bin/zip2bodyfile/cli.rs
 create mode 100644 src/bin/zip2bodyfile/main.rs

diff --git a/Cargo.lock b/Cargo.lock
index 3374b4e..11b7cf1 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -17,6 +17,17 @@ version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f26201604c87b1e01bd3d98f8d5d9a8fcbb815e8cedb41ffccbeb4bf593a35fe"
 
+[[package]]
+name = "aes"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b169f7a6d4742236a0a00c541b845991d0ac43e546831af1249753ab4c3aa3a0"
+dependencies = [
+ "cfg-if",
+ "cipher",
+ "cpufeatures",
+]
+
 [[package]]
 name = "aho-corasick"
 version = "1.1.1"
@@ -183,6 +194,12 @@ version = "0.21.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9ba43ea6f343b788c8764558649e08df62f86c6ef251fdaeb1ffd010a9ae50a2"
 
+[[package]]
+name = "base64ct"
+version = "1.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8c3c1a368f70d6cf7302d78f8f7093da241fb8e8807c05cc9e51a125895a6d5b"
+
 [[package]]
 name = "binread"
 version = "2.2.0"
@@ -282,6 +299,27 @@ version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a2bd12c1caf447e69cd4528f47f94d203fd2582878ecb9e9465484c4148a8223"
 
+[[package]]
+name = "bzip2"
+version = "0.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bdb116a6ef3f6c3698828873ad02c3014b3c85cadb88496095628e3ef1e347f8"
+dependencies = [
+ "bzip2-sys",
+ "libc",
+]
+
+[[package]]
+name = "bzip2-sys"
+version = "0.1.11+1.0.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "736a955f3fa7875102d57c82b8cac37ec45224a07fd32d58f9f7a186b6cd4cdc"
+dependencies = [
+ "cc",
+ "libc",
+ "pkg-config",
+]
+
 [[package]]
 name = "camino"
 version = "1.1.6"
@@ -319,6 +357,7 @@ version = "1.0.83"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f1174fb0b6ec23863f8b971027804a42614e347eafb0a95bf0b12cdae21fc4d0"
 dependencies = [
+ "jobserver",
  "libc",
 ]
 
@@ -365,6 +404,16 @@ dependencies = [
  "phf_codegen",
 ]
 
+[[package]]
+name = "cipher"
+version = "0.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
+dependencies = [
+ "crypto-common",
+ "inout",
+]
+
 [[package]]
 name = "clap"
 version = "3.2.25"
@@ -515,6 +564,12 @@ dependencies = [
  "windows-sys 0.45.0",
 ]
 
+[[package]]
+name = "constant_time_eq"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "245097e9a4535ee1e3e3931fcfcd55a796a44c643e8596ff6566d68f09b87bbc"
+
 [[package]]
 name = "core-foundation"
 version = "0.9.3"
@@ -702,7 +757,7 @@ dependencies = [
 
 [[package]]
 name = "dfir-toolkit"
-version = "0.10.1"
+version = "0.11.0"
 dependencies = [
  "anyhow",
  "assert-json-diff",
@@ -742,7 +797,7 @@ dependencies = [
  "more-asserts",
  "nt_hive2",
  "num",
- "num-derive 0.4.0",
+ "num-derive 0.3.3",
  "num-traits",
  "ouroboros",
  "phf",
@@ -761,6 +816,7 @@ dependencies = [
  "tokio",
  "tokio-async-drop",
  "winstructs",
+ "zip",
 ]
 
 [[package]]
@@ -817,6 +873,7 @@ checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
 dependencies = [
  "block-buffer",
  "crypto-common",
+ "subtle",
 ]
 
 [[package]]
@@ -1269,6 +1326,15 @@ version = "0.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d77f7ec81a6d05a3abb01ab6eb7590f6083d08449fe5a1c8b1e620283546ccb7"
 
+[[package]]
+name = "hmac"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
+dependencies = [
+ "digest",
+]
+
 [[package]]
 name = "http"
 version = "0.2.9"
@@ -1418,6 +1484,15 @@ version = "1.0.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bfa799dd5ed20a7e349f3b4639aa80d74549c81716d9ec4f994c9b5815598306"
 
+[[package]]
+name = "inout"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a0c10553d664a4d0bcff9f4215d0aac67a639cc68ef660840afe309b807bc9f5"
+dependencies = [
+ "generic-array",
+]
+
 [[package]]
 name = "instant"
 version = "0.1.12"
@@ -1459,6 +1534,15 @@ version = "1.0.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "af150ab688ff2122fcef229be89cb50dd66af9e01a4ff320cc137eecc9bacc38"
 
+[[package]]
+name = "jobserver"
+version = "0.1.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ab46a6e9526ddef3ae7f787c06f0f2600639ba80ea3eade3d8e670a2230f51d6"
+dependencies = [
+ "libc",
+]
+
 [[package]]
 name = "js-sys"
 version = "0.3.64"
@@ -1912,6 +1996,17 @@ dependencies = [
  "regex",
 ]
 
+[[package]]
+name = "password-hash"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7676374caaee8a325c9e7a2ae557f216c5563a171d6997b0ef8a65af35147700"
+dependencies = [
+ "base64ct",
+ "rand_core",
+ "subtle",
+]
+
 [[package]]
 name = "paste"
 version = "0.1.18"
@@ -1931,6 +2026,18 @@ dependencies = [
  "proc-macro-hack",
 ]
 
+[[package]]
+name = "pbkdf2"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "83a0692ec44e4cf1ef28ca317f14f8f07da2d95ec3fa01f86e4467b725e60917"
+dependencies = [
+ "digest",
+ "hmac",
+ "password-hash",
+ "sha2",
+]
+
 [[package]]
 name = "percent-encoding"
 version = "2.3.0"
@@ -2422,6 +2529,17 @@ dependencies = [
  "syn 1.0.109",
 ]
 
+[[package]]
+name = "sha1"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3bf829a2d51ab4a5ddf1352d8470c140cadc8301b2ae1789db023f01cedd6ba"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
 [[package]]
 name = "sha2"
 version = "0.10.8"
@@ -2558,6 +2676,12 @@ dependencies = [
  "syn 2.0.37",
 ]
 
+[[package]]
+name = "subtle"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "81cdd64d312baedb58e21336b31bc043b77e01cc99033ce76ef539f78e965ebc"
+
 [[package]]
 name = "syn"
 version = "1.0.109"
@@ -3241,3 +3365,52 @@ name = "zeroize"
 version = "1.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2a0956f1ba7c7909bfb66c2e9e4124ab6f6482560f6628b5aaeba39207c9aad9"
+
+[[package]]
+name = "zip"
+version = "0.6.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "760394e246e4c28189f19d488c058bf16f564016aefac5d32bb1f3b51d5e9261"
+dependencies = [
+ "aes",
+ "byteorder",
+ "bzip2",
+ "constant_time_eq",
+ "crc32fast",
+ "crossbeam-utils",
+ "flate2",
+ "hmac",
+ "pbkdf2",
+ "sha1",
+ "time",
+ "zstd",
+]
+
+[[package]]
+name = "zstd"
+version = "0.11.2+zstd.1.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "20cc960326ece64f010d2d2107537f26dc589a6573a316bd5b1dba685fa5fde4"
+dependencies = [
+ "zstd-safe",
+]
+
+[[package]]
+name = "zstd-safe"
+version = "5.0.2+zstd.1.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d2a5585e04f9eea4b2a3d1eca508c4dee9592a89ef6f450c11719da0726f4db"
+dependencies = [
+ "libc",
+ "zstd-sys",
+]
+
+[[package]]
+name = "zstd-sys"
+version = "2.0.9+zstd.1.5.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e16efa8a874a0481a574084d34cc26fdb3b99627480f785888deb6386506656"
+dependencies = [
+ "cc",
+ "pkg-config",
+]
diff --git a/Cargo.toml b/Cargo.toml
index 9047f40..3d167a8 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "dfir-toolkit"
-version = "0.10.1"
+version = "0.11.0"
 edition = "2021"
 authors = ["Jan Starke <jan.starke@posteo.de>", "Deborah Mahn <deborah.mahn@dfir-dd.de>"]
 description = "CLI tools for digital forensics and incident response"
@@ -83,9 +83,14 @@ name = "pf2bodyfile"
 path = "src/bin/pf2bodyfile/main.rs"
 required-features = ["pf2bodyfile"]
 
+[[bin]]
+name = "zip2bodyfile"
+path = "src/bin/zip2bodyfile/main.rs"
+required-features = ["zip2bodyfile"]
+
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 [features]
-default = ["pol_export", "mactime2", "evtxtools", "regdump", "hivescan", "cleanhive", "ipgrep", "ts2date", "lnk2bodyfile", "pf2bodyfile"]
+default = ["pol_export", "mactime2", "evtxtools", "regdump", "hivescan", "cleanhive", "ipgrep", "ts2date", "lnk2bodyfile", "pf2bodyfile", "zip2bodyfile"]
 mactime2 = ["gzip", "elastic", "chrono-tz", "thiserror", "bitflags", "encoding_rs_io"]
 gzip = ["flate2"]
 elastic = ["elasticsearch", "tokio", "futures", "serde_json", "sha2", "base64", "num-traits", "num-derive", "strum", "strum_macros", "tokio-async-drop"]
@@ -100,6 +105,7 @@ ipgrep = []
 ts2date = ["regex"]
 lnk2bodyfile = ["lnk"]
 pf2bodyfile = ["num", "libc", "frnsc-prefetch", "forensic-rs"]
+zip2bodyfile = ["zip"]
 
 regdump = ["nt_hive2"]
 hivescan = ["nt_hive2"]
@@ -179,6 +185,9 @@ num = {version="0", optional=true}
 frnsc-prefetch = {version="0.9", optional=true}
 forensic-rs = {version="0.9.1", optional=true}
 
+# zip2bodyfile
+zip = {version="0.6", optional=true}
+
 [dev-dependencies]
 
 # mactime2
diff --git a/src/bin/zip2bodyfile/cli.rs b/src/bin/zip2bodyfile/cli.rs
new file mode 100644
index 0000000..5a22034
--- /dev/null
+++ b/src/bin/zip2bodyfile/cli.rs
@@ -0,0 +1,29 @@
+use clap::Parser;
+use clap::ValueHint;
+use clio::ClioPath;
+use dfir_toolkit::common::HasVerboseFlag;
+use getset::Getters;
+use log::LevelFilter;
+
+/// creates bodyfile from Windows Prefetch files
+#[derive(Parser, Getters)]
+#[clap(name=env!("CARGO_BIN_NAME"), author, version)]
+#[getset(get = "pub (crate)")]
+pub(crate) struct Cli {
+    /// names of the archive files (commonly files with 'zip' extension)
+    #[clap(value_hint=ValueHint::FilePath)]
+    zip_files: Vec<ClioPath>,
+
+    /// show the name of the archive in the bodyfile output
+    #[clap(long("show-archive-name"))]
+    show_archive_name: bool,
+
+    #[clap(flatten)]
+    verbose: clap_verbosity_flag::Verbosity,
+}
+
+impl HasVerboseFlag for Cli {
+    fn log_level_filter(&self) -> LevelFilter {
+        self.verbose.log_level_filter()
+    }
+}
diff --git a/src/bin/zip2bodyfile/main.rs b/src/bin/zip2bodyfile/main.rs
new file mode 100644
index 0000000..c547984
--- /dev/null
+++ b/src/bin/zip2bodyfile/main.rs
@@ -0,0 +1,59 @@
+mod cli;
+
+use std::io::{Read, Seek};
+
+use cli::Cli;
+use dfir_toolkit::common::bodyfile::Bodyfile3Line;
+use dfir_toolkit::common::FancyParser;
+use log::{error, warn};
+use zip::ZipArchive;
+
+fn main() -> anyhow::Result<()> {
+    let cli = Cli::parse_cli();
+
+    if cli.zip_files().iter().any(|f| !f.path().exists()) {
+        anyhow::bail!("some files you specified do not exist");
+    }
+    if cli.zip_files().iter().any(|f| !f.path().is_file()) {
+        anyhow::bail!("some paths you specified are no files");
+    }
+    for input in cli.zip_files().iter() {
+        if let Some(zip_os_filename) = input.path().file_name() {
+            if let Some(zip_filename) = zip_os_filename.to_str() {
+                let mut zip_archive = ZipArchive::new(input.clone().open()?)?;
+                zip_archive.display_zip_file(zip_filename, *cli.show_archive_name())?;
+            } else {
+                error!("invalid Unicode characters in filename: '{zip_os_filename:?}'")
+            }
+        } else {
+            warn!("unable to handle directories; you must specify concrete file names");
+        }
+    }
+    Ok(())
+}
+
+trait DisplayZipFile {
+    fn display_zip_file(&mut self, zip_file_name: &str, show_archive_name: bool) -> anyhow::Result<()>;
+}
+
+impl<R> DisplayZipFile for ZipArchive<R> where R: Read + Seek {
+    fn display_zip_file(&mut self, zip_file_name: &str, show_archive_name: bool) -> anyhow::Result<()> {
+        for index in 0..self.len() {
+            let file = self.by_index(index)?;
+
+            let name = if show_archive_name {
+                format!("{} (in archive {zip_file_name})", file.name())
+            } else {
+                file.name().to_string()
+            };
+
+            let bf_line = Bodyfile3Line::new()
+                .with_owned_name(name)
+                .with_size(file.size())
+                .with_mtime(file.last_modified().to_time()?.unix_timestamp().into());
+
+            println!("{bf_line}");
+        }
+        Ok(())
+    }
+}

From 5c46e59504ff80d27b353cc0a29d0cd553e62736 Mon Sep 17 00:00:00 2001
From: Jan Starke <jan.starke@posteo.de>
Date: Tue, 27 Feb 2024 11:55:45 +0100
Subject: [PATCH 02/35] update documentation

---
 README.md            |  1 +
 doc/pf2bodyfile.md   |  1 +
 doc/zip2bodyfile.md  | 33 +++++++++++++++++++++++++++++++++
 scripts/update-md.sh |  1 +
 4 files changed, 36 insertions(+)
 create mode 100644 doc/zip2bodyfile.md

diff --git a/README.md b/README.md
index e831147..e413b0a 100644
--- a/README.md
+++ b/README.md
@@ -35,6 +35,7 @@
   - [ ] [`regview`](https://github.com/janstarke/regview)
   - [x] [`ts2date`](https://github.com/dfir-dd/dfir-toolkit/blob/main/doc/ts2date.md)
   - [ ] [`usnjrnl_dump`](https://github.com/janstarke/usnjrnl)
+  - [x] [`zip2bodyfile`](https://github.com/dfir-dd/dfir-toolkit/blob/main/doc/zip2bodyfile.md)
 
 # Overview of timelining tools
 
diff --git a/doc/pf2bodyfile.md b/doc/pf2bodyfile.md
index 1e5e039..748437b 100644
--- a/doc/pf2bodyfile.md
+++ b/doc/pf2bodyfile.md
@@ -18,6 +18,7 @@ creates bodyfile from Windows Prefetch files
 
 ###### **Options:**
 
+* `-I` — show not only the executed files, but all references files -- such as libraries -- as well
 * `-v`, `--verbose` — More output per occurrence
 * `-q`, `--quiet` — Less output per occurrence
 
diff --git a/doc/zip2bodyfile.md b/doc/zip2bodyfile.md
new file mode 100644
index 0000000..a4161ce
--- /dev/null
+++ b/doc/zip2bodyfile.md
@@ -0,0 +1,33 @@
+# Command-Line Help for `zip2bodyfile`
+
+This document contains the help content for the `zip2bodyfile` command-line program.
+
+**Command Overview:**
+
+* [`zip2bodyfile`↴](#zip2bodyfile)
+
+## `zip2bodyfile`
+
+creates bodyfile from Windows Prefetch files
+
+**Usage:** `zip2bodyfile [OPTIONS] [ZIP_FILES]...`
+
+###### **Arguments:**
+
+* `<ZIP_FILES>` — names of the archive files (commonly files with 'zip' extension)
+
+###### **Options:**
+
+* `--show-archive-name` — show the name of the archive in the bodyfile output
+* `-v`, `--verbose` — More output per occurrence
+* `-q`, `--quiet` — Less output per occurrence
+
+
+
+<hr/>
+
+<small><i>
+    This document was generated automatically by
+    <a href="https://crates.io/crates/clap-markdown"><code>clap-markdown</code></a>.
+</i></small>
+
diff --git a/scripts/update-md.sh b/scripts/update-md.sh
index b68a908..be4b8c7 100755
--- a/scripts/update-md.sh
+++ b/scripts/update-md.sh
@@ -40,6 +40,7 @@ cat >README.md <<'EOF'
   - [ ] [`regview`](https://github.com/janstarke/regview)
   - [x] [`ts2date`](https://github.com/dfir-dd/dfir-toolkit/blob/main/doc/ts2date.md)
   - [ ] [`usnjrnl_dump`](https://github.com/janstarke/usnjrnl)
+  - [x] [`zip2bodyfile`](https://github.com/dfir-dd/dfir-toolkit/blob/main/doc/zip2bodyfile.md)
 
 # Overview of timelining tools
 

From d3442935d525c0cf543d806a4bab24ff9c5b3efc Mon Sep 17 00:00:00 2001
From: Jan Starke <jan.starke@posteo.de>
Date: Tue, 27 Feb 2024 14:47:37 +0100
Subject: [PATCH 03/35] add support for creation and modification date

---
 Cargo.lock                  | 13 +++++++++++--
 Cargo.toml                  |  2 +-
 src/bin/pf2bodyfile/main.rs | 26 +++++++++++++++++++++-----
 3 files changed, 33 insertions(+), 8 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 3374b4e..d186aa6 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -728,7 +728,7 @@ dependencies = [
  "encoding_rs_io",
  "evtx",
  "flate2",
- "forensic-rs",
+ "forensic-rs 0.11.0",
  "frnsc-prefetch",
  "futures",
  "getset",
@@ -1064,6 +1064,15 @@ dependencies = [
  "thiserror",
 ]
 
+[[package]]
+name = "forensic-rs"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccb29be9815a6c5c5ed191acb436097f45edf5bd8a50f572a5a4296a45ee44ff"
+dependencies = [
+ "serde",
+]
+
 [[package]]
 name = "form_urlencoded"
 version = "1.2.0"
@@ -1080,7 +1089,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2ed2131c091273267486b2dabcc96c2bb6d7374d27f7827c37d98de86daa2a2f"
 dependencies = [
  "crc32fast",
- "forensic-rs",
+ "forensic-rs 0.9.1",
 ]
 
 [[package]]
diff --git a/Cargo.toml b/Cargo.toml
index 9047f40..bc7309e 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -177,7 +177,7 @@ lnk = {version="0.5.1", optional=true}
 libc = {version="0.2", optional=true}
 num = {version="0", optional=true}
 frnsc-prefetch = {version="0.9", optional=true}
-forensic-rs = {version="0.9.1", optional=true}
+forensic-rs = {version=">=0.11", optional=true}
 
 [dev-dependencies]
 
diff --git a/src/bin/pf2bodyfile/main.rs b/src/bin/pf2bodyfile/main.rs
index b393204..7735af8 100644
--- a/src/bin/pf2bodyfile/main.rs
+++ b/src/bin/pf2bodyfile/main.rs
@@ -26,12 +26,17 @@ fn main() -> anyhow::Result<()> {
                 let mut fs = ChRootFileSystem::new(parent, vfs.clone());
                 if let Some(pf_os_filename) = input.path().file_name() {
                     if let Some(pf_filename) = pf_os_filename.to_str() {
-                        let pf_file = read_prefetch_file(
+                        let virtual_file = fs.open(Path::new(&pf_filename.to_string()))?;
+                        let created = virtual_file.metadata()?.created_opt().map(|t| i64::try_from(*t).ok()).flatten();
+                        let modified = virtual_file.metadata()?.modified_opt().map(|t| i64::try_from(*t).ok()).flatten();
+                        let pf_file = read_prefetch_file(pf_filename, virtual_file)?;
+
+                        pf_file.display_prefetch_file(
                             pf_filename,
-                            fs.open(Path::new(&pf_filename.to_string()))?,
+                            *cli.include_metrics(),
+                            created,
+                            modified,
                         )?;
-
-                        pf_file.display_prefetch_file(pf_filename, *cli.include_metrics())?;
                     } else {
                         error!("invalid Unicode characters in filename: '{pf_os_filename:?}'")
                     }
@@ -52,6 +57,8 @@ trait DisplayPrefetchFile {
         &self,
         pf_file_name: &str,
         include_metrics: bool,
+        created: Option<i64>,
+        modified: Option<i64>,
     ) -> anyhow::Result<()>;
 }
 
@@ -60,6 +67,8 @@ impl DisplayPrefetchFile for PrefetchFile {
         &self,
         pf_file_name: &str,
         include_metrics: bool,
+        created: Option<i64>,
+        modified: Option<i64>,
     ) -> anyhow::Result<()> {
         for time in &self.last_run_times {
             let accessed =
@@ -67,12 +76,19 @@ impl DisplayPrefetchFile for PrefetchFile {
                     .to_datetime()
                     .into();
 
-            let bf_line = Bodyfile3Line::new()
+            let mut bf_line = Bodyfile3Line::new()
                 .with_owned_name(format!(
                     "Prefetch: run '{}' (run {} times, read from '{pf_file_name}')",
                     self.name, self.run_count
                 ))
                 .with_atime(accessed);
+
+            if let Some(ts) = created {
+                bf_line = bf_line.with_crtime(ts.into());
+            }
+            if let Some(ts) = modified {
+                bf_line = bf_line.with_mtime(ts.into());
+            }
             println!("{bf_line}");
 
             if include_metrics {

From 89a0dcfebdcaa7f14170a6e1f3eba545159d4c0e Mon Sep 17 00:00:00 2001
From: Jan Starke <jan.starke@posteo.de>
Date: Tue, 27 Feb 2024 16:11:39 +0100
Subject: [PATCH 04/35] format file and update versions

---
 Cargo.lock                  | 913 +++++++++++++++++++-----------------
 Cargo.toml                  |   4 +-
 src/bin/pf2bodyfile/main.rs |  12 +-
 3 files changed, 506 insertions(+), 423 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index d186aa6..71990b4 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -19,9 +19,9 @@ checksum = "f26201604c87b1e01bd3d98f8d5d9a8fcbb815e8cedb41ffccbeb4bf593a35fe"
 
 [[package]]
 name = "aho-corasick"
-version = "1.1.1"
+version = "1.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ea5d730647d4fadd988536d06fecce94b7b4f2a7efdae548f1cf4b63205518ab"
+checksum = "b2969dcb958b36655471fc61f7e416fa76033bdd4bfed0678d8fee1e2d07a1f0"
 dependencies = [
  "memchr",
 ]
@@ -49,9 +49,9 @@ dependencies = [
 
 [[package]]
 name = "anstream"
-version = "0.5.0"
+version = "0.6.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b1f58811cfac344940f1a400b6e6231ce35171f614f26439e80f8c1465c5cc0c"
+checksum = "96b09b5178381e0874812a9b157f7fe84982617e48f71f4e3235482775e5b540"
 dependencies = [
  "anstyle",
  "anstyle-parse",
@@ -63,43 +63,43 @@ dependencies = [
 
 [[package]]
 name = "anstyle"
-version = "1.0.3"
+version = "1.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b84bf0a05bbb2a83e5eb6fa36bb6e87baa08193c35ff52bbf6b38d8af2890e46"
+checksum = "8901269c6307e8d93993578286ac0edf7f195079ffff5ebdeea6a59ffb7e36bc"
 
 [[package]]
 name = "anstyle-parse"
-version = "0.2.1"
+version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "938874ff5980b03a87c5524b3ae5b59cf99b1d6bc836848df7bc5ada9643c333"
+checksum = "c75ac65da39e5fe5ab759307499ddad880d724eed2f6ce5b5e8a26f4f387928c"
 dependencies = [
  "utf8parse",
 ]
 
 [[package]]
 name = "anstyle-query"
-version = "1.0.0"
+version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ca11d4be1bab0c8bc8734a9aa7bf4ee8316d462a08c6ac5052f888fef5b494b"
+checksum = "e28923312444cdd728e4738b3f9c9cac739500909bb3d3c94b43551b16517648"
 dependencies = [
- "windows-sys 0.48.0",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
 name = "anstyle-wincon"
-version = "2.1.0"
+version = "3.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "58f54d10c6dfa51283a066ceab3ec1ab78d13fae00aa49243a45e4571fb79dfd"
+checksum = "1cd54b81ec8d6180e24654d0b371ad22fc3dd083b6ff8ba325b72e00c87660a7"
 dependencies = [
  "anstyle",
- "windows-sys 0.48.0",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
 name = "anyhow"
-version = "1.0.75"
+version = "1.0.80"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4668cab20f66d8d020e1fbc0ebe47217433c1b6c8f2040faf858554e394ace6"
+checksum = "5ad32ce52e4161730f7098c077cd2ed6229b5804ccf99e5366be1ab72a98b4e1"
 
 [[package]]
 name = "assert-json-diff"
@@ -113,9 +113,9 @@ dependencies = [
 
 [[package]]
 name = "assert_cmd"
-version = "2.0.12"
+version = "2.0.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "88903cb14723e4d4003335bb7f8a14f27691649105346a0f0957466c096adfe6"
+checksum = "ed72493ac66d5804837f480ab3766c72bdfab91a65e565fc54fa9e42db0073a8"
 dependencies = [
  "anstyle",
  "bstr",
@@ -128,9 +128,9 @@ dependencies = [
 
 [[package]]
 name = "async-compression"
-version = "0.4.3"
+version = "0.4.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bb42b2197bf15ccb092b62c74515dbd8b86d0effd934795f6687c93b6e679a2c"
+checksum = "a116f46a969224200a0a97f29cfd4c50e7534e4b4826bd23ea2c3c533039c82c"
 dependencies = [
  "flate2",
  "futures-core",
@@ -179,9 +179,9 @@ checksum = "b41b7ea54a0c9d92199de89e20e58d49f02f8e699814ef3fdf266f6f748d15c7"
 
 [[package]]
 name = "base64"
-version = "0.21.4"
+version = "0.21.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ba43ea6f343b788c8764558649e08df62f86c6ef251fdaeb1ffd010a9ae50a2"
+checksum = "9d297deb1925b89f2ccc13d7635fa0714f12c87adce1c75356b39ca9b7178567"
 
 [[package]]
 name = "binread"
@@ -234,9 +234,9 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 
 [[package]]
 name = "bitflags"
-version = "2.4.0"
+version = "2.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4682ae6287fcf752ecaabbfcc7b6f9b72aa33933dc23a554d853aea8eea8635"
+checksum = "ed570934406eb16438a4e976b1b4500774099c13b8cb96eec99f620f05090ddf"
 
 [[package]]
 name = "block-buffer"
@@ -249,9 +249,9 @@ dependencies = [
 
 [[package]]
 name = "bstr"
-version = "1.6.2"
+version = "1.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c2f7349907b712260e64b0afe2f84692af14a454be26187d9df565c7f69266a"
+checksum = "05efc5cfd9110c8416e471df0e96702d58690178e206e61b7173706673c93706"
 dependencies = [
  "memchr",
  "regex-automata",
@@ -260,21 +260,21 @@ dependencies = [
 
 [[package]]
 name = "bumpalo"
-version = "3.14.0"
+version = "3.15.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f30e7476521f6f8af1a1c4c0b8cc94f0bee37d91763d0ca2665f299b6cd8aec"
+checksum = "8ea184aa71bb362a1157c896979544cc23974e08fd265f29ea96b59f0b4a555b"
 
 [[package]]
 name = "bytecount"
-version = "0.6.3"
+version = "0.6.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c676a478f63e9fa2dd5368a42f28bba0d6c560b775f38583c8bbaa7fcd67c9c"
+checksum = "e1e5f035d16fc623ae5f74981db80a439803888314e3a555fd6f04acd51a3205"
 
 [[package]]
 name = "byteorder"
-version = "1.4.3"
+version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "14c189c53d098945499cdfa7ecc63567cf3886b3332b312a5b4585d8d3a6a610"
+checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
 
 [[package]]
 name = "bytes"
@@ -293,9 +293,9 @@ dependencies = [
 
 [[package]]
 name = "cargo-platform"
-version = "0.1.3"
+version = "0.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2cfa25e60aea747ec7e1124f238816749faa93759c6ff5b31f1ccdda137f4479"
+checksum = "694c8807f2ae16faecc43dc17d74b3eb042482789fd0eb64b39a2e04e087053f"
 dependencies = [
  "serde",
 ]
@@ -308,19 +308,16 @@ checksum = "4acbb09d9ee8e23699b9634375c72795d095bf268439da88562cf9b501f181fa"
 dependencies = [
  "camino",
  "cargo-platform",
- "semver 1.0.19",
+ "semver 1.0.22",
  "serde",
  "serde_json",
 ]
 
 [[package]]
 name = "cc"
-version = "1.0.83"
+version = "1.0.88"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1174fb0b6ec23863f8b971027804a42614e347eafb0a95bf0b12cdae21fc4d0"
-dependencies = [
- "libc",
-]
+checksum = "02f341c093d19155a6e41631ce5971aac4e9a868262212153124c15fa22d1cdc"
 
 [[package]]
 name = "cfg-if"
@@ -330,9 +327,9 @@ checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
 
 [[package]]
 name = "chrono"
-version = "0.4.31"
+version = "0.4.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f2c685bad3eb3d45a01354cedb7d5faa66194d1d58ba6e267a8de788f79db38"
+checksum = "5bc015644b92d5890fab7489e49d21f879d5c990186827d42ec511919404f38b"
 dependencies = [
  "android-tzdata",
  "iana-time-zone",
@@ -340,14 +337,14 @@ dependencies = [
  "num-traits",
  "serde",
  "wasm-bindgen",
- "windows-targets 0.48.5",
+ "windows-targets 0.52.3",
 ]
 
 [[package]]
 name = "chrono-tz"
-version = "0.8.3"
+version = "0.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1369bc6b9e9a7dfdae2055f6ec151fe9c554a9d23d357c0237cee2e25eaabb7"
+checksum = "d59ae0466b83e838b81a54256c39d5d7c20b9d7daa10510a242d9b75abd5936e"
 dependencies = [
  "chrono",
  "chrono-tz-build",
@@ -356,9 +353,9 @@ dependencies = [
 
 [[package]]
 name = "chrono-tz-build"
-version = "0.2.0"
+version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2f5ebdc942f57ed96d560a6d1a459bae5851102a25d5bf89dc04ae453e31ecf"
+checksum = "433e39f13c9a060046954e0592a8d0a4bcb1040125cbf91cb8ee58964cfb350f"
 dependencies = [
  "parse-zoneinfo",
  "phf",
@@ -375,16 +372,16 @@ dependencies = [
  "bitflags 1.3.2",
  "clap_lex 0.2.4",
  "indexmap 1.9.3",
- "strsim",
+ "strsim 0.10.0",
  "termcolor",
  "textwrap",
 ]
 
 [[package]]
 name = "clap"
-version = "4.4.5"
+version = "4.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "824956d0dca8334758a5b7f7e50518d66ea319330cbceedcf76905c2f6ab30e3"
+checksum = "c918d541ef2913577a0f9566e9ce27cb35b6df072075769e0b26cb5a554520da"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -396,51 +393,51 @@ version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "325f50228f76921784b6d9f2d62de6778d834483248eefecd27279174797e579"
 dependencies = [
- "clap 4.4.5",
+ "clap 4.5.1",
 ]
 
 [[package]]
 name = "clap-verbosity-flag"
-version = "2.0.1"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1eef05769009513df2eb1c3b4613e7fad873a14c600ff025b08f250f59fee7de"
+checksum = "bb9b20c0dd58e4c2e991c8d203bbeb76c11304d1011659686b5b644bc29aa478"
 dependencies = [
- "clap 4.4.5",
+ "clap 4.5.1",
  "log",
 ]
 
 [[package]]
 name = "clap_builder"
-version = "4.4.5"
+version = "4.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "122ec64120a49b4563ccaedcbea7818d069ed8e9aa6d829b82d8a4128936b2ab"
+checksum = "9f3e7391dad68afb0c2ede1bf619f579a3dc9c2ec67f089baa397123a2f3d1eb"
 dependencies = [
  "anstream",
  "anstyle",
- "clap_lex 0.5.1",
- "strsim",
+ "clap_lex 0.7.0",
+ "strsim 0.11.0",
  "terminal_size",
 ]
 
 [[package]]
 name = "clap_complete"
-version = "4.4.2"
+version = "4.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8baeccdb91cd69189985f87f3c7e453a3a451ab5746cf3be6acc92120bd16d24"
+checksum = "885e4d7d5af40bfb99ae6f9433e292feac98d452dcb3ec3d25dfe7552b77da8c"
 dependencies = [
- "clap 4.4.5",
+ "clap 4.5.1",
 ]
 
 [[package]]
 name = "clap_derive"
-version = "4.4.2"
+version = "4.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0862016ff20d69b84ef8247369fabf5c008a7417002411897d40ee1f4532b873"
+checksum = "307bc0538d5f0f83b8248db3087aa92fe504e4691294d0c96c0eabc33f47ba47"
 dependencies = [
  "heck",
  "proc-macro2",
  "quote",
- "syn 2.0.37",
+ "syn 2.0.51",
 ]
 
 [[package]]
@@ -454,18 +451,18 @@ dependencies = [
 
 [[package]]
 name = "clap_lex"
-version = "0.5.1"
+version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cd7cc57abe963c6d3b9d8be5b06ba7c8957a930305ca90304f24ef040aa6f961"
+checksum = "98cc8fbded0c607b7ba9dd60cd98df59af97e84d24e49c8557331cfc26d301ce"
 
 [[package]]
 name = "clio"
-version = "0.3.4"
+version = "0.3.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "746ce4269bee03af43b3349f37f420cf5957f8431c531c08dea0441b298b10e0"
+checksum = "b7fc6734af48458f72f5a3fa7b840903606427d98a710256e808f76a965047d9"
 dependencies = [
  "cfg-if",
- "clap 4.4.5",
+ "clap 4.5.1",
  "is-terminal",
  "libc",
  "tempfile",
@@ -481,11 +478,10 @@ checksum = "acbf1af155f9b9ef647e42cdc158db4b64a1b61f743629225fde6f3e0be2a7c7"
 
 [[package]]
 name = "colored"
-version = "2.0.4"
+version = "2.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2674ec482fbc38012cf31e6c42ba0177b431a0cb6f15fe40efa5aab1bda516f6"
+checksum = "cbf2150cce219b664a8a70df7a1f933836724b503f8a413af9365b4dcc4d90b8"
 dependencies = [
- "is-terminal",
  "lazy_static",
  "windows-sys 0.48.0",
 ]
@@ -499,27 +495,27 @@ dependencies = [
  "is-terminal",
  "serde",
  "serde_json",
- "yansi",
+ "yansi 0.5.1",
 ]
 
 [[package]]
 name = "console"
-version = "0.15.7"
+version = "0.15.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c926e00cc70edefdc64d3a5ff31cc65bb97a3460097762bd23afb4d8145fccf8"
+checksum = "0e1f83fc076bd6dd27517eacdf25fef6c4dfe5f1d7448bafaaf3a26f13b5e4eb"
 dependencies = [
  "encode_unicode",
  "lazy_static",
  "libc",
  "unicode-width",
- "windows-sys 0.45.0",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
 name = "core-foundation"
-version = "0.9.3"
+version = "0.9.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "194a7a9e6de53fa55116934067c844d9d749312f75c6f6d0980e8c252f8c2146"
+checksum = "91e195e091a93c46f7102ec7818a2aa394e1e1771c3ab4825963fa03e45afb8f"
 dependencies = [
  "core-foundation-sys",
  "libc",
@@ -527,60 +523,52 @@ dependencies = [
 
 [[package]]
 name = "core-foundation-sys"
-version = "0.8.4"
+version = "0.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e496a50fda8aacccc86d7529e2c1e0892dbd0f898a6b5645b5561b89c3210efa"
+checksum = "06ea2b9bc92be3c2baa9334a323ebca2d6f074ff852cd1d7b11064035cd3868f"
 
 [[package]]
 name = "cpufeatures"
-version = "0.2.9"
+version = "0.2.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a17b76ff3a4162b0b27f354a0c87015ddad39d35f9c0c36607a3bdd175dde1f1"
+checksum = "53fe5e26ff1b7aef8bca9c6080520cfb8d9333c7568e1829cef191a9723e5504"
 dependencies = [
  "libc",
 ]
 
 [[package]]
 name = "crc32fast"
-version = "1.3.2"
+version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b540bd8bc810d3885c6ea91e2018302f68baba2129ab3e88f32389ee9370880d"
+checksum = "b3855a8a784b474f333699ef2bbca9db2c4a1f6d9088a90a2d25b1eb53111eaa"
 dependencies = [
  "cfg-if",
 ]
 
 [[package]]
 name = "crossbeam-deque"
-version = "0.8.3"
+version = "0.8.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce6fd6f855243022dcecf8702fef0c297d4338e226845fe067f6341ad9fa0cef"
+checksum = "613f8cc01fe9cf1a3eb3d7f488fd2fa8388403e97039e2f73692932e291a770d"
 dependencies = [
- "cfg-if",
  "crossbeam-epoch",
  "crossbeam-utils",
 ]
 
 [[package]]
 name = "crossbeam-epoch"
-version = "0.9.15"
+version = "0.9.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ae211234986c545741a7dc064309f67ee1e5ad243d0e48335adc0484d960bcc7"
+checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e"
 dependencies = [
- "autocfg",
- "cfg-if",
  "crossbeam-utils",
- "memoffset",
- "scopeguard",
 ]
 
 [[package]]
 name = "crossbeam-utils"
-version = "0.8.16"
+version = "0.8.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a22b2d63d4d1dc0b7f1b6b2747dd0088008a9be28b6ddf0b1e7d335e3037294"
-dependencies = [
- "cfg-if",
-]
+checksum = "248e3bacc7dc6baa3b21e405ee045c3047101a49145e7e9eca583ab4c2ca5345"
 
 [[package]]
 name = "crypto-common"
@@ -594,9 +582,9 @@ dependencies = [
 
 [[package]]
 name = "csv"
-version = "1.2.2"
+version = "1.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "626ae34994d3d8d668f4269922248239db4ae42d538b14c398b74a52208e8086"
+checksum = "ac574ff4d437a7b5ad237ef331c17ccca63c46479e5b5453eb8e10bb99a759fe"
 dependencies = [
  "csv-core",
  "itoa",
@@ -606,9 +594,9 @@ dependencies = [
 
 [[package]]
 name = "csv-core"
-version = "0.1.10"
+version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b2466559f260f48ad25fe6317b3c8dac77b5bdb5763ac7d9d6103530663bc90"
+checksum = "5efa2b3d7902f4b634a20cae3c9c4e6209dc4779feb6863329607560143efa70"
 dependencies = [
  "memchr",
 ]
@@ -625,12 +613,12 @@ dependencies = [
 
 [[package]]
 name = "darling"
-version = "0.20.3"
+version = "0.20.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0209d94da627ab5605dcccf08bb18afa5009cfbef48d8a8b7d7bdbc79be25c5e"
+checksum = "54e36fcd13ed84ffdfda6f5be89b31287cbb80c439841fe69e04841435464391"
 dependencies = [
- "darling_core 0.20.3",
- "darling_macro 0.20.3",
+ "darling_core 0.20.8",
+ "darling_macro 0.20.8",
 ]
 
 [[package]]
@@ -643,22 +631,22 @@ dependencies = [
  "ident_case",
  "proc-macro2",
  "quote",
- "strsim",
+ "strsim 0.10.0",
  "syn 1.0.109",
 ]
 
 [[package]]
 name = "darling_core"
-version = "0.20.3"
+version = "0.20.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "177e3443818124b357d8e76f53be906d60937f0d3a90773a664fa63fa253e621"
+checksum = "9c2cf1c23a687a1feeb728783b993c4e1ad83d99f351801977dd809b48d0a70f"
 dependencies = [
  "fnv",
  "ident_case",
  "proc-macro2",
  "quote",
- "strsim",
- "syn 2.0.37",
+ "strsim 0.10.0",
+ "syn 2.0.51",
 ]
 
 [[package]]
@@ -674,20 +662,23 @@ dependencies = [
 
 [[package]]
 name = "darling_macro"
-version = "0.20.3"
+version = "0.20.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "836a9bbc7ad63342d6d6e7b815ccab164bc77a2d95d84bc3117a8c0d5c98e2d5"
+checksum = "a668eda54683121533a393014d8692171709ff57a7d61f187b6e782719f8933f"
 dependencies = [
- "darling_core 0.20.3",
+ "darling_core 0.20.8",
  "quote",
- "syn 2.0.37",
+ "syn 2.0.51",
 ]
 
 [[package]]
 name = "deranged"
-version = "0.3.8"
+version = "0.3.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2696e8a945f658fd14dc3b87242e6b80cd0f36ff04ea560fa39082368847946"
+checksum = "b42b6fa04a440b495c8b04d0e71b707c585f83cb9cb28cf8cd0d976c315e31b4"
+dependencies = [
+ "powerfmt",
+]
 
 [[package]]
 name = "derive-getters"
@@ -707,12 +698,12 @@ dependencies = [
  "anyhow",
  "assert-json-diff",
  "assert_cmd",
- "base64 0.21.4",
+ "base64 0.21.7",
  "binread",
- "bitflags 2.4.0",
+ "bitflags 2.4.2",
  "chrono",
  "chrono-tz",
- "clap 4.4.5",
+ "clap 4.5.1",
  "clap-markdown",
  "clap-verbosity-flag",
  "clap_complete",
@@ -742,7 +733,7 @@ dependencies = [
  "more-asserts",
  "nt_hive2",
  "num",
- "num-derive 0.4.0",
+ "num-derive 0.4.2",
  "num-traits",
  "ouroboros",
  "phf",
@@ -770,7 +761,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "efc96511560e4661da0ada6debede9ed1dc63d8ac2ad8cefc00434e351a8b509"
 dependencies = [
  "anyhow",
- "darling 0.20.3",
+ "darling 0.20.8",
  "evtx",
  "log",
  "quote",
@@ -784,11 +775,11 @@ version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "37be4820fae21cbed1f691dffcb02969b673bfeef4bd3fdee8cb175d1ca27023"
 dependencies = [
- "darling 0.20.3",
+ "darling 0.20.8",
  "dfirtk-eventdata",
  "proc-macro2",
  "quote",
- "syn 2.0.37",
+ "syn 2.0.51",
 ]
 
 [[package]]
@@ -837,15 +828,15 @@ dependencies = [
 
 [[package]]
 name = "dyn-clone"
-version = "1.0.14"
+version = "1.0.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23d2f3407d9a573d666de4b5bdf10569d73ca9478087346697dcbae6244bfbcd"
+checksum = "0d6ef0072f8a535281e4876be788938b528e9a1d43900b82c2569af7da799125"
 
 [[package]]
 name = "either"
-version = "1.9.0"
+version = "1.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a26ae43d7bcc3b814de94796a5e736d4029efb0ee900c12e2d54c993ad1a1e07"
+checksum = "11157ac094ffbdde99aa67b23417ebdd801842852b500e395a45a9c0aac03e4a"
 
 [[package]]
 name = "elasticsearch"
@@ -963,23 +954,12 @@ checksum = "5443807d6dff69373d433ab9ef5378ad8df50ca6298caf15de6e52e24aaf54d5"
 
 [[package]]
 name = "errno"
-version = "0.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "136526188508e25c6fef639d7927dfb3e0e3084488bf202267829cf7fc23dbdd"
-dependencies = [
- "errno-dragonfly",
- "libc",
- "windows-sys 0.48.0",
-]
-
-[[package]]
-name = "errno-dragonfly"
-version = "0.1.2"
+version = "0.3.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aa68f1b12764fab894d2755d2518754e71b4fd80ecfb822714a1206c2aab39bf"
+checksum = "a258e46cdc063eb8519c00b9fc845fc47bcfca4130e2f08e88665ceda8474245"
 dependencies = [
- "cc",
  "libc",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -1025,9 +1005,9 @@ checksum = "25cbce373ec4653f1a01a31e8a5e5ec0c622dc27ff9c4e6606eefef5cbbed4a5"
 
 [[package]]
 name = "flate2"
-version = "1.0.27"
+version = "1.0.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c6c98ee8095e9d1dcbf2fcc6d95acccb90d1c81db1e44725c6a984b1dbdfb010"
+checksum = "46303f565772937ffe1d394a4fac6f411c6013172fadde9dcdb1e147a086940e"
 dependencies = [
  "crc32fast",
  "miniz_oxide",
@@ -1075,18 +1055,18 @@ dependencies = [
 
 [[package]]
 name = "form_urlencoded"
-version = "1.2.0"
+version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a62bc1cf6f830c2ec14a513a9fb124d0a213a629668a4186f329db21fe045652"
+checksum = "e13624c2627564efccf4934284bdd98cbaa14e79b0b5a141218e507b3a823456"
 dependencies = [
  "percent-encoding",
 ]
 
 [[package]]
 name = "frnsc-prefetch"
-version = "0.9.0"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2ed2131c091273267486b2dabcc96c2bb6d7374d27f7827c37d98de86daa2a2f"
+checksum = "c8cc48c4295142e32b6b94988a69701557a9810a90a743a8b01a8899746d7ed9"
 dependencies = [
  "crc32fast",
  "forensic-rs 0.9.1",
@@ -1094,9 +1074,9 @@ dependencies = [
 
 [[package]]
 name = "futures"
-version = "0.3.28"
+version = "0.3.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23342abe12aba583913b2e62f22225ff9c950774065e4bfb61a19cd9770fec40"
+checksum = "645c6916888f6cb6350d2550b80fb63e734897a8498abe35cfb732b6487804b0"
 dependencies = [
  "futures-channel",
  "futures-core",
@@ -1109,9 +1089,9 @@ dependencies = [
 
 [[package]]
 name = "futures-channel"
-version = "0.3.28"
+version = "0.3.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "955518d47e09b25bbebc7a18df10b81f0c766eaf4c4f1cccef2fca5f2a4fb5f2"
+checksum = "eac8f7d7865dcb88bd4373ab671c8cf4508703796caa2b1985a9ca867b3fcb78"
 dependencies = [
  "futures-core",
  "futures-sink",
@@ -1119,15 +1099,15 @@ dependencies = [
 
 [[package]]
 name = "futures-core"
-version = "0.3.28"
+version = "0.3.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4bca583b7e26f571124fe5b7561d49cb2868d79116cfa0eefce955557c6fee8c"
+checksum = "dfc6580bb841c5a68e9ef15c77ccc837b40a7504914d52e47b8b0e9bbda25a1d"
 
 [[package]]
 name = "futures-executor"
-version = "0.3.28"
+version = "0.3.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ccecee823288125bd88b4d7f565c9e58e41858e47ab72e8ea2d64e93624386e0"
+checksum = "a576fc72ae164fca6b9db127eaa9a9dda0d61316034f33a0a0d4eda41f02b01d"
 dependencies = [
  "futures-core",
  "futures-task",
@@ -1136,38 +1116,38 @@ dependencies = [
 
 [[package]]
 name = "futures-io"
-version = "0.3.28"
+version = "0.3.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4fff74096e71ed47f8e023204cfd0aa1289cd54ae5430a9523be060cdb849964"
+checksum = "a44623e20b9681a318efdd71c299b6b222ed6f231972bfe2f224ebad6311f0c1"
 
 [[package]]
 name = "futures-macro"
-version = "0.3.28"
+version = "0.3.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "89ca545a94061b6365f2c7355b4b32bd20df3ff95f02da9329b34ccc3bd6ee72"
+checksum = "87750cf4b7a4c0625b1529e4c543c2182106e4dedc60a2a6455e00d212c489ac"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.37",
+ "syn 2.0.51",
 ]
 
 [[package]]
 name = "futures-sink"
-version = "0.3.28"
+version = "0.3.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f43be4fe21a13b9781a69afa4985b0f6ee0e1afab2c6f454a8cf30e2b2237b6e"
+checksum = "9fb8e00e87438d937621c1c6269e53f536c14d3fbd6a042bb24879e57d474fb5"
 
 [[package]]
 name = "futures-task"
-version = "0.3.28"
+version = "0.3.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "76d3d132be6c0e6aa1534069c705a74a5997a356c0dc2f86a47765e5617c5b65"
+checksum = "38d84fa142264698cdce1a9f9172cf383a0c82de1bddcf3092901442c4097004"
 
 [[package]]
 name = "futures-util"
-version = "0.3.28"
+version = "0.3.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26b01e40b772d54cf6c6d721c1d1abd0647a0106a12ecaa1c186273392a69533"
+checksum = "3d6401deb83407ab3da39eba7e33987a73c3df0c82b4bb5813ee871c19c41d48"
 dependencies = [
  "futures-channel",
  "futures-core",
@@ -1193,9 +1173,9 @@ dependencies = [
 
 [[package]]
 name = "getrandom"
-version = "0.2.10"
+version = "0.2.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "be4136b2a15dd319360be1c07d9933517ccf0be8f16bf62a3bee4f0d618df427"
+checksum = "190092ea657667030ac6a35e305e62fc4dd69fd98ac98631e5d3a2b1575a12b5"
 dependencies = [
  "cfg-if",
  "libc",
@@ -1216,9 +1196,9 @@ dependencies = [
 
 [[package]]
 name = "gimli"
-version = "0.28.0"
+version = "0.28.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6fb8d784f27acf97159b40fc4db5ecd8aa23b9ad5ef69cdd136d3bc80665f0c0"
+checksum = "4271d37baee1b8c7e4b708028c57d816cf9d2434acb33a549475f78c181f6253"
 
 [[package]]
 name = "glob"
@@ -1238,7 +1218,7 @@ dependencies = [
  "futures-sink",
  "futures-util",
  "http",
- "indexmap 2.1.0",
+ "indexmap 2.2.3",
  "slab",
  "tokio",
  "tokio-util",
@@ -1274,15 +1254,15 @@ dependencies = [
 
 [[package]]
 name = "hermit-abi"
-version = "0.3.3"
+version = "0.3.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d77f7ec81a6d05a3abb01ab6eb7590f6083d08449fe5a1c8b1e620283546ccb7"
+checksum = "379dada1584ad501b383485dd706b8afb7a70fcbc7f4da7d780638a5a6124a60"
 
 [[package]]
 name = "http"
-version = "0.2.9"
+version = "0.2.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bd6effc99afb63425aff9b05836f029929e345a6148a14b7ecd5ab67af944482"
+checksum = "8947b1a6fad4393052c7ba1f4cd97bed3e953a95c79c92ad9b051a04611d9fbb"
 dependencies = [
  "bytes",
  "fnv",
@@ -1291,9 +1271,9 @@ dependencies = [
 
 [[package]]
 name = "http-body"
-version = "0.4.5"
+version = "0.4.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d5f38f16d184e36f2408a55281cd658ecbd3ca05cce6d6510a176eca393e26d1"
+checksum = "7ceab25649e9960c0311ea418d17bee82c0dcec1bd053b5f9a66e265a693bed2"
 dependencies = [
  "bytes",
  "http",
@@ -1314,9 +1294,9 @@ checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
 
 [[package]]
 name = "hyper"
-version = "0.14.27"
+version = "0.14.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ffb1cfd654a8219eaef89881fdb3bb3b1cdc5fa75ded05d6933b2b382e395468"
+checksum = "bf96e135eb83a2a8ddf766e426a841d8ddd7449d5f00d34ea02b41d2f19eef80"
 dependencies = [
  "bytes",
  "futures-channel",
@@ -1329,7 +1309,7 @@ dependencies = [
  "httpdate",
  "itoa",
  "pin-project-lite",
- "socket2 0.4.9",
+ "socket2",
  "tokio",
  "tower-service",
  "tracing",
@@ -1351,16 +1331,16 @@ dependencies = [
 
 [[package]]
 name = "iana-time-zone"
-version = "0.1.57"
+version = "0.1.60"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2fad5b825842d2b38bd206f3e81d6957625fd7f0a361e345c30e01a0ae2dd613"
+checksum = "e7ffbb5a1b541ea2561f8c41c087286cc091e21e556a4f09a8f6cbf17b69b141"
 dependencies = [
  "android_system_properties",
  "core-foundation-sys",
  "iana-time-zone-haiku",
  "js-sys",
  "wasm-bindgen",
- "windows",
+ "windows-core",
 ]
 
 [[package]]
@@ -1380,9 +1360,9 @@ checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39"
 
 [[package]]
 name = "idna"
-version = "0.4.0"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d20d6b07bfbc108882d88ed8e37d39636dcc260e15e30c45e6ba089610b917c"
+checksum = "634d9b1461af396cad843f47fdba5597a4f9e6ddd4bfb6ff5d85028c25cb12f6"
 dependencies = [
  "unicode-bidi",
  "unicode-normalization",
@@ -1400,9 +1380,9 @@ dependencies = [
 
 [[package]]
 name = "indexmap"
-version = "2.1.0"
+version = "2.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d530e1a18b1cb4c484e6e34556a0d948706958449fca0cab753d649f2bce3d1f"
+checksum = "233cf39063f058ea2caae4091bf4a3ef70a653afbc026f5c4a4135d114e3c177"
 dependencies = [
  "equivalent",
  "hashbrown 0.14.3",
@@ -1410,9 +1390,9 @@ dependencies = [
 
 [[package]]
 name = "indicatif"
-version = "0.17.7"
+version = "0.17.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fb28741c9db9a713d93deb3bb9515c20788cef5815265bee4980e87bde7e0f25"
+checksum = "763a5a8f45087d6bcea4222e7b72c291a054edf80e4ef6efd2a4979878c7bea3"
 dependencies = [
  "console",
  "instant",
@@ -1438,41 +1418,41 @@ dependencies = [
 
 [[package]]
 name = "ipnet"
-version = "2.8.0"
+version = "2.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "28b29a3cd74f0f4598934efe3aeba42bae0eb4680554128851ebbecb02af14e6"
+checksum = "8f518f335dce6725a761382244631d86cf0ccb2863413590b31338feb467f9c3"
 
 [[package]]
 name = "is-terminal"
-version = "0.4.9"
+version = "0.4.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb0889898416213fab133e1d33a0e5858a48177452750691bde3666d0fdbaf8b"
+checksum = "f23ff5ef2b80d608d61efee834934d862cd92461afc0560dedf493e4c033738b"
 dependencies = [
- "hermit-abi 0.3.3",
- "rustix",
- "windows-sys 0.48.0",
+ "hermit-abi 0.3.8",
+ "libc",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
 name = "itertools"
-version = "0.11.0"
+version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b1c173a5686ce8bfa551b3563d0c2170bf24ca44da99c7ca4bfdab5418c3fe57"
+checksum = "ba291022dbbd398a455acf126c1e341954079855bc60dfdda641363bd6922569"
 dependencies = [
  "either",
 ]
 
 [[package]]
 name = "itoa"
-version = "1.0.9"
+version = "1.0.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "af150ab688ff2122fcef229be89cb50dd66af9e01a4ff320cc137eecc9bacc38"
+checksum = "b1a46d1a171d865aa5f83f92695765caa047a9b4cbae2cbf37dbd613a793fd4c"
 
 [[package]]
 name = "js-sys"
-version = "0.3.64"
+version = "0.3.68"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c5f195fe497f702db0f318b07fdd68edb16955aed830df8363d837542f8f935a"
+checksum = "406cda4b368d531c842222cf9d2600a9a4acce8d29423695379c6868a143a9ee"
 dependencies = [
  "wasm-bindgen",
 ]
@@ -1489,9 +1469,9 @@ dependencies = [
 
 [[package]]
 name = "lazy-regex"
-version = "3.0.2"
+version = "3.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e723bd417b2df60a0f6a2b6825f297ea04b245d4ba52b5a22cb679bdf58b05fa"
+checksum = "5d12be4595afdf58bd19e4a9f4e24187da2a66700786ff660a418e9059937a4c"
 dependencies = [
  "lazy-regex-proc_macros",
  "once_cell",
@@ -1500,14 +1480,14 @@ dependencies = [
 
 [[package]]
 name = "lazy-regex-proc_macros"
-version = "3.0.1"
+version = "3.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0f0a1d9139f0ee2e862e08a9c5d0ba0470f2aa21cd1e1aa1b1562f83116c725f"
+checksum = "44bcd58e6c97a7fcbaffcdc95728b393b8d98933bfadad49ed4097845b57ef0b"
 dependencies = [
  "proc-macro2",
  "quote",
  "regex",
- "syn 2.0.37",
+ "syn 2.0.51",
 ]
 
 [[package]]
@@ -1518,15 +1498,15 @@ checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
 
 [[package]]
 name = "libc"
-version = "0.2.148"
+version = "0.2.153"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9cdc71e17332e86d2e1d38c1f99edcb6288ee11b815fb1a4b049eaa2114d369b"
+checksum = "9c198f91728a82281a64e1f4f9eeb25d82cb32a5de251c6bd1b5154d63a8e7bd"
 
 [[package]]
 name = "linux-raw-sys"
-version = "0.4.10"
+version = "0.4.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da2479e8c062e40bf0066ffa0bc823de0a9368974af99c9f6df941d2c231e03f"
+checksum = "01cda141df6706de531b6c46c3a33ecca755538219bd484262fa09410c13539c"
 
 [[package]]
 name = "lnk"
@@ -1544,9 +1524,9 @@ dependencies = [
 
 [[package]]
 name = "lock_api"
-version = "0.4.10"
+version = "0.4.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c1cc9717a20b1bb222f333e6a92fd32f7d8a18ddc5a3191a11af45dcbf4dcd16"
+checksum = "3c168f8615b12bc01f9c17e2eb0cc07dcae1940121185446edc3744920e8ef45"
 dependencies = [
  "autocfg",
  "scopeguard",
@@ -1575,18 +1555,9 @@ checksum = "2532096657941c2fea9c289d370a250971c689d4f143798ff67113ec042024a5"
 
 [[package]]
 name = "memchr"
-version = "2.6.3"
+version = "2.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f232d6ef707e1956a43342693d2a31e72989554d58299d7a88738cc95b0d35c"
-
-[[package]]
-name = "memoffset"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a634b1c61a95585bd15607c6ab0c4e5b226e695ff2800ba0cdccddf208c406c"
-dependencies = [
- "autocfg",
-]
+checksum = "523dc4f511e55ab87b694dc30d0f820d60906ef06413f93d4d7a1385599cc149"
 
 [[package]]
 name = "memoverlay"
@@ -1605,18 +1576,18 @@ checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
 
 [[package]]
 name = "miniz_oxide"
-version = "0.7.1"
+version = "0.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e7810e0be55b428ada41041c41f32c9f1a42817901b4ccf45fa3d4b6561e74c7"
+checksum = "9d811f3e15f28568be3407c8e7fdb6514c1cda3cb30683f15b6a1a1dc4ea14a7"
 dependencies = [
  "adler",
 ]
 
 [[package]]
 name = "mio"
-version = "0.8.8"
+version = "0.8.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "927a765cd3fc26206e66b296465fa9d3e5ab003e651c1b3c060e7956d96b19d2"
+checksum = "8f3d0b296e374a4e6f3c7b0a1f5a51d748a0d34c85e7dc48fc3fa9a87657fe09"
 dependencies = [
  "libc",
  "wasi",
@@ -1664,7 +1635,7 @@ dependencies = [
  "log",
  "marvin32",
  "memoverlay",
- "num-derive 0.4.0",
+ "num-derive 0.4.2",
  "num-traits",
  "thiserror",
  "winstructs",
@@ -1697,13 +1668,19 @@ dependencies = [
 
 [[package]]
 name = "num-complex"
-version = "0.4.4"
+version = "0.4.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ba157ca0885411de85d6ca030ba7e2a83a28636056c7c699b07c8b6f7383214"
+checksum = "23c6602fda94a57c990fe0df199a035d83576b496aa29f4e634a8ac6004e68a6"
 dependencies = [
  "num-traits",
 ]
 
+[[package]]
+name = "num-conv"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9"
+
 [[package]]
 name = "num-derive"
 version = "0.3.3"
@@ -1717,30 +1694,29 @@ dependencies = [
 
 [[package]]
 name = "num-derive"
-version = "0.4.0"
+version = "0.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9e6a0fd4f737c707bd9086cc16c925f294943eb62eb71499e9fd4cf71f8b9f4e"
+checksum = "ed3955f1a9c7c0c15e092f9c887db08b1fc683305fdf6eb6684f22555355e202"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.37",
+ "syn 2.0.51",
 ]
 
 [[package]]
 name = "num-integer"
-version = "0.1.45"
+version = "0.1.46"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "225d3389fb3509a24c93f5c29eb6bde2586b98d9f016636dff58d7c6f7569cd9"
+checksum = "7969661fd2958a5cb096e56c8e1ad0444ac2bbcd0061bd28660485a44879858f"
 dependencies = [
- "autocfg",
  "num-traits",
 ]
 
 [[package]]
 name = "num-iter"
-version = "0.1.43"
+version = "0.1.44"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d03e6c028c5dc5cac6e2dec0efda81fc887605bb3d884578bb6d6bf7514e252"
+checksum = "d869c01cc0c455284163fd0092f1f93835385ccab5a98a0dcc497b2f8bf055a9"
 dependencies = [
  "autocfg",
  "num-integer",
@@ -1761,9 +1737,9 @@ dependencies = [
 
 [[package]]
 name = "num-traits"
-version = "0.2.16"
+version = "0.2.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f30b0abd723be7e2ffca1272140fac1a2f084c77ec3e123c192b66af1ee9e6c2"
+checksum = "da0df0e5185db44f69b44f26786fe401b6c293d1907744beaa7fa62b2e5a517a"
 dependencies = [
  "autocfg",
 ]
@@ -1774,15 +1750,15 @@ version = "1.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4161fcb6d602d4d2081af7c3a45852d875a03dd337a6bfdd6e06407b61342a43"
 dependencies = [
- "hermit-abi 0.3.3",
+ "hermit-abi 0.3.8",
  "libc",
 ]
 
 [[package]]
 name = "num_threads"
-version = "0.1.6"
+version = "0.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2819ce041d2ee131036f4fc9d6ae7ae125a3a40e97ba64d04fe799ad9dabbb44"
+checksum = "5c7398b9c8b70908f6371f47ed36737907c87c52af34c268fed0bf0ceb92ead9"
 dependencies = [
  "libc",
 ]
@@ -1801,26 +1777,26 @@ checksum = "b8f8bdf33df195859076e54ab11ee78a1b208382d3a26ec40d142ffc1ecc49ef"
 
 [[package]]
 name = "object"
-version = "0.32.1"
+version = "0.32.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9cf5f9dd3933bd50a9e1f149ec995f39ae2c496d31fd772c1fd45ebc27e902b0"
+checksum = "a6a622008b6e321afc04970976f62ee297fdbaa6f95318ca343e3eebb9648441"
 dependencies = [
  "memchr",
 ]
 
 [[package]]
 name = "once_cell"
-version = "1.18.0"
+version = "1.19.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd8b5dd2ae5ed71462c540258bedcb51965123ad7e7ccf4b9a8cafaa4a63576d"
+checksum = "3fdb12b2476b595f9358c5161aa467c2438859caa136dec86c26fdd2efe17b92"
 
 [[package]]
 name = "openssl"
-version = "0.10.57"
+version = "0.10.64"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bac25ee399abb46215765b1cb35bc0212377e58a061560d8b29b024fd0430e7c"
+checksum = "95a0481286a310808298130d22dd1fef0fa571e05a8f44ec801801e84b216b1f"
 dependencies = [
- "bitflags 2.4.0",
+ "bitflags 2.4.2",
  "cfg-if",
  "foreign-types",
  "libc",
@@ -1837,7 +1813,7 @@ checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.37",
+ "syn 2.0.51",
 ]
 
 [[package]]
@@ -1848,9 +1824,9 @@ checksum = "ff011a302c396a5197692431fc1948019154afc178baf7d8e37367442a4601cf"
 
 [[package]]
 name = "openssl-sys"
-version = "0.9.93"
+version = "0.9.101"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "db4d56a4c0478783083cfafcc42493dd4a981d41669da64b4572a2a089b51b1d"
+checksum = "dda2b0f344e78efc2facf7d195d098df0dd72151b26ab98da807afc26c198dff"
 dependencies = [
  "cc",
  "libc",
@@ -1860,15 +1836,15 @@ dependencies = [
 
 [[package]]
 name = "os_str_bytes"
-version = "6.5.1"
+version = "6.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4d5d9eb14b174ee9aa2ef96dc2b94637a2d4b6e7cb873c7e171f0c20c6cf3eac"
+checksum = "e2355d85b9a3786f481747ced0e0ff2ba35213a1f9bd406ed906554d7af805a1"
 
 [[package]]
 name = "ouroboros"
-version = "0.18.0"
+version = "0.18.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1c86de06555b970aec45229b27291b53154f21a5743a163419f4e4c0b065dcde"
+checksum = "97b7be5a8a3462b752f4be3ff2b2bf2f7f1d00834902e46be2a4d68b87b0573c"
 dependencies = [
  "aliasable",
  "ouroboros_macro",
@@ -1877,16 +1853,16 @@ dependencies = [
 
 [[package]]
 name = "ouroboros_macro"
-version = "0.18.0"
+version = "0.18.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8cad0c4b129e9696e37cb712b243777b90ef489a0bfaa0ac34e7d9b860e4f134"
+checksum = "b645dcde5f119c2c454a92d0dfa271a2a3b205da92e4292a68ead4bdbfde1f33"
 dependencies = [
  "heck",
  "itertools",
- "proc-macro-error",
  "proc-macro2",
+ "proc-macro2-diagnostics",
  "quote",
- "syn 2.0.37",
+ "syn 2.0.51",
 ]
 
 [[package]]
@@ -1901,13 +1877,13 @@ dependencies = [
 
 [[package]]
 name = "parking_lot_core"
-version = "0.9.8"
+version = "0.9.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "93f00c865fe7cabf650081affecd3871070f26767e7b2070a3ffae14c654b447"
+checksum = "4c42a9226546d68acdd9c0a280d17ce19bfe27a46bf68784e4066115788d008e"
 dependencies = [
  "cfg-if",
  "libc",
- "redox_syscall 0.3.5",
+ "redox_syscall 0.4.1",
  "smallvec",
  "windows-targets 0.48.5",
 ]
@@ -1942,9 +1918,9 @@ dependencies = [
 
 [[package]]
 name = "percent-encoding"
-version = "2.3.0"
+version = "2.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b2a4787296e9989611394c33f193f676704af1686e70b8f8033ab5ba9a35a94"
+checksum = "e3148f5046208a5d56bcfc03053e3ca6334e51da8dfb19b6cdc8b306fae3283e"
 
 [[package]]
 name = "phf"
@@ -1998,15 +1974,21 @@ checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
 
 [[package]]
 name = "pkg-config"
-version = "0.3.27"
+version = "0.3.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26072860ba924cbfa98ea39c8c19b4dd6a4a25423dbdf219c1eca91aa0cf6964"
+checksum = "d231b230927b5e4ad203db57bbcbee2802f6bce620b1e4a9024a07d94e2907ec"
 
 [[package]]
 name = "portable-atomic"
-version = "1.4.3"
+version = "1.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "31114a898e107c51bb1609ffaf55a0e011cf6a4d7f1170d0015a165082c0338b"
+checksum = "7170ef9988bc169ba16dd36a7fa041e5c4cbeb6a35b76d4c03daded371eae7c0"
+
+[[package]]
+name = "powerfmt"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
 
 [[package]]
 name = "ppv-lite86"
@@ -2016,13 +1998,12 @@ checksum = "5b40af805b3121feab8a3c29f04d8ad262fa8e0561883e7653e024ae4479e6de"
 
 [[package]]
 name = "predicates"
-version = "3.0.4"
+version = "3.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6dfc28575c2e3f19cb3c73b93af36460ae898d426eba6fc15b9bd2a5220758a0"
+checksum = "68b87bfd4605926cdfefc1c3b5f8fe560e3feca9d5552cf68c466d3d8236c7e8"
 dependencies = [
  "anstyle",
  "difflib",
- "itertools",
  "predicates-core",
 ]
 
@@ -2074,20 +2055,33 @@ checksum = "dc375e1527247fe1a97d8b7156678dfe7c1af2fc075c9a4db3690ecd2a148068"
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.67"
+version = "1.0.78"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3d433d9f1a3e8c1263d9456598b16fec66f4acc9a74dacffd35c7bb09b3a1328"
+checksum = "e2422ad645d89c99f8f3e6b88a9fdeca7fabeac836b1002371c4367c8f984aae"
 dependencies = [
  "unicode-ident",
 ]
 
+[[package]]
+name = "proc-macro2-diagnostics"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af066a9c399a26e020ada66a034357a868728e72cd426f3adcd35f80d88d88c8"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.51",
+ "version_check",
+ "yansi 1.0.0-rc.1",
+]
+
 [[package]]
 name = "pulldown-cmark"
-version = "0.9.3"
+version = "0.9.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77a1a2f1f0a7ecff9c31abbe177637be0e97a0aef46cf8738ece09327985d998"
+checksum = "57206b407293d2bcd3af849ce869d52068623f19e1b5ff8e8778e3309439682b"
 dependencies = [
- "bitflags 1.3.2",
+ "bitflags 2.4.2",
  "memchr",
  "unicase",
 ]
@@ -2103,9 +2097,9 @@ dependencies = [
 
 [[package]]
 name = "quote"
-version = "1.0.33"
+version = "1.0.35"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5267fca4496028628a95160fc423a33e8b2e6af8a5302579e322e4b520293cae"
+checksum = "291ec9ab5efd934aaf503a6466c5d5251535d108ee747472c3977cc5acc868ef"
 dependencies = [
  "proc-macro2",
 ]
@@ -2142,9 +2136,9 @@ dependencies = [
 
 [[package]]
 name = "rayon"
-version = "1.8.0"
+version = "1.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c27db03db7734835b3f53954b534c91069375ce6ccaa2e065441e07d9b6cdb1"
+checksum = "fa7237101a77a10773db45d62004a272517633fbcc3df19d96455ede1122e051"
 dependencies = [
  "either",
  "rayon-core",
@@ -2152,9 +2146,9 @@ dependencies = [
 
 [[package]]
 name = "rayon-core"
-version = "1.12.0"
+version = "1.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ce3fb6ad83f861aac485e76e1985cd109d9a3713802152be56c3b1f0e0658ed"
+checksum = "1465873a3dfdaa8ae7cb14b4383657caab0b3e8a0aa9ae8e04b044854c8dfce2"
 dependencies = [
  "crossbeam-deque",
  "crossbeam-utils",
@@ -2171,27 +2165,24 @@ dependencies = [
 
 [[package]]
 name = "redox_syscall"
-version = "0.3.5"
+version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "567664f262709473930a4bf9e51bf2ebf3348f2e748ccc50dea20646858f8f29"
+checksum = "4722d768eff46b75989dd134e5c353f0d6296e5aaa3132e776cbdb56be7731aa"
 dependencies = [
  "bitflags 1.3.2",
 ]
 
 [[package]]
 name = "redox_termios"
-version = "0.1.2"
+version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8440d8acb4fd3d277125b4bd01a6f38aee8d814b3b5fc09b3f2b825d37d3fe8f"
-dependencies = [
- "redox_syscall 0.2.16",
-]
+checksum = "20145670ba436b55d91fc92d25e71160fbfbdd57831631c8d7d36377a476f1cb"
 
 [[package]]
 name = "regex"
-version = "1.9.5"
+version = "1.10.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "697061221ea1b4a94a624f67d0ae2bfe4e22b8a17b6a192afb11046542cc8c47"
+checksum = "b62dbe01f0b06f9d8dc7d49e05a0785f153b00b2c227856282f671e0318c9b15"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -2201,9 +2192,9 @@ dependencies = [
 
 [[package]]
 name = "regex-automata"
-version = "0.3.8"
+version = "0.4.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c2f401f4955220693b56f8ec66ee9c78abffd8d1c4f23dc41a23839eb88f0795"
+checksum = "5bb987efffd3c6d0d8f5f89510bb458559eab11e4f869acb20bf845e016259cd"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -2212,18 +2203,18 @@ dependencies = [
 
 [[package]]
 name = "regex-syntax"
-version = "0.7.5"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dbb5fb1acd8a1a18b3dd5be62d25485eb770e05afb408a9627d14d451bae12da"
+checksum = "c08c74e62047bb2de4ff487b251e4a92e24f48745648451635cec7d591162d9f"
 
 [[package]]
 name = "reqwest"
-version = "0.11.20"
+version = "0.11.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3e9ad3fe7488d7e34558a2033d45a0c90b72d97b4f80705666fea71472e2e6a1"
+checksum = "c6920094eb85afde5e4a138be3f2de8bbdf28000f0029e72c45025a56b042251"
 dependencies = [
  "async-compression",
- "base64 0.21.4",
+ "base64 0.21.7",
  "bytes",
  "encoding_rs",
  "futures-core",
@@ -2241,9 +2232,12 @@ dependencies = [
  "once_cell",
  "percent-encoding",
  "pin-project-lite",
+ "rustls-pemfile",
  "serde",
  "serde_json",
  "serde_urlencoded",
+ "sync_wrapper",
+ "system-configuration",
  "tokio",
  "tokio-native-tls",
  "tokio-util",
@@ -2272,15 +2266,24 @@ dependencies = [
 
 [[package]]
 name = "rustix"
-version = "0.38.19"
+version = "0.38.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "745ecfa778e66b2b63c88a61cb36e0eea109e803b0b86bf9879fbc77c70e86ed"
+checksum = "6ea3e1a662af26cd7a3ba09c0297a31af215563ecf42817c98df621387f4e949"
 dependencies = [
- "bitflags 2.4.0",
+ "bitflags 2.4.2",
  "errno",
  "libc",
  "linux-raw-sys",
- "windows-sys 0.48.0",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "rustls-pemfile"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1c74cae0a4cf6ccbbf5f359f08efdf8ee7e1dc532573bf0db71968cb56b1448c"
+dependencies = [
+ "base64 0.21.7",
 ]
 
 [[package]]
@@ -2291,9 +2294,9 @@ checksum = "7ffc183a10b4478d04cbbbfc96d0873219d962dd5accaff2ffbd4ceb7df837f4"
 
 [[package]]
 name = "ryu"
-version = "1.0.15"
+version = "1.0.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ad4cc8da4ef723ed60bced201181d83791ad433213d8c24efffda1eec85d741"
+checksum = "e86697c916019a8588c99b5fac3cead74ec0b4b819707a682fd4d23fa0ce1ba1"
 
 [[package]]
 name = "same-file"
@@ -2306,11 +2309,11 @@ dependencies = [
 
 [[package]]
 name = "schannel"
-version = "0.1.22"
+version = "0.1.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c3733bf4cf7ea0880754e19cb5a462007c4a8c1914bff372ccc95b464f1df88"
+checksum = "fbc91545643bcf3a0bbb6569265615222618bdf33ce4ffbbd13c4bbd4c093534"
 dependencies = [
- "windows-sys 0.48.0",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -2353,9 +2356,9 @@ dependencies = [
 
 [[package]]
 name = "semver"
-version = "1.0.19"
+version = "1.0.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ad977052201c6de01a8ef2aa3378c4bd23217a056337d1d6da40468d267a4fb0"
+checksum = "92d43fe69e652f3df9bdc2b85b2854a0825b86e4fb76bc44d945137d053639ca"
 dependencies = [
  "serde",
 ]
@@ -2368,29 +2371,29 @@ checksum = "388a1df253eca08550bef6c72392cfe7c30914bf41df5269b68cbd6ff8f570a3"
 
 [[package]]
 name = "serde"
-version = "1.0.188"
+version = "1.0.197"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf9e0fcba69a370eed61bcf2b728575f726b50b55cba78064753d708ddc7549e"
+checksum = "3fb1c873e1b9b056a4dc4c0c198b24c3ffa059243875552b2bd0933b1aee4ce2"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.188"
+version = "1.0.197"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4eca7ac642d82aa35b60049a6eccb4be6be75e599bd2e9adb5f875a737654af2"
+checksum = "7eb0b34b42edc17f6b7cac84a52a1c5f0e1bb2227e997ca9011ea3dd34e8610b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.37",
+ "syn 2.0.51",
 ]
 
 [[package]]
 name = "serde_json"
-version = "1.0.107"
+version = "1.0.114"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6b420ce6e3d8bd882e9b243c6eed35dbc9a6110c9769e74b584e0d68d1f20c65"
+checksum = "c5f09b1bd632ef549eaa9f60a1f8de742bdbc698e6cee2095fc84dde5f549ae0"
 dependencies = [
  "itoa",
  "ryu",
@@ -2509,28 +2512,18 @@ dependencies = [
 
 [[package]]
 name = "smallvec"
-version = "1.11.1"
+version = "1.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "942b4a808e05215192e39f4ab80813e599068285906cc91aa64f923db842bd5a"
+checksum = "e6ecd384b10a64542d77071bd64bd7b231f4ed5940fba55e98c3de13824cf3d7"
 
 [[package]]
 name = "socket2"
-version = "0.4.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "64a4a911eed85daf18834cfaa86a79b7d266ff93ff5ba14005426219480ed662"
-dependencies = [
- "libc",
- "winapi 0.3.9",
-]
-
-[[package]]
-name = "socket2"
-version = "0.5.4"
+version = "0.5.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4031e820eb552adee9295814c0ced9e5cf38ddf1e8b7d566d6de8e2538ea989e"
+checksum = "05ffd9c0a93b7543e062e759284fcf5f5e3b098501104bfbdde4d404db792871"
 dependencies = [
  "libc",
- "windows-sys 0.48.0",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -2545,26 +2538,32 @@ version = "0.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "73473c0e59e6d5812c5dfe2a064a6444949f089e20eec9a2e5506596494e4623"
 
+[[package]]
+name = "strsim"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5ee073c9e4cd00e28217186dbe12796d692868f432bf2e97ee73bed0c56dfa01"
+
 [[package]]
 name = "strum"
-version = "0.25.0"
+version = "0.26.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "290d54ea6f91c969195bdbcd7442c8c2a2ba87da8bf60a7ee86a235d4bc1e125"
+checksum = "723b93e8addf9aa965ebe2d11da6d7540fa2283fcea14b3371ff055f7ba13f5f"
 dependencies = [
  "strum_macros",
 ]
 
 [[package]]
 name = "strum_macros"
-version = "0.25.2"
+version = "0.26.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ad8d03b598d3d0fff69bf533ee3ef19b8eeb342729596df84bcc7e1f96ec4059"
+checksum = "7a3417fc93d76740d974a01654a09777cb500428cc874ca9f45edfe0c4d4cd18"
 dependencies = [
  "heck",
  "proc-macro2",
  "quote",
  "rustversion",
- "syn 2.0.37",
+ "syn 2.0.51",
 ]
 
 [[package]]
@@ -2580,26 +2579,52 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.37"
+version = "2.0.51"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7303ef2c05cd654186cb250d29049a24840ca25d2747c25c0381c8d9e2f582e8"
+checksum = "6ab617d94515e94ae53b8406c628598680aa0c9587474ecbe58188f7b345d66c"
 dependencies = [
  "proc-macro2",
  "quote",
  "unicode-ident",
 ]
 
+[[package]]
+name = "sync_wrapper"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2047c6ded9c721764247e62cd3b03c09ffc529b2ba5b10ec482ae507a4a70160"
+
+[[package]]
+name = "system-configuration"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba3a3adc5c275d719af8cb4272ea1c4a6d668a777f37e115f6d11ddbc1c8e0e7"
+dependencies = [
+ "bitflags 1.3.2",
+ "core-foundation",
+ "system-configuration-sys",
+]
+
+[[package]]
+name = "system-configuration-sys"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a75fb188eb626b924683e3b95e3a48e63551fcfb51949de2f06a9d91dbee93c9"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
 [[package]]
 name = "tempfile"
-version = "3.8.0"
+version = "3.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb94d2f3cc536af71caac6b6fcebf65860b347e7ce0cc9ebe8f70d3e521054ef"
+checksum = "85b77fafb263dd9d05cbeac119526425676db3784113aa9295c88498cbf8bff1"
 dependencies = [
  "cfg-if",
  "fastrand",
- "redox_syscall 0.3.5",
  "rustix",
- "windows-sys 0.48.0",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -2665,40 +2690,42 @@ checksum = "3369f5ac52d5eb6ab48c6b4ffdc8efbcad6b89c765749064ba298f2c68a16a76"
 
 [[package]]
 name = "textwrap"
-version = "0.16.0"
+version = "0.16.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "222a222a5bfe1bba4a77b45ec488a741b3cb8872e5e499451fd7d0129c9c7c3d"
+checksum = "23d434d3f8967a09480fb04132ebe0a3e088c173e6d0ee7897abbdf4eab0f8b9"
 
 [[package]]
 name = "thiserror"
-version = "1.0.49"
+version = "1.0.57"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1177e8c6d7ede7afde3585fd2513e611227efd6481bd78d2e82ba1ce16557ed4"
+checksum = "1e45bcbe8ed29775f228095caf2cd67af7a4ccf756ebff23a306bf3e8b47b24b"
 dependencies = [
  "thiserror-impl",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "1.0.49"
+version = "1.0.57"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "10712f02019e9288794769fba95cd6847df9874d49d871d062172f9dd41bc4cc"
+checksum = "a953cb265bef375dae3de6663da4d3804eee9682ea80d8e2542529b73c531c81"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.37",
+ "syn 2.0.51",
 ]
 
 [[package]]
 name = "time"
-version = "0.3.29"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "426f806f4089c493dcac0d24c29c01e2c38baf8e30f1b716ee37e83d200b18fe"
+checksum = "c8248b6521bb14bc45b4067159b9b6ad792e2d6d754d6c41fb50e29fefe38749"
 dependencies = [
  "deranged",
  "itoa",
  "libc",
+ "num-conv",
  "num_threads",
+ "powerfmt",
  "serde",
  "time-core",
  "time-macros",
@@ -2712,10 +2739,11 @@ checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3"
 
 [[package]]
 name = "time-macros"
-version = "0.2.15"
+version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4ad70d68dba9e1f8aceda7aa6711965dfec1cac869f311a51bd08b3a2ccbce20"
+checksum = "7ba3a3ef41e6672a2f0f001392bb5dcd3ff0a9992d618ca761a11c3121547774"
 dependencies = [
+ "num-conv",
  "time-core",
 ]
 
@@ -2736,9 +2764,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "tokio"
-version = "1.32.0"
+version = "1.36.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "17ed6077ed6cd6c74735e21f37eb16dc3935f96878b1fe961074089cc80893f9"
+checksum = "61285f6515fa018fb2d1e46eb21223fff441ee8db5d0f1435e8ab4f5cdb80931"
 dependencies = [
  "backtrace",
  "bytes",
@@ -2748,7 +2776,7 @@ dependencies = [
  "parking_lot",
  "pin-project-lite",
  "signal-hook-registry",
- "socket2 0.5.4",
+ "socket2",
  "tokio-macros",
  "windows-sys 0.48.0",
 ]
@@ -2761,13 +2789,13 @@ checksum = "2e57fbf1da3f18c8a95469f8973c138b0a99f4ae761885c3646b0c61139b0522"
 
 [[package]]
 name = "tokio-macros"
-version = "2.1.0"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "630bdcf245f78637c13ec01ffae6187cca34625e8c63150d424b59e55af2675e"
+checksum = "5b8a1e28f2deaa14e508979454cb3a223b10b938b45af148bc0986de36f1923b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.37",
+ "syn 2.0.51",
 ]
 
 [[package]]
@@ -2782,9 +2810,9 @@ dependencies = [
 
 [[package]]
 name = "tokio-util"
-version = "0.7.9"
+version = "0.7.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d68074620f57a0b21594d9735eb2e98ab38b17f80d3fcb189fca266771ca60d"
+checksum = "5419f34732d9eb6ee4c3578b7989078579b7f039cbbb9ca2c4da015749371e15"
 dependencies = [
  "bytes",
  "futures-core",
@@ -2802,29 +2830,28 @@ checksum = "b6bc1c9ce2b5135ac7f93c72918fc37feb872bdc6a5533a8b85eb4b86bfdae52"
 
 [[package]]
 name = "tracing"
-version = "0.1.37"
+version = "0.1.40"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ce8c33a8d48bd45d624a6e523445fd21ec13d3653cd51f681abf67418f54eb8"
+checksum = "c3523ab5a71916ccf420eebdf5521fcef02141234bbc0b8a49f2fdc4544364ef"
 dependencies = [
- "cfg-if",
  "pin-project-lite",
  "tracing-core",
 ]
 
 [[package]]
 name = "tracing-core"
-version = "0.1.31"
+version = "0.1.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0955b8137a1df6f1a2e9a37d8a6656291ff0297c1a97c24e0d8425fe2312f79a"
+checksum = "c06d3da6113f116aaee68e4d601191614c9053067f9ab7f6edbcb161237daa54"
 dependencies = [
  "once_cell",
 ]
 
 [[package]]
 name = "try-lock"
-version = "0.2.4"
+version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3528ecfd12c466c6f163363caf2d02a71161dd5e1cc6ae7b34207ea2d42d81ed"
+checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
 
 [[package]]
 name = "typenum"
@@ -2843,9 +2870,9 @@ dependencies = [
 
 [[package]]
 name = "unicode-bidi"
-version = "0.3.13"
+version = "0.3.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92888ba5573ff080736b3648696b70cafad7d250551175acbaa4e0385b3e1460"
+checksum = "08f95100a766bf4f8f28f90d77e0a5461bbdb219042e7679bebe79004fed8d75"
 
 [[package]]
 name = "unicode-ident"
@@ -2855,9 +2882,9 @@ checksum = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b"
 
 [[package]]
 name = "unicode-normalization"
-version = "0.1.22"
+version = "0.1.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c5713f0fc4b5db668a2ac63cdb7bb4469d8c9fed047b1d0292cc7b0ce2ba921"
+checksum = "a56d1686db2308d901306f92a263857ef59ea39678a5458e7cb17f01415101f5"
 dependencies = [
  "tinyvec",
 ]
@@ -2870,9 +2897,9 @@ checksum = "e51733f11c9c4f72aa0c160008246859e340b00807569a0da0e7a1079b27ba85"
 
 [[package]]
 name = "url"
-version = "2.4.1"
+version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "143b538f18257fac9cad154828a57c6bf5157e1aa604d4816b5995bf6de87ae5"
+checksum = "31e6302e3bb753d46e83516cae55ae196fc0c309407cf11ab35cc51a4c2a4633"
 dependencies = [
  "form_urlencoded",
  "idna",
@@ -2939,9 +2966,9 @@ checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.87"
+version = "0.2.91"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7706a72ab36d8cb1f80ffbf0e071533974a60d0a308d01a5d0375bf60499a342"
+checksum = "c1e124130aee3fb58c5bdd6b639a0509486b0338acaaae0c84a5124b0f588b7f"
 dependencies = [
  "cfg-if",
  "wasm-bindgen-macro",
@@ -2949,24 +2976,24 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-backend"
-version = "0.2.87"
+version = "0.2.91"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ef2b6d3c510e9625e5fe6f509ab07d66a760f0885d858736483c32ed7809abd"
+checksum = "c9e7e1900c352b609c8488ad12639a311045f40a35491fb69ba8c12f758af70b"
 dependencies = [
  "bumpalo",
  "log",
  "once_cell",
  "proc-macro2",
  "quote",
- "syn 2.0.37",
+ "syn 2.0.51",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-futures"
-version = "0.4.37"
+version = "0.4.41"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c02dbc21516f9f1f04f187958890d7e6026df8d16540b7ad9492bc34a67cea03"
+checksum = "877b9c3f61ceea0e56331985743b13f3d25c406a7098d45180fb5f09bc19ed97"
 dependencies = [
  "cfg-if",
  "js-sys",
@@ -2976,9 +3003,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.87"
+version = "0.2.91"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dee495e55982a3bd48105a7b947fd2a9b4a8ae3010041b9e0faab3f9cd028f1d"
+checksum = "b30af9e2d358182b5c7449424f017eba305ed32a7010509ede96cdc4696c46ed"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -2986,28 +3013,28 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.87"
+version = "0.2.91"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "54681b18a46765f095758388f2d0cf16eb8d4169b639ab575a8f5693af210c7b"
+checksum = "642f325be6301eb8107a83d12a8ac6c1e1c54345a7ef1a9261962dfefda09e66"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.37",
+ "syn 2.0.51",
  "wasm-bindgen-backend",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.87"
+version = "0.2.91"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca6ad05a4870b2bf5fe995117d3728437bd27d7cd5f06f13c17443ef369775a1"
+checksum = "4f186bd2dcf04330886ce82d6f33dd75a7bfcf69ecf5763b89fcde53b6ac9838"
 
 [[package]]
 name = "web-sys"
-version = "0.3.64"
+version = "0.3.68"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b85cbef8c220a6abc02aefd892dfc0fc23afb1c6a426316ec33253a3877249b"
+checksum = "96565907687f7aceb35bc5fc03770a8a0471d82e479f25832f54a0e3f4b28446"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
@@ -3057,12 +3084,12 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
-name = "windows"
-version = "0.48.0"
+name = "windows-core"
+version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e686886bc078bc1b0b600cac0147aadb815089b6e4da64016cbd754b6342700f"
+checksum = "33ab640c8d7e35bf8ba19b884ba838ceb4fba93a4e8c65a9059d08afcfc683d9"
 dependencies = [
- "windows-targets 0.48.5",
+ "windows-targets 0.52.3",
 ]
 
 [[package]]
@@ -3080,15 +3107,6 @@ dependencies = [
  "windows_x86_64_msvc 0.42.2",
 ]
 
-[[package]]
-name = "windows-sys"
-version = "0.45.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75283be5efb2831d37ea142365f009c02ec203cd29a3ebecbc093d52315b66d0"
-dependencies = [
- "windows-targets 0.42.2",
-]
-
 [[package]]
 name = "windows-sys"
 version = "0.48.0"
@@ -3099,18 +3117,12 @@ dependencies = [
 ]
 
 [[package]]
-name = "windows-targets"
-version = "0.42.2"
+name = "windows-sys"
+version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e5180c00cd44c9b1c88adb3693291f1cd93605ded80c250a75d472756b4d071"
+checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
 dependencies = [
- "windows_aarch64_gnullvm 0.42.2",
- "windows_aarch64_msvc 0.42.2",
- "windows_i686_gnu 0.42.2",
- "windows_i686_msvc 0.42.2",
- "windows_x86_64_gnu 0.42.2",
- "windows_x86_64_gnullvm 0.42.2",
- "windows_x86_64_msvc 0.42.2",
+ "windows-targets 0.52.3",
 ]
 
 [[package]]
@@ -3128,6 +3140,21 @@ dependencies = [
  "windows_x86_64_msvc 0.48.5",
 ]
 
+[[package]]
+name = "windows-targets"
+version = "0.52.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d380ba1dc7187569a8a9e91ed34b8ccfc33123bbacb8c0aed2d1ad7f3ef2dc5f"
+dependencies = [
+ "windows_aarch64_gnullvm 0.52.3",
+ "windows_aarch64_msvc 0.52.3",
+ "windows_i686_gnu 0.52.3",
+ "windows_i686_msvc 0.52.3",
+ "windows_x86_64_gnu 0.52.3",
+ "windows_x86_64_gnullvm 0.52.3",
+ "windows_x86_64_msvc 0.52.3",
+]
+
 [[package]]
 name = "windows_aarch64_gnullvm"
 version = "0.42.2"
@@ -3140,6 +3167,12 @@ version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"
 
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68e5dcfb9413f53afd9c8f86e56a7b4d86d9a2fa26090ea2dc9e40fba56c6ec6"
+
 [[package]]
 name = "windows_aarch64_msvc"
 version = "0.42.2"
@@ -3152,6 +3185,12 @@ version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"
 
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8dab469ebbc45798319e69eebf92308e541ce46760b49b18c6b3fe5e8965b30f"
+
 [[package]]
 name = "windows_i686_gnu"
 version = "0.42.2"
@@ -3164,6 +3203,12 @@ version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"
 
+[[package]]
+name = "windows_i686_gnu"
+version = "0.52.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2a4e9b6a7cac734a8b4138a4e1044eac3404d8326b6c0f939276560687a033fb"
+
 [[package]]
 name = "windows_i686_msvc"
 version = "0.42.2"
@@ -3176,6 +3221,12 @@ version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"
 
+[[package]]
+name = "windows_i686_msvc"
+version = "0.52.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "28b0ec9c422ca95ff34a78755cfa6ad4a51371da2a5ace67500cf7ca5f232c58"
+
 [[package]]
 name = "windows_x86_64_gnu"
 version = "0.42.2"
@@ -3188,6 +3239,12 @@ version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"
 
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "704131571ba93e89d7cd43482277d6632589b18ecf4468f591fbae0a8b101614"
+
 [[package]]
 name = "windows_x86_64_gnullvm"
 version = "0.42.2"
@@ -3200,6 +3257,12 @@ version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"
 
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42079295511643151e98d61c38c0acc444e52dd42ab456f7ccfd5152e8ecf21c"
+
 [[package]]
 name = "windows_x86_64_msvc"
 version = "0.42.2"
@@ -3212,6 +3275,12 @@ version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
 
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0770833d60a970638e989b3fa9fd2bb1aaadcf88963d1659fd7d9990196ed2d6"
+
 [[package]]
 name = "winreg"
 version = "0.50.0"
@@ -3245,8 +3314,14 @@ version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "09041cd90cf85f7f8b2df60c646f853b7f535ce68f85244eb6731cf89fa498ec"
 
+[[package]]
+name = "yansi"
+version = "1.0.0-rc.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1367295b8f788d371ce2dbc842c7b709c73ee1364d30351dd300ec2203b12377"
+
 [[package]]
 name = "zeroize"
-version = "1.6.0"
+version = "1.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2a0956f1ba7c7909bfb66c2e9e4124ab6f6482560f6628b5aaeba39207c9aad9"
+checksum = "525b4ec142c6b68a2d10f01f7bbf6755599ca3f81ea53b8431b7dd348f5fdb2d"
diff --git a/Cargo.toml b/Cargo.toml
index bc7309e..1c3e951 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -176,8 +176,8 @@ lnk = {version="0.5.1", optional=true}
 # pf2bodyfile
 libc = {version="0.2", optional=true}
 num = {version="0", optional=true}
-frnsc-prefetch = {version="0.9", optional=true}
-forensic-rs = {version=">=0.11", optional=true}
+frnsc-prefetch = {version="0.11", optional=true}
+forensic-rs = {version="0.11", optional=true}
 
 [dev-dependencies]
 
diff --git a/src/bin/pf2bodyfile/main.rs b/src/bin/pf2bodyfile/main.rs
index 7735af8..51d1ad7 100644
--- a/src/bin/pf2bodyfile/main.rs
+++ b/src/bin/pf2bodyfile/main.rs
@@ -27,8 +27,16 @@ fn main() -> anyhow::Result<()> {
                 if let Some(pf_os_filename) = input.path().file_name() {
                     if let Some(pf_filename) = pf_os_filename.to_str() {
                         let virtual_file = fs.open(Path::new(&pf_filename.to_string()))?;
-                        let created = virtual_file.metadata()?.created_opt().map(|t| i64::try_from(*t).ok()).flatten();
-                        let modified = virtual_file.metadata()?.modified_opt().map(|t| i64::try_from(*t).ok()).flatten();
+                        let created = virtual_file
+                            .metadata()?
+                            .created_opt()
+                            .map(|t| i64::try_from(*t).ok())
+                            .flatten();
+                        let modified = virtual_file
+                            .metadata()?
+                            .modified_opt()
+                            .map(|t| i64::try_from(*t).ok())
+                            .flatten();
                         let pf_file = read_prefetch_file(pf_filename, virtual_file)?;
 
                         pf_file.display_prefetch_file(

From c3636a8166a5e10268c90ee3fc37fe44b1b23d80 Mon Sep 17 00:00:00 2001
From: Explie <tobias@dfir-dd.de>
Date: Wed, 28 Feb 2024 20:16:30 +0100
Subject: [PATCH 05/35] Update zip2bodyfile.md

---
 doc/zip2bodyfile.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/zip2bodyfile.md b/doc/zip2bodyfile.md
index a4161ce..80b27a5 100644
--- a/doc/zip2bodyfile.md
+++ b/doc/zip2bodyfile.md
@@ -8,7 +8,7 @@ This document contains the help content for the `zip2bodyfile` command-line prog
 
 ## `zip2bodyfile`
 
-creates bodyfile from Windows Prefetch files
+creates bodyfile from files and folders within ZIP Archives
 
 **Usage:** `zip2bodyfile [OPTIONS] [ZIP_FILES]...`
 

From 58e47fcdb3d1259f2dc88403bda92d0b15ba82b9 Mon Sep 17 00:00:00 2001
From: Explie <tobias@dfir-dd.de>
Date: Wed, 28 Feb 2024 20:22:26 +0100
Subject: [PATCH 06/35] Update cli.rs

updated md
---
 src/bin/zip2bodyfile/cli.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/bin/zip2bodyfile/cli.rs b/src/bin/zip2bodyfile/cli.rs
index 5a22034..9b47cdf 100644
--- a/src/bin/zip2bodyfile/cli.rs
+++ b/src/bin/zip2bodyfile/cli.rs
@@ -5,7 +5,7 @@ use dfir_toolkit::common::HasVerboseFlag;
 use getset::Getters;
 use log::LevelFilter;
 
-/// creates bodyfile from Windows Prefetch files
+/// creates bodyfile from ZIP Archives based on the contained files and folders
 #[derive(Parser, Getters)]
 #[clap(name=env!("CARGO_BIN_NAME"), author, version)]
 #[getset(get = "pub (crate)")]

From 77a1d29a8d30f3f95717a42e06e108f562ba2267 Mon Sep 17 00:00:00 2001
From: Explie <tobias@dfir-dd.de>
Date: Wed, 28 Feb 2024 20:23:38 +0100
Subject: [PATCH 07/35] Update zip2bodyfile.md

---
 doc/zip2bodyfile.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/zip2bodyfile.md b/doc/zip2bodyfile.md
index 80b27a5..651470b 100644
--- a/doc/zip2bodyfile.md
+++ b/doc/zip2bodyfile.md
@@ -8,7 +8,7 @@ This document contains the help content for the `zip2bodyfile` command-line prog
 
 ## `zip2bodyfile`
 
-creates bodyfile from files and folders within ZIP Archives
+creates bodyfile from ZIP Archives based on the contained files and folders
 
 **Usage:** `zip2bodyfile [OPTIONS] [ZIP_FILES]...`
 

From 7e4bca296a7e77ec27b05c4c1cb9962a9f698e58 Mon Sep 17 00:00:00 2001
From: Jan Starke <jan.starke@posteo.de>
Date: Thu, 29 Feb 2024 09:27:08 +0100
Subject: [PATCH 08/35] add integration test for zip2bodyfile

---
 Cargo.lock                        |   2 +-
 Cargo.toml                        |   2 +-
 tests/data/zip2bodyfile/hello.zip | Bin 0 -> 180 bytes
 tests/mod.rs                      |   3 +-
 tests/zip2bodyfile.rs             |  48 ++++++++++++++++++++++++++++++
 5 files changed, 52 insertions(+), 3 deletions(-)
 create mode 100644 tests/data/zip2bodyfile/hello.zip
 create mode 100644 tests/zip2bodyfile.rs

diff --git a/Cargo.lock b/Cargo.lock
index 11b7cf1..af6eac3 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -757,7 +757,7 @@ dependencies = [
 
 [[package]]
 name = "dfir-toolkit"
-version = "0.11.0"
+version = "0.11.1"
 dependencies = [
  "anyhow",
  "assert-json-diff",
diff --git a/Cargo.toml b/Cargo.toml
index 3d167a8..c42ca16 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "dfir-toolkit"
-version = "0.11.0"
+version = "0.11.1"
 edition = "2021"
 authors = ["Jan Starke <jan.starke@posteo.de>", "Deborah Mahn <deborah.mahn@dfir-dd.de>"]
 description = "CLI tools for digital forensics and incident response"
diff --git a/tests/data/zip2bodyfile/hello.zip b/tests/data/zip2bodyfile/hello.zip
new file mode 100644
index 0000000000000000000000000000000000000000..ccf7d5d24282823b446147d8d90f3b441a0d0453
GIT binary patch
literal 180
zcmWIWW@h1H0D-3-u@Sn~9P4?2Y!K#TkYUJ3&B@8vE2$_64dG;9*0X+)3c{ro+zgB?
zFPIq^zyw&4LV12sP6}6mHzSiAGcE%qK=v>&0`Znc5DUq8R*3OvMhAGavVjyb0--;U
I24MyU04xh4G5`Po

literal 0
HcmV?d00001

diff --git a/tests/mod.rs b/tests/mod.rs
index b6c5636..beac6a6 100644
--- a/tests/mod.rs
+++ b/tests/mod.rs
@@ -1,3 +1,4 @@
 mod mactime2;
 mod ts2date;
-mod lnk2bodyfile;
\ No newline at end of file
+mod lnk2bodyfile;
+mod zip2bodyfile;
\ No newline at end of file
diff --git a/tests/zip2bodyfile.rs b/tests/zip2bodyfile.rs
new file mode 100644
index 0000000..58a8dfd
--- /dev/null
+++ b/tests/zip2bodyfile.rs
@@ -0,0 +1,48 @@
+use std::{
+    io::{BufRead, BufReader, Cursor},
+    path::PathBuf,
+};
+
+use assert_cmd::Command;
+use dfir_toolkit::common::bodyfile::{Bodyfile3Line, Accessed, Modified, Changed, Created};
+
+#[test]
+fn test_hello() {
+    do_test_hello(r#"hello.txt"#, vec![].into_iter());
+}
+
+#[test]
+fn test_hello_with_archive_name() {
+    do_test_hello(r#"hello.txt (in archive hello.zip)"#, vec!["--show-archive-name"].into_iter());
+}
+
+fn do_test_hello(expected_name: &str, args: impl Iterator<Item = &'static str>) {
+    let mut cmd = Command::cargo_bin("zip2bodyfile").unwrap();
+    let mut data_path = PathBuf::from(std::env::var("CARGO_MANIFEST_DIR").unwrap());
+    data_path.push("tests");
+    data_path.push("data");
+    data_path.push("zip2bodyfile");
+    data_path.push("hello.zip");
+
+    let result = cmd.arg(data_path).args(args).ok();
+    if result.is_err() {
+        println!("{}", result.as_ref().err().unwrap());
+    }
+
+    assert!(result.is_ok());
+
+    // parse the result as bodyfile 😈
+    let reader = BufReader::new(Cursor::new(result.unwrap().stdout));
+    let mut lines_iterator = reader.lines();
+    let first_line = lines_iterator.next().unwrap().unwrap();
+
+    let bfline = Bodyfile3Line::try_from(&first_line[..]).unwrap();
+    assert_eq!(bfline.get_name(), expected_name);
+    assert_eq!(*bfline.get_size(), 12);
+    assert_eq!(*bfline.get_atime(), Accessed::default());
+    assert_eq!(*bfline.get_mtime(), Modified::from(1709197630));
+    assert_eq!(*bfline.get_ctime(), Changed::default());
+    assert_eq!(*bfline.get_crtime(), Created::default());
+
+    assert!(lines_iterator.next().is_none());
+}
\ No newline at end of file

From d0b793ee99920d69a84db5eb361c06414daa4d60 Mon Sep 17 00:00:00 2001
From: Explie <tobias@dfir-dd.de>
Date: Thu, 29 Feb 2024 21:40:13 +0100
Subject: [PATCH 09/35] Added failing integration test

---
 tests/data/zip2bodyfile/hello2.zip | Bin 0 -> 12512 bytes
 tests/zip2bodyfile.rs              |  59 ++++++++++++++++++++++++++++-
 2 files changed, 58 insertions(+), 1 deletion(-)
 create mode 100644 tests/data/zip2bodyfile/hello2.zip

diff --git a/tests/data/zip2bodyfile/hello2.zip b/tests/data/zip2bodyfile/hello2.zip
new file mode 100644
index 0000000000000000000000000000000000000000..2782382ce517faf71ec4501468ea034b39b04e43
GIT binary patch
literal 12512
zcmb8WQ;;r96lgcLZQHhO+qUhQGxH74*tTukwr$%ylmFh_<RO(*lJ2VA{nG1YS9R^$
zy;?~Y6buIFe+)z&J+1$_`Cowq2pY)D!rF!2&C$`$*4mBU!ra)+-Nl^V$J&X-#L>*#
z!rIQ9QC$rj2sk!u&s^z$fuR0(5Wi)b5+e|hd?XMM_5UZ3oV2L8f~xrc$s6(4b;XrT
zy!HKwg6WQk4zilcZSbsymJ~uWJAe~+k)Fiq$${t;dahiExq-F5t`qz)x6tndo{#nC
zj@`jZxUQX?ocyY(;s3sCyPA7#`*`_w@Gy52?Ca9e)A{`Uc=_4J^Tzr8xy@`Xr~Nuw
z{&$b~75F*1LD>8I&(ieTyl0DZ<fydCGVSbJ_N%~oc6aUSmfJS_N9j#H*Zui*nW1te
z^yjSf%HxJ{&%e!K4b%PUeWz}8Hczjq&U&S=g?G*FZ>?*`jZIhKiM_@N2jgZfb*ldv
z9e-Cbc-y<_fsW}_%MHh~g?6>x3QyKrRlrrHgUy9^*QVKusWSg&;n1V{&PFxem1UY?
zy6V}<uLEwHeOk$oDk3hWm1~M^<KphC?B<NYMQpQ!#hTkKwWwaFJ7&K2T8uS6hf{Lr
zR{LlGZDlw3`JDSxP0xMSxh}my(^lurb%Lj-eCuTt`oI9A?l-%q{exD=HqvV6H7@_Z
z?3<h3TU-dby0(7Ht_NCX9X#S$YOvMbE!1cAH8Xoo_MN=k_HrK06Bore|5dZ+CfqwK
z1P`*~BN$;tzkkuOs)8IFuP?SbR<QG1xdsJSHrpJu=hSqV&QQ}v35B-ydy6t)pO}Mu
zL;~`@&t$nwjM>!r+4+Oi-?5IsvaMSwV)o6hx<`82Eo)mqpHRz-=JfHvGGLc!zF|yP
zUGg(b0X4o|lQag<fkQOW^!$OclI6Cg07hKR4NH;XS@S(01SX{Yj6+2(!=u$&YoRRw
z_s9ntnu7;?PULHM!AV@6hZMU<(5FL^d%INAL@q!K1x1ES8S5TMz_)a5hY#js2}W19
zx}n&gVRPn#%}&@-tK$%w@off1_H=fUA4oZ_*0l5lbB1*R^C!JK$`XYIVQcBC-9Ff!
zeBL-=QsZ`mDI0k&h?VZGrZR7+(>sPe!vd;rGLPNhX1fxV#<FAW(Oyl#soi!PRhpmx
z4vFD_&U1yp6CgUC`AD)qz3KQ#c{<x`-LC?lCz;!6)FH&Fe{}dj#4u8=w}kA7^tp-8
ztkOU?SvX`)l^M6I5>-Oo%D9>@MDp3K6+#xstryonc;|GUjMPu!Cowt=sWbJHVDCv@
z^MwLt-?u3iOSx>1r@{QJs>vjg-gUEiVcf?5aKvDH;fQWzJlw7>466YU5m0V*mpHIN
zgre1)Jqnc|Q*gY?xG4Q+ofMyIM5{zz!%FG`E!2Wbf>~-uj<%><V~;)DV{B3wh@LBl
zrFa*~GwB1lXauB26`9}D!y{oZ%(OG=F(-zfL)v3KyPJ)=5x;$<wHEOR?gEhpJ1OvW
zknN;EB61EJES<5(hoP8zEAu8b_@~8TO2%O2maRuv=ax4$R)*?ewZWD^;U(%#J>hMV
zF#Lp(Fe$d3gnJ|Y+cof72FmluvCz3NSK5nXp4^uLJj{nkpTX>iJRvV4aCaFXuiJUl
zu7C8eixH>n-QpeAWF<c+H8!H~L!xg|hjfrEZ;~EH3w+9w1+=vtMunG&=)9&{b^AEg
zjA?_xeQ&WL9~%rMo_APSI1uWKdH42;p0q{_KVdK)!-XNM<{bD`Xiyb0Me@wya}tlh
zba>mVU_7HWVxln-=#r50dz_={lRX1*7%WCvdTo`?Jbwv#V?Ki^&q}oO(nj6Ub2u9S
zOfIfNMoR=7-Dg-x))OhFh?g);GG*6Asj|D6Nh?Z=x~HbhMmK=+Vza`@#AL?WI0TmA
zzFWt`95e1if->u?GS<)C18%G`kHSPuOspfhF9@sOa57feQx~+NpSIu~R`{|J+4(mO
z7(f-qA1tgwcX|aMDV2b16T@AymbpF^BEw7fZ1yLjF-)jvkN!fYs#b}vie9)KRF#SC
z-B$rD`-F(r1S?$^1fBj>&CBA1{wGVzX6MKQ)HxlBcR^&TbJCU;nUi#YK?2>?OBuMg
z!kuZpXB~p23m#YkXhFn`^-)=-)f)u*_TF;5=PUN#iip9hIl+zNZ;%bvAw{s5IP`d&
zIJD{z&t?F-7;6@5ou_}((138>aF{&psQ{|{P9<Q@R%4EdC!Ia-k_0o6EJmWejXR<_
zA)H^x<dQjTxDpZ4@Bk{T1xmk{bVG*o7fhsxa{SaqfAyMiSp`WJ=nZ`Y8Txitmh|Y2
zltHavv8~bG1pK|Gs?!HvE4VCQtkx%-zBV(x(9|191%O1kDtF8U1<|N-JQhW7>Vwwi
zyou?PzUSZB)^zpu`gr>Jb7<`B>K_;0*GJ^u%0RP`u$RY2#$!QpO1)QiR!9g+nA1FH
zUa+sBFucFp8Lfc+ymQr<PfOKgnQ~>KvLqq8H(77Vs=gpXcHRmeFIEk0E-|VZw3W~`
z7NIZ@7DM<ttpzf;s!14AuIgA}6%)R@=`E3UL3)UN%B}A`MKh`(b)s-y5!t)H32it*
zhQp2;Y=>wgWsWx>+v}o%{+lH3hngWTM!rM>l0`J>J8Ks>m_ONs--I8qZZ3az2YiQR
zf?fDjy|W)BW-L-Hc}0Q)sXD@B+@s<?2toJVJ{b?)j#4E?&Y#o8s4d9k1a8$s_XirB
zPuT=DbfRB?s@rg6mFU;D(d-un(d6iv`oDWdL4&<Ud~V+pRXmgy&FHX}=DH#+hi<M4
zx25QL4tQe!_Bvtx1!;~u3ECIBkWib}?6_>dtdo*MvHoqEB_2FtecbH^DH}}kN+`1!
z|9q^`$R^}YP0e;Y%rt=tZ0yl`L~)px#Da+V2ht7qCr<YzXOyr1X%to(H=64kJ<RJN
zIWjbsw`;{U7)k0Wjh}jmNOD>zHv7TYnw!5=J`{%AO9pF0RU;X$66?-lY?}ds2H5~s
zH)7aEoOVcje=1nOALT7X>vSW<yd8RQAqh8$_Z^L|PD6wXWC}vl*jIlu=zXQ;KsQLd
zgrMAu8W5^z$EpUXjgHamSc`rkK_j%IP68hhg=qn0ayhCu;%zk4UEjgmMKaY9RRj?<
zmauA#`r_l>2nrO&$PC%0!1Y!XF>OWt39jli@%`xxn^;hY{uHyrhdPPus!B_nh*dve
zr=f4Ary0A%;Q#~CvsF16pbid1_DFRSU*}EK9r=P39CCA$K8&SKHQ=~ZPt2trps_Cw
zpT~q@PuMslZW;+k=nk^i)`HRShBx4Zv8dAkQ}Ni4!biW=W~2Z^ECMpD=6*-N`@?2W
z8wPAodq6Beh76>=)B$yd|M#TamPHhAOL1faJ$h+`2!VtoOmmZGOo0x}R5Z}u3Z5dG
z6Z4q7{>mGAZRzS;`Y=vmSzTcyAsrkFCLy{=&=Jxl_eggzmAWY^d_kCchwgW(;lBhX
zv>Ex1&yF%?!h_xM%dJ#T+zgV^_vR9*yeosb3<Q$CH3#8Sj52798>=Eco5@%h&3q=f
z5&T>e5~bD5zC{?w@zZE#Xhj+qX-xB`J_nOoe5o5+5O21E<H$7r`@BXTh?nVSjo3vl
zNbzMJZM2u46Gu#on@Ln3`D;kByTISYDW)_<5u%h8;h|Q6Hv@IDkT0OtmYJ{nK^>3M
z!R&sK{5aR>8rl1})gdV&jw$LQd>4MaeX09OCGt=8)er!XMbUIeA3Pk;4pxhz0JiUs
z%Q|*GeK_H^E<c41Zbs3S1*^(DM>cXtflh(^3Vw-PMxsE0-6KFjFiZ!M#1Qw=a98oo
zSE{B$TOel!K=Bcom{O2ZQOIx@b!2k<gzT%Rke~J!)vv5Gn?lbqW;8h-mvo|#^iE1g
zM8MLP6F()h88{7uK5AebCpMs@hR<jNv#jTdl1>4OJ0VsCe}8$<ctE!@%B*>{3GGZ`
zHK(0L{3Y3fX-hylKlIgF8na6mVZ4$!^yBVF6=p@E9C4DTpb=Nm&Qvy{bEX>Myg~v?
zjtE7W)7g)<G-vjo4Ki+VV~w3y6<9`#qXC<HC)4gQ9b0hfEo4|Z`Rf6y|1<W9ZE%Hl
z$yAqv)Op6;cU`p_y^)f@<H6F^i9xFOD};vxov?%|P=0OQrtHYT%mZB|hAKo6el1B9
zLM!j*J)R13GeWiKb4?(x^b<*p{LR+IAk$j8=>r~<3)^*RKS{`LQfHNh)Pc*IW|rup
zVj9IUv3OHu_jg#WgVS7@xO(+<DhS6B9n7(x6_%7OCfIu2!KRx>oFg>d1(ud<j>jU_
z-q4#ebw{5#l-&eYmSrM)NhwI$SgO$qu;USAFh?|YPec4KIV^bNPP9XQ3b<v|n?s1K
z`BVs#P^r6Ns0VTjd*jwzE3BF))fXj?7&v;|i*ExF^HqN}(X105A+kMz^%0hR{d-)y
z`#S=7MC{`CI)-bQAm1JVWT8!<f9}CZ>yKMhnNBu_;}o<$F;8+9na7{8w%R9R={`Y_
zQ8U_phnaC3q4|)ZV}EswEf8Bc({+PZJRkqd?8GIJ*RE|Ce!Yf9whF`vgsOkt+lUJT
zI`#3e$tk6;3DI6so2e%#ReT7s==ysV^aPlMd2whS>ViqG-{;3>qh*n+$Jv;POTi@*
zU||2eCS?}p?8Poz1fQWlg1LW%Egn-vkA$LqKn|A?`ej(CjyFlts7BrIEti;3D|%60
zl}kMjTzBD)SPNA%2gRfRM1;8}65z0JN@lGQdzP}Tt`cD<3_+PYG*TM#pln_b!rN;<
zQcd=z<m06hwQCj9hLNQ}Wk@D2oVBl_Xx0^Kt@bO6R0y0&@nAcf>kN1ySdA%wrL%DP
z;CcMnwt;DwQxk;>i{S~S>l~b6wwFR`aukgw2X}F^mWZRNphmbrWD=$uz-)HQs@79X
z>HE+`2_f3Xjv)p~re<ZylNTwH?)RmoJHq#iOpp#xeB3y|Vu*vJoP3~$J|5Pieruuj
zC=5QAFI|}m;)M4A@O@QUY5ZUW0MUI5mq1y8VesxU1!qeY(HWf|N4V(t&YhC%px{1)
z_{6tG4Ak>@Kk-9)>#idJT#gfT#XNxb<1ph%1@0cS9|;bV_n?OYfP5^9YYYro#v?#Y
zS7^=0u6&%ll}f}&WY4V|-JkMbjhR1?SoKG3R9DP@pv*;j%}1@LBZ|nV#Oxf`{G~U$
z%{mJ}1!+9bpPa(Rp?sf4tMVEDZe@u%xk247Wpa14;JG#l`Z?~Q;<U>8{LBdcdqDM?
zY$o$MP;n+&O^TpYhre(oa}I)-d3k4TZa5UiiY^&c(vV?z=LRKl(wfm;ENPGw9`2))
z3Xg8X-k<*bxn?pO#2DRIe-8@wLM}IJ<){jVmJokLei;|TV>xNTZYnPqk&mvEF`IWn
zVJN&%GjAYyiUrkWA5!wav}iD-;^6+-RFAK{7E6>0f5^#fx66_X-61dAgi1kP>s2wk
zoB-iKWSGGlquATsV?gQs*;%vHml2|05%TFOLSYDGTA8cc{3A^|Ir7egFC&E1Kyi%R
zg!c2=o?g3&&;6a4eDduCXG*LON<Hr&w1M#8Q^V@Zy#BK4=jsrSE1Jxkq{ejSL~IgF
z%*B>z^iRz<1S*PCF;`@kLi3kjx8`y*>yRcmAXXZlxa1og2rY0Uk#8*pb)x~1xvdRu
zl#~^*!%_NU_yG%xU;WGKl?#V}L8a2S9)1nyPi>{nFT6S0LZ$%>9P|-3@RgLm$kv?)
zJHP-HG_=8sXcfQ&6{r|_lhk&z%<_+4zB#U(A?BG7tJ20k8q{>)jA2;?ue-PblMqd|
zV)ZYSWpLzv-K*mmmBx~u!V;Tbfqmt8Kmwe;$Lwg8*iZhoCZOIQ#f(oTxnMF}X=Dlw
zXKg_wJ{opCSII<tH)Y9g|1q!y({k(MM+wbyItOW1ioNANgs-ao&^+L^w9zLNk9ToN
zYM%866ptj%N{>h*J=-WdlEBTKz!uOAKSdJ^Fhu1$AVWzr`*+_fn0yR}EL(hLL>q;x
z;HTVHW9v^YjNxil1l~Sa{3H%d0#ZsX7^~(Vk0FBFk)Jrsin_Bbix|eEPI#GajZW@c
zq}tOsRy`rRoYTLWN>bVb*yk=D2UiCj0}lrGK<g8H9#GNqab%~?o_@`2ibKXBo{iGW
z0s)k_pgJqlGaSjptRnA|%=tH@A-Za3<rO`X*mX~AVye&ss8cmf_+=kMG`TapykWPk
z{H*i4M|m&)h?wb2p{(C7=P2Bf@MNX!s{*jVcm?eK%6`NSACMbi*@YIslRuNDzojqH
z>D_uzah3DrF%gCptiOb=7)WPEz?TW{EcDMCe+cOP0n&9*+q0DN*OHu$p=Y6;rzGYP
z3>|{9#H_d|>%49&T#;H_hDRp;#~~%@qe>*rtZ9+RFA$uc&_>T!j4bZ=UMt_Ytb9Uy
zJo;an*i6Z3)wRL;`<*HgR|88<CM+(b$biUkexkhn-F-$9gfA;h(r(sYoKtiE&E-*z
zvT0@{BU8{pb0_N{GQVNlgZCjV%_>$X^iY_JuUtTOW}|kxVNr3TFd^V50TLo{>d7bI
zj(>lON#sy`bWP+6bJnN;CK;Y=BpjP|c8gH_>I^g*C<2i(J#b$!!54N|@mr#sVfO3_
z=k~AkTm3qxBY(3;-rXLDk#YF*8hhGy%+(K$WJt(k!#|@0hjk|Gb~#Z5pQ@&U3kRfJ
zR&*-}j51HK?CBuMs-=Vt)NXza=dvS}Z1?*#O~4iCW&Imor4W-YfC7YnR(8!}01io#
zVy+Yql#X(@V!G@qCiLmj(Q?pq(n_Rwq0`XCp7BFUluNeG>N_^p#p#Q36qv`8<Y1<s
zCG9m<@6RqE;8bEZk~we!3UNyzcmU*oYZu0sti^U6RTz7#D)9Nrq$WMBwaxotDEk45
z?<&>`qBj{>KQI=|s^~I_rrK4Vkc`TLa<|i(T2c^+6-AXR;E@>Fi>@U4;k)KO?m7zz
zdh5jeHlfE!5;d_P>6=d4kt(avGk*(Tgvp`N)~eK38_g+hsZ=h<jfm=r&{OY~8=~T9
z%gC?C1~Bn)(kb5)Tu{7CF5rjrQWqF_2Hs^~M$>anV$psQGY+`;Rjnh77dP513~!J0
z<YWhoqE#r{{vC!^Ns?#$g%jc^aLWj!&SC|>r@87)IL}uKp{g{ZtT1J=!hWZ9<9rN4
zWs{a>q|C)ed13la6jk0Nn7@4{qlP|`KFO>11jciTkQx6cM<PmssI?1x!<^Y9c*d^f
zRbFqqL_051OZJ#^Zs<IIK!Seg?pzQMjZoz99>;)%HbK1=t(l@?i{%zt45w(4rsT!x
z#JbM1DC!{9-^|!6puP*#EYMCZfip3xG>X<UPo_L&Ls}l4-sT`Yk!bG#xocLXcckDV
zKj%D<<2rLy8xZrG@>r+zc*Z<^1@u^$==FyT1Rpa6>NeJFFuX&Ut^kcE0(@~wmU7W!
z21c|_x@o0Xg2W{z%yD^5VOXrT7T^U{tsfDcxNizV^bJNvy;v_<fQ^O6H7pz3gq3a@
z??*|Eh2@Ejvhl%`<w69L#6kvkbPz5au7H&+ChB@)wB<N5u`k(Ogi4bm7jB>|z^)I=
zyLdm1_n@J}6e5$QR`(e$oo1oC*sj`)Y;W_)`?1rZXwaez`Z?_^<=y1M;A(GAM6IAT
zM~0#AjO`OkBb5w4D4qXibb^uch)>7@yDC~>9vCvDAaC$C<*<{c$G9?D4XQ7%F94mp
zwxK#>{@2diEUtHpq9*@w2VR-qxkf|91ia1Ch7wc^{<2cOZLgt5OBNkJL6eG<ghW3@
zdy9gea7kHf@GRzQev4^ydy+U^n8l$k0-Uo*65hv{FWE)>77^@0yNQ|mjto^O$Tcfc
zZG+jUoC(I_Sh+cl=q)X!dH^`27=Ku-3rL3l&R8C{5=k5Z7pmQVM7D`OXm371r*<40
zs+B^>6mL1XK4S?)B91r^qZVK&wG+!V4x6g>?Py4l+^D5O++Je3;>`<gU#%BA+^_c4
z-)yoI;OZ+}2h~ebdjsx}+sxyPBzzgVozPk{bRJeWh6@A*ZPpm_Rzlg#Z@<t1>=gl%
z(JEO{h+Bm%&*34yB8v5lKBdg=XDWnEH!CvbMI9NotRsWjqAoTZ1c*A;Q^_2vm?<&k
z3`|D^IiXWNZJcSAa%&(UTc`w8&ImK<nb(X%+>+K|teMod<*aG{L+xQ|uViu~dxr60
zK^#ea$@HX4o?VVkdd0?rlNGQIfwfIBsnguZv*0|?y!2U_bM;xc1=+P60Xb7bV<|b5
zB?_gh5&Mj)J@{J$J~oS|ZtQYv?6*alA{r^1_Sqxh=kFUeHXpoa3ql=Z6)uH1<_5<N
znL@*{?XE5h!qotJaTA+0Kt>H_>X`Sq8bQ%=p+k2EJlf&Jn4DEIpf==I1{-zT-u2-|
zFqx|Ijw*P$ynsmi%)+WO=&IeB?RjC$>%!eRN5Cxn#tVoq;Sg~ZoNh|62O-Ejrt*>f
zQ(Gz{a|*=&C-bkME?N``mr%xoz@N;oj-&eVr%`oCX(}ih&0107P({nrcyooQ0xjK!
z_P7eu1c3n3;FF4SS%=}Hp_h{6YiC5u9ufB=ofPNl$|()`oz@Exox%qY#t1bo@3~!^
z(;&UfH@-=}#f)Lb@brlF#$m{SX-MN(NCc~Z;aHn6MNGIX=Y#Ce+U~A5JZY&f1L5WZ
zK~N(RG;7w<$X*d00O}o-lFff*txj}J9^*CLsX0M5V!1-%-Y6L4<^WDw>Tb|zi@_&R
z_r=z%P?Js^DL(ol*!W9WN>XXwsCNsdssrXJ7gD2ZDK^y%`$r@6MC6AXWL5$he6fXC
z=C(-}bH>b~ToOiA*`I1*dWm!JG(ghuCxTC|(#mKi120Th!gyPqilVKR=&r^Vf7Yxk
zQPv}Ko>{k0xNlN5{Y53I)_sx;fpMbLS1>mfqVPjD6;a^z5ha&466rvtX$dozM5!xi
zF?#6mS?j7x#?jWhpU0~8UzA}yNWb`H%w}u_+3cKr6!F}+%#lw08O)VA7>FK7N(D=e
zh~I~6M6Sx`Uaq(a2!w`o)O}Hfa;0pWTdgCKYi4*?m7z{v1;S5dM7%qGoi}99rOq0J
zwecLP-sc&_<A<O1qwWy6lm~IAa#LcdI3O&Cgf6gUr`SoVL9n>R2RGmYjK0^8zriM2
zrNe<y6LD`k@x!~tjD11@u-uFeNz~oQ$R;Yi*&C2Hqv8lP{!gA5rH%nOL-!aQrHUfk
zp&qIpx|wD9y(X}VC;_R-x>UXi%jNmBa%THGJ-kR)h`5BheB-T;B$>`H+}grD|5b3_
zW`}l|`hWm;gjYm%M=|PwH=J{$&WW)?m|6Q`ZE!)4?c8+bgK$zn({KSgPL(Xv^R&IM
zJqkaZF%~cx>`~gG@}p}fUXLB$#uXcxa!R`w;Sdm$dTUCcluw?eelaJqpBtjn_IOTF
zbUm6G$p(lCuKEi5@$|lz%2@d=WEpa+jIEbQe){OxNQati{KL|y{~C1(@j*`wgt_|z
z*#r=3pgB&)%lICmEgw<N)`0U(#$6-6ev!s*HZ103HGQnWy<SjFr9A{?!=~iu`Q}mQ
zX4zcDX>wvg(N&m*DNDRft<jnja{yOV&^$hoii6rPM=ghOPRu>nhG)DjD*Q~A63pZ&
z{A_J@#QUE)<j~12ETgwccP*fF*PBEheuFMd6&pqa#Zr(%Ep3&;{F{o*Ho0tZM<<Kd
zapA&#4Srh8{q`%k)`<bOPM|z!*iAFxR=Q#&pk2di<<!+wVR<*3Px8;-bdyLiZa(kC
zWW_J*qz&((X}(=92=;G|T4P6FlWt1-b#CxLoFXHqk!gOQPw>5<Ia@P2wCWHg04B`(
zqD3inS~L>OI|N&~lTiB*Hp(E<Cr?+bjKVlwZF=FfaHFXa6(nw;hf;jXy(0f<c?D;A
zvzb2XP{RoawbvtuCN|4pOd!22D&>An0v3=I+l=kGGkdI%Ovu4c9IS^@l*}Qr^$z4)
zQD|%e7p#q&>*o9nlMr^RnH;1H4;|=nfew@YMVN>FA}5JL!1@eeLUmtC&KX%V=ISI&
zUn7U0AHLM;V>JkHv~&rML9T~D0KpWiTaYcLg|t3-?$|XWWY?20KQ>lO6&>TbEI2tX
z>d_aM8Ihwi7z52pN`99Ks2qdHKfyvC!yE<{;2eNT0W?a4apz0S%6Kow;<>4-cW6)b
z=S2(~n<`#|L#$Y^NEqSRR=GJB{jHmLvUr66tzoyMo|AC9pU$t5wa1F3H4Q6ZgZq8%
znc1k+_VhvBjzgAuM*V1IH}#(fJg3E5p^#Bn@^B>vhA67Eb8!FtcxsY68HH^?T@??R
zOf|VW<m=1dR$HB4q@*5wTZ;1cA^729h2Z4CulA8=8dV1k2$XxUZ9WX?-vA%e4ociN
zNJf0W0*-?R<tDDi>_EYSl?&UiQ#cM{9|_PF3T51b!o3%E&J=a%z4syKo3?cpW4O+-
zy%0|`a2EkyD!!Td$GM?+owjN$B6X4*4yxm?9t^GHq0|Fs3&Hg@1}^#QvE2!#C>o<I
zPZ*FK+p63JsLPQ{B4z2alY-Nu%8>1df=mXZ@ce+MNi=yos@6%^o-R)2m6PSB<36?$
z$ePX!9rug+YxI}{5ts<X39SW#7{=KUkGOm=1fkupve*y*6x>u2vLI>=%tF@UbX@=a
zo(_?a`J{|nx};$DfM>q1F!&WvSmJht-vKxv;|4n#jK;U-M<XL-OIK(i3c7(&*FuJb
z^kX~<Yu?68eVn!x@E41@cza=0W*fysE%+G342TR@1)p#&T(e16$F|aBEZZFJ=YM7l
zVP#&C*tV|6AUmvXBMC9^nrlr{1KTnL9Y*jLE=x+a!x(9$yqKcHvYleX984r%kH3g+
z&^D)xI2`bf`pApa`nHy!I?gsDv|dU6qj@34z&rq9`jh|0T&Y^=Fk${Y=M<WWMG$Ul
zr~gEioHYAo^5GGsA2UlNf!|cOS$TbM(LAl6D3$})!FHid3`n9?7ztO)%;)0d3+lwL
zw@N<i-4k-5Pqf?XJB*Cx_EeU^3QNj97LSjg9TD!=<BuH{ccq1!gTuhgm@`LgZ<cl5
z)^ui3P9q?Wzk*ITnoWP$>nQKTg{N3e?aRO1@rg;S0&UX%v6ssI@0sX|)p64T%O$TU
z)vw&|)>qJ63Q<C|T-9pvhjh%O(?RvFNrlziT}6a)M;AGj8L!NO_GSsybQ6pV&)h<!
z&O(W9I<jPK5rX<{4!z==mC}D+Ws_7b_<5tq^HAQT{Ax(q=!_Yb1-(YhM7+|Xw4pI!
ztiiHmR&dwFJxQWxvA}7a5<|dRb0Uiq^K~_@<(c%1CX#1$W*BofT2A6#E#llou^*W;
zptv|`z%9g@xy>1bvaKQVka^P4AJ-CfR07JdFy9D;vs5Yk!M7mX?A{D7EU8exNiE(n
z#1L17k3q52ne1cP?7*5%hsM0ux>bcV+yOF5P0s&!t6~ieD|gI#;COUnpTe{@xC2*b
zaK?Dz*+&i!k0F`BTK;cL0t<V@WV!G;>ypcI5|Q&^BxFzw9QoYWn2t}}H9emFVm~b*
z6@qKVrTFRz8G_&6P;`OrN>_;j&){qe0@PyZ@!Atfk%22Bwf>5*gx73YUrPWF^B_yC
zE#Lt(-Df?SyVM4};z`Hi6i)9}>=`lg9t?i4orz^J_^Qz<ZSq{@W>$}Zj$o{JTrCPy
z4rN0hF(8VGEdHcRQ2Byh1Q0&r<36%bHgO+MLRQ&>7>DJvZ0#nqcqdNzz<I+c>MT@q
zJEf*qp>snpwo6Z`FgLi~F<Iwl1bdZi@*8{oc3dfk!~J0j-!uAi66yAO+!5W9bI-3h
zNc469@8TSyg=s8QI;)qa^MYE&&y_|Q)0~mB#;<Y0#$w1U5t@Hm+pl7Ge+i^^p~9=3
zorwb%AT?YcovsQ*F)ee(JW!tX?7#4l*Gi^sxRr}-xD;>4V&e@ZlUW6KPnMR1#yo7)
z8LuSn#76D^0&hY&D`P1%jl7iL{-jkNWwu|$MS##GG9q~pj3&OYs7@9yV&^V~WDM{{
z358CYnhk*Cl~av0`xh+6Lq`hr)bMj|ty=1!dLLmz3q(Qi&sL5uz{xmb+KPf4?yP}j
z2R&*a97v+r+#N<nrO^&yaLeS0%_Q(6{VxzjOvsoI?aaOWg1~^WyevOVvuk2z0*V7Z
zTaC1G5$yWBYnd~qR-*`l`9ZE8-Jnu!776_NYX+KG<c8c>^|p~5O|mUFT_q`hDJFd*
zeFj84&-is$L2&b1F9v@>?)`JW`{}FuEFnRXs2xV}%0R99*~>amj!}N-f=KTsXa6aB
z7&J6|_KM<{EPn~8V<(RY`S$@laG#YVu^q8F{D%>j=CuK~192E3<RG^yz65Uh01qx{
zSnGeSK`GUGnTjla&rt&01WIon>{rP$*~;)@7C#({-e%J`al0!HgqNr%jA53D*x7PE
zYAwbFFl((?pH0{fEFOK+6Qc4(DFocQ1^6(NsAKHJAZg)}Q;?X`%+z|KmI$_1UYG3Y
zz#vheXmZMG2+xgxDR%{TIjVDnkP0-O%+WDTcd2~?m?!n>Xp85Pub4HAExSv}Oh{#X
z&^i)nzwFx}UcY_!NqcGPk7#fKMN0l;m?4GkKT@#b%{tw#6fdseaj!F?UeXdjM{8$=
zeDMGxuJ#dS8NRCT_0>P(LvN(R&-eD5HEEIAIsAkDnNq-Zv8G@h({4&2F(xyB(M4i~
z+@^hgMbqV<@Zb8p#xMt1Liwi`@vOnPRQbVx0@aZ433mVShYH@D<jeYyXb>qi0)VyM
zt_RT?F~Azab)<zU)J&HtLAf(qLm{l*H}m2da%DinF`&KQsp{(<o3!%|w|c$zkkR$z
zWp&H3$U6|FaNJ!Xga7Ftaa_}tH%oLeE6Nu$h_6FS6nrS6cLR+1N5EfG>b9OdN6834
z=SVLxhui1QU#oygOWf{!?8^7n)dz^)mTLM|{|)nhyv!;Uo=h3GNGSKDDt={HB<Oz6
z@0pcpA?<!R|CE6q;8_U*SP;;?GoY4TfEZ7Q{XKL1x?oxvyq~cO4u7~f{)oU@)O(@i
zmb6Lr+o7g7N|dB;mK5eyC21K6;Rc>cYQhk9Vi{4l?`K<SaT=La%s#W*44pQ(WiDh9
zGAb?L*U0&$nLr>m23$O${Z@(e8!5#~7OU;4kr<1O3I`0@77e6PHVeF*Te2H~?b+~V
ztXomco<uYmEFHiWA#zzcPCuZSDU6hfe}+J#>6N4EoFf3LAKY7dS3l>se__kAGUL6z
z60ZJe)Fw3cn575acLx6@7YBoGj>4=VOuMBiNbA#I=auA?bNanqbYzSfBo$h!a730d
zuR<WQbz}eO$6$%J9!M8_tzg7p$s^7I?Y{{0?k7I*sz;a&hp`u|MMO>X5LX2_7}V&%
zDKmOF0F|I2ABN)LlamLEN(xvG>H^|$BIV)SD7`5Za{;&+(UYT~<rQT`M+V=h>Tv_X
z1&>pJLzf!hmsKMw;#ABqe0@^A4CGo0oK<mDv1p&LJDx|l@9`42Ff|p|Ylg^&?DykX
zp6%ZJNl_~hz$14AGgvN)Nxqv9C&l87v9VtL2DoCqM>y6?>8>?O)QM@8{7n;D0CKD#
z`1>^TJ4)wkC4cDsK1ig=zx63hj0;95RxOHg%Btxk+<>`j@Wn9{o%Xw{kA~+ejS%Xg
z#yVpa_Cjj<4=IypgB@rYFZbWDw+~fzml4d%nHnc3qZegU3hNfLo#9Kpq}3nF7g2S7
zFH&YSiBpu$)E1yl0hNQn)IU-W`wI6B%|Mz^S=DL4%2D-SU*c5om@1!zBL^gh0<(9g
z9?p(+j@M}$J3H5(2UR~#uHk~~TU}Xuw-$M&uLog)xxZh=0Y65LXP$W&h=@;buREHo
zT|GTIdb7LwGdC;Ou)W#OcT*oXAwQ4K0rrmd-)SR1+q;6(_k)L<0Uf%0bhUv;;EawA
zeY^AlU++c&yLvr&dk>hEy+u18;=a6HzFO0Fz+-oR-=5GYcr$iT*HORBAMPJcpG1Ln
zxBc?Pdp85=Yxfjy{03lWe*Jwp`}!z>tZqgqgS`|2_4Eu4`~wv0<!*R&4n9u@4Cv3z
zp4W$FmW??5SL+artbP=qx~AfukFIwPZG_(kEn5WW2x_fiM|b3i`o8_xyI9-u?i?I%
z&oDKVr2Zle-eJ7`HoAd`Uk3){hK53QHIJ5Uyqw_ql3Q}P$#d2I_&j0L1kd`v1O%ZG
z**NUY2~IN-V)V_Gc_p@X{C->4zV`;^i_ctNP8!THLho+uX!;8Fefc|2c(rHk&0=`=
zFP_Zo;A?brV6c2%h(t|^4jxTv(*GT9hX9`mg!K38?FFH@J^lU2n1!Kf5TzOTY}&g$
zjXnoZOs9bZhi$<Ej6<19zhQoeQARaM8gRcZPJa$TYsI0@{xfvmKGuAbOhWJRq&;45
zAtJmbgXpjbf`POKdwTNxGk-Yx6sbUcaegLWmv{GO88P1>e{#+fp!Q{y-2D|TM^+XY
z-H>^Uct>G~6gniIGO&Qbyl$YwUq|m$jOGq^!^N!Y9BzgGoc>%JTVR`f?s>ZM`E&MB
zh%v{_Ffa=4A@?0XcMH#N2T~yD=}p=1cTXSw?Rpz!#a_Az-#EN{+DX5!e}XSSl4Sv=
z;3QVu&QpYE*kcfw*GMCL*}M))>D!ERL%%zHUcdgigSC*{2@levQaE?(4n9;azdM8d
zXoV7pM5em`moH7OZtx*=9vX|qr-cB;ow^rJOsHaw+jmYGrl@VY{)eq@+|0PfQG<Hh
zxhpvt3O5~as|}LRFVP<H%Lq|fo6KJ|7warn)tIWF#Mb&fuqR~&Z=y5R%CI0f7m_sc
z9Ta20hi(q?m5?rN5;7vPDD0?YM~6j1(#k6f@tprX{V4fYdMj?Mli(xnJn`;h7!&F!
zknp5SfmI?Q*_Ho&@xQjR_nKKX4Um1J@Z#NPJ>xxIpUm|X_H)uwCh>wRpG%&pY-ZQ$
zx9nc5k8D{cwl!~tF<`I<UUFF!yZm${Y8Fl~hyD~P&;hkT`6GAuUbOq)R3&lWvA^kW
z0$VL|R$)2Ml93Ucq5qXy{kOmTe(=$}ee37~kh7QX6(Pl6nNIrl2rBBPw7Zt(5JnT6
z);_k(3^{f@1oG1qFX$gWs;%9CPuwoSB%>v{eL7pM;aeMzOS0bmva{+hrmYk~bJ#7l
z$g4ad%Dy|xZt}Ch6&KzFh8{bZHVFuF*r7-^p@4@f1@cFY)s2&mAIj3D9~s_zlorRm
zFZEad`MZ|S#+U*3UzA=>f%fCVr+@jSc*TzAUJ?)DwA{9k|3W#wvs(|!c4N4q=!bb=
ztOa>+TeETreK;`3kdfxFd-Yp{eFiu$>Ny!w`Sr`>N<sxMXV|Tf92<M!{ae!W2W&s~
zEzvX<J=j~jp*qUo7;)k2d?|B@G`uDd->Bi7lYW+|j!9KI5mIJ`COem4uk<?1FtmqD
z+C#*y%l({Q^RjBUTKfFncAlP|Mod=>muHSVdv}kz4516LZQkbHlV&*v(2$XH@qp4C
z<DTYy!9FuP2iK|m=*YGT+(Hr3Y$o+DBWyC<GbD6N4W>WpYRrVBmaxrL{>9SfMQ#0I
z#%?_th+(;5%US<B!M@q_skrmD);Apm37~4qz^-WWeB;#2BRthKRMkACH>}((yLlBW
z_)Qc1`1gHD!oX>9Ue2qP-i7idW#-bq*BxB%dLD&P0BF1LsM4e+0{8(^Ilk}@W3m~W
z4_E;N0%646HDKq0nt81}h?Il5P+mH|O%}3bX01i@&$?OkhQJcqUSqE{m2Z0jjEC>0
zKe3>o%dYhU3gaduom#7bav}%C!P6t9<t@kh_{<(XlF}g%)kl^{-;_UkuCwC$PEOJ;
z<8P~6H=)Q<EFjZKvTTnO%yERLou<Pw@8@IT@oI!Dv3{G}AGO8lR_~#mD}TBkF6<9g
zp3d}W8ip{<<e@&LYIJ!RqKCzNgjsm)F#F_ge&;E6P$JD{l}J{X$IW<t>emdmZp`i(
zJw1Y@v2jWAJ6ffPgsF6SI*wv9=`PujDhy{9M*PKOu`V_=N%?I501NEi&}s(7)1n2l
zmmT_+qq=AZkQs&)@NBz=d>T89iy+VBZI3)z{ASjFclvFoU}ib!E}nb~D#-$a00I3!
ztN#DH^^f$w<p2L);{X2v{=ZlM{|6EHe`2Noi~sN7|LaEpC0THY|8X4TzuEEMdhy@4
w0xBR=Rt{DUV=iV64r6w6W+oO6E>mtMb8}V;Q&vt3b2c^;W)l`xGcKn84J;JNA^-pY

literal 0
HcmV?d00001

diff --git a/tests/zip2bodyfile.rs b/tests/zip2bodyfile.rs
index 58a8dfd..c6389a3 100644
--- a/tests/zip2bodyfile.rs
+++ b/tests/zip2bodyfile.rs
@@ -45,4 +45,61 @@ fn do_test_hello(expected_name: &str, args: impl Iterator<Item = &'static str>)
     assert_eq!(*bfline.get_crtime(), Created::default());
 
     assert!(lines_iterator.next().is_none());
-}
\ No newline at end of file
+}
+
+
+
+#[test]
+fn test_hello2() {
+    do_test_hello2(vec![].into_iter());
+}
+
+
+fn do_test_hello2(args: impl Iterator<Item = &'static str>) {
+    let mut cmd = Command::cargo_bin("zip2bodyfile").unwrap();
+    let mut data_path = PathBuf::from(std::env::var("CARGO_MANIFEST_DIR").unwrap());
+    data_path.push("tests");
+    data_path.push("data");
+    data_path.push("zip2bodyfile");
+    data_path.push("hello2.zip");
+
+    let result = cmd.arg(data_path).args(args).ok();
+    if result.is_err() {
+        println!("{}", result.as_ref().err().unwrap());
+    }
+
+    assert!(result.is_ok());
+
+    let reader = BufReader::new(Cursor::new(result.unwrap().stdout));
+    let mut lines_iterator = reader.lines();
+    let first_line = lines_iterator.next().unwrap().unwrap();
+    
+    /* 
+    * Archive:  ~/dfir-toolkit/tests/data/zip2bodyfile/hello2.zip
+    * c3636a8166a5e10268c90ee3fc37fe44b1b23d80
+    *   Length      Date    Time    Name
+    * ---------  ---------- -----   ----
+    *        0  2024-02-28 20:16   dfir-toolkit-feature-zip2bodyfile/
+    *    35149  2024-02-28 20:16   dfir-toolkit-feature-zip2bodyfile/LICENSE
+    */
+
+    let mut expected_name = String::from("dfir-toolkit-feature-zip2bodyfile/");
+    let mut bfline = Bodyfile3Line::try_from(&first_line[..]).unwrap();
+    
+    assert_eq!(bfline.get_name(), expected_name.as_str());
+    assert_eq!(*bfline.get_size(), 0);
+    // 1709151390 = 2024-02-28 20:16:30
+    // 1709118990 = 2024-02-28 11:16:30
+    assert_eq!(*bfline.get_mtime(), Modified::from(1709151390));
+
+    let second_line = lines_iterator.next().unwrap().unwrap();
+    bfline = Bodyfile3Line::try_from(&second_line[..]).unwrap();
+    expected_name = String::from("dfir-toolkit-feature-zip2bodyfile/LICENSE");
+    assert_eq!(bfline.get_name(), expected_name.as_str());
+    assert_eq!(*bfline.get_size(), 35149);
+    // 1709151390 = 2024-02-28 20:16:30
+    assert_eq!(*bfline.get_mtime(), Modified::from(1709151390));
+
+
+    assert!(lines_iterator.next().is_none());
+}

From e607441db3755f899e4cd7d33f32531c5d3df834 Mon Sep 17 00:00:00 2001
From: Jan Starke <jan.starke@posteo.de>
Date: Wed, 6 Mar 2024 10:48:32 +0100
Subject: [PATCH 10/35] use extended timestamps

---
 .github/workflows/coverage.yml |  2 +-
 Cargo.lock                     |  2 -
 Cargo.toml                     |  3 +-
 src/bin/zip2bodyfile/main.rs   | 81 +++++++++++++++++++++++++++++-----
 tests/zip2bodyfile.rs          | 11 ++---
 5 files changed, 79 insertions(+), 20 deletions(-)

diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 34d1248..e5a7441 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -30,7 +30,7 @@ jobs:
       - id: coverage
         uses: actions-rs/grcov@v0.1
       
-      - uses: codecov/codecov-action@v3
+      - uses: codecov/codecov-action@v4
         with:
           token: ${{secrets.CODECOV_TOKEN}}
           files: ${{ steps.coverage.outputs.report }}
\ No newline at end of file
diff --git a/Cargo.lock b/Cargo.lock
index af6eac3..0b529f7 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3369,8 +3369,6 @@ checksum = "2a0956f1ba7c7909bfb66c2e9e4124ab6f6482560f6628b5aaeba39207c9aad9"
 [[package]]
 name = "zip"
 version = "0.6.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "760394e246e4c28189f19d488c058bf16f564016aefac5d32bb1f3b51d5e9261"
 dependencies = [
  "aes",
  "byteorder",
diff --git a/Cargo.toml b/Cargo.toml
index c42ca16..b83c2a3 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -186,7 +186,8 @@ frnsc-prefetch = {version="0.9", optional=true}
 forensic-rs = {version="0.9.1", optional=true}
 
 # zip2bodyfile
-zip = {version="0.6", optional=true}
+# zip = {version="0.6", optional=true}
+zip = {version="0.6", optional=true, path="../zip"}
 
 [dev-dependencies]
 
diff --git a/src/bin/zip2bodyfile/main.rs b/src/bin/zip2bodyfile/main.rs
index c547984..8ff357e 100644
--- a/src/bin/zip2bodyfile/main.rs
+++ b/src/bin/zip2bodyfile/main.rs
@@ -2,11 +2,12 @@ mod cli;
 
 use std::io::{Read, Seek};
 
+use chrono::FixedOffset;
 use cli::Cli;
 use dfir_toolkit::common::bodyfile::Bodyfile3Line;
 use dfir_toolkit::common::FancyParser;
 use log::{error, warn};
-use zip::ZipArchive;
+use zip::{ExtraField, ZipArchive};
 
 fn main() -> anyhow::Result<()> {
     let cli = Cli::parse_cli();
@@ -33,24 +34,82 @@ fn main() -> anyhow::Result<()> {
 }
 
 trait DisplayZipFile {
-    fn display_zip_file(&mut self, zip_file_name: &str, show_archive_name: bool) -> anyhow::Result<()>;
+    fn display_zip_file(
+        &mut self,
+        zip_file_name: &str,
+        show_archive_name: bool,
+    ) -> anyhow::Result<()>;
 }
 
-impl<R> DisplayZipFile for ZipArchive<R> where R: Read + Seek {
-    fn display_zip_file(&mut self, zip_file_name: &str, show_archive_name: bool) -> anyhow::Result<()> {
+impl<R> DisplayZipFile for ZipArchive<R>
+where
+    R: Read + Seek,
+{
+    fn display_zip_file(
+        &mut self,
+        zip_file_name: &str,
+        show_archive_name: bool,
+    ) -> anyhow::Result<()> {
         for index in 0..self.len() {
             let file = self.by_index(index)?;
 
+            let mut bf_line = Bodyfile3Line::new()
+                .with_size(file.size());
+
+            let mut utc_mtime = None;
+            for field in file.extra_data_fields() {
+                #[allow(irrefutable_let_patterns)]
+                if let ExtraField::ExtendedTimestamp(ts) = field {
+                    if let Some(mtime) = ts.mod_time() {
+                        bf_line = bf_line.with_mtime((*mtime as i64).into());
+                        utc_mtime = Some(*mtime as i64);
+                    }
+                    if let Some(atime) = ts.mod_time() {
+                        bf_line = bf_line.with_atime((*atime as i64).into());
+                    }
+                    if let Some(crtime) = ts.mod_time() {
+                        bf_line = bf_line.with_crtime((*crtime as i64).into());
+                    }
+                    break;
+                }
+            }
+
+            let tz_offset = utc_mtime.and_then(|utc_ts| {
+                let local_ts = file.last_modified().to_time().unwrap().unix_timestamp();
+
+                match i32::try_from(local_ts - utc_ts) {
+                    Err(_) => {
+                        log::warn!("illegal timezone offset: {}, ", local_ts - utc_ts);
+                        None
+                    }
+                    Ok(secs) => match FixedOffset::east_opt(secs) {
+                        None => {
+                            log::warn!("timestamp offset (abs value) is too large: {secs} seconds");
+                            None
+                        }
+                        Some(offset) => Some(offset),
+                    },
+                }
+            });
+
+            let tz_offset_text = match tz_offset {
+                None => "".to_string(),
+                Some(o) => format!(", [offset: {o}]")
+            };
+
+            if utc_mtime.is_none() {
+                log::warn!("no extended timestamp header with modification time found, using the MS-DOS timestamp instead");
+                bf_line =
+                    bf_line.with_mtime(file.last_modified().to_time()?.unix_timestamp().into());
+            }
+
             let name = if show_archive_name {
-                format!("{} (in archive {zip_file_name})", file.name())
+                format!("{} (in archive {zip_file_name}){tz_offset_text}", file.name())
             } else {
-                file.name().to_string()
+                format!("{}{tz_offset_text}", file.name())
             };
-
-            let bf_line = Bodyfile3Line::new()
-                .with_owned_name(name)
-                .with_size(file.size())
-                .with_mtime(file.last_modified().to_time()?.unix_timestamp().into());
+            
+            bf_line = bf_line.with_owned_name(name);
 
             println!("{bf_line}");
         }
diff --git a/tests/zip2bodyfile.rs b/tests/zip2bodyfile.rs
index 58a8dfd..0b1753b 100644
--- a/tests/zip2bodyfile.rs
+++ b/tests/zip2bodyfile.rs
@@ -8,12 +8,12 @@ use dfir_toolkit::common::bodyfile::{Bodyfile3Line, Accessed, Modified, Changed,
 
 #[test]
 fn test_hello() {
-    do_test_hello(r#"hello.txt"#, vec![].into_iter());
+    do_test_hello(r#"hello.txt, [offset: +01:00]"#, vec![].into_iter());
 }
 
 #[test]
 fn test_hello_with_archive_name() {
-    do_test_hello(r#"hello.txt (in archive hello.zip)"#, vec!["--show-archive-name"].into_iter());
+    do_test_hello(r#"hello.txt (in archive hello.zip), [offset: +01:00]"#, vec!["--show-archive-name"].into_iter());
 }
 
 fn do_test_hello(expected_name: &str, args: impl Iterator<Item = &'static str>) {
@@ -36,13 +36,14 @@ fn do_test_hello(expected_name: &str, args: impl Iterator<Item = &'static str>)
     let mut lines_iterator = reader.lines();
     let first_line = lines_iterator.next().unwrap().unwrap();
 
+    println!("{first_line}");
     let bfline = Bodyfile3Line::try_from(&first_line[..]).unwrap();
     assert_eq!(bfline.get_name(), expected_name);
     assert_eq!(*bfline.get_size(), 12);
-    assert_eq!(*bfline.get_atime(), Accessed::default());
-    assert_eq!(*bfline.get_mtime(), Modified::from(1709197630));
+    assert_eq!(*bfline.get_atime(), Accessed::from(1709194030));
+    assert_eq!(*bfline.get_mtime(), Modified::from(1709194030));
     assert_eq!(*bfline.get_ctime(), Changed::default());
-    assert_eq!(*bfline.get_crtime(), Created::default());
+    assert_eq!(*bfline.get_crtime(), Created::from(1709194030));
 
     assert!(lines_iterator.next().is_none());
 }
\ No newline at end of file

From fee8def4651512ca9b663bab613a278017c99add Mon Sep 17 00:00:00 2001
From: Jan Starke <jan.starke@posteo.de>
Date: Wed, 6 Mar 2024 10:58:52 +0100
Subject: [PATCH 11/35] fix timezone issues

---
 tests/zip2bodyfile.rs | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/tests/zip2bodyfile.rs b/tests/zip2bodyfile.rs
index 6774497..64284dd 100644
--- a/tests/zip2bodyfile.rs
+++ b/tests/zip2bodyfile.rs
@@ -87,19 +87,20 @@ fn do_test_hello2(args: impl Iterator<Item = &'static str>) {
     let mut expected_name = String::from("dfir-toolkit-feature-zip2bodyfile/");
     let mut bfline = Bodyfile3Line::try_from(&first_line[..]).unwrap();
     
-    assert_eq!(bfline.get_name(), expected_name.as_str());
+    assert_eq!(bfline.get_name(), &format!("{expected_name}, [offset: -08:00]"));
     assert_eq!(*bfline.get_size(), 0);
     // 1709151390 = 2024-02-28 20:16:30
     // 1709118990 = 2024-02-28 11:16:30
-    assert_eq!(*bfline.get_mtime(), Modified::from(1709151390));
+    // 1709147790 = 2024-02-28 19:16:30
+    assert_eq!(*bfline.get_mtime(), Modified::from(1709147790));
 
     let second_line = lines_iterator.next().unwrap().unwrap();
     bfline = Bodyfile3Line::try_from(&second_line[..]).unwrap();
     expected_name = String::from("dfir-toolkit-feature-zip2bodyfile/LICENSE");
-    assert_eq!(bfline.get_name(), expected_name.as_str());
+    assert_eq!(bfline.get_name(), &format!("{expected_name}, [offset: -08:00]"));
     assert_eq!(*bfline.get_size(), 35149);
     // 1709151390 = 2024-02-28 20:16:30
-    assert_eq!(*bfline.get_mtime(), Modified::from(1709151390));
+    assert_eq!(*bfline.get_mtime(), Modified::from(1709147790));
 
 
     assert!(lines_iterator.next().is_none());

From 0ee26467197efc4a567a007a911b9281d07c302f Mon Sep 17 00:00:00 2001
From: Jan Starke <jan.starke@posteo.de>
Date: Wed, 6 Mar 2024 11:14:40 +0100
Subject: [PATCH 12/35] use git dependency

---
 Cargo.lock | 1 +
 Cargo.toml | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/Cargo.lock b/Cargo.lock
index 0b529f7..8d218ea 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3369,6 +3369,7 @@ checksum = "2a0956f1ba7c7909bfb66c2e9e4124ab6f6482560f6628b5aaeba39207c9aad9"
 [[package]]
 name = "zip"
 version = "0.6.6"
+source = "git+https://github.com/janstarke/zip.git#a03b4e8ff9895f2cf5d4cea470a4e51f271e9929"
 dependencies = [
  "aes",
  "byteorder",
diff --git a/Cargo.toml b/Cargo.toml
index b83c2a3..f996e8a 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -187,7 +187,7 @@ forensic-rs = {version="0.9.1", optional=true}
 
 # zip2bodyfile
 # zip = {version="0.6", optional=true}
-zip = {version="0.6", optional=true, path="../zip"}
+zip = {version="0.6", optional=true, git="https://github.com/janstarke/zip.git"}
 
 [dev-dependencies]
 

From f42d4e0d446dff7ded91c1f9e772a8552f9f6ba1 Mon Sep 17 00:00:00 2001
From: Jan Starke <jan.starke@posteo.de>
Date: Mon, 13 May 2024 11:33:39 +0200
Subject: [PATCH 13/35] use mor recent version of prefetch parser

---
 Cargo.lock | 22 ++++++----------------
 Cargo.toml |  4 ++--
 2 files changed, 8 insertions(+), 18 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 71990b4..421cb42 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -719,7 +719,7 @@ dependencies = [
  "encoding_rs_io",
  "evtx",
  "flate2",
- "forensic-rs 0.11.0",
+ "forensic-rs",
  "frnsc-prefetch",
  "futures",
  "getset",
@@ -1036,19 +1036,9 @@ checksum = "00b0228411908ca8685dba7fc2cdd70ec9990a6e753e89b6ac91a84c40fbaf4b"
 
 [[package]]
 name = "forensic-rs"
-version = "0.9.1"
+version = "0.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e878efbc5ee339c257d8c18b1c8535864bcfb0ec9a4b7c0a6afd3aed718cf20"
-dependencies = [
- "serde",
- "thiserror",
-]
-
-[[package]]
-name = "forensic-rs"
-version = "0.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ccb29be9815a6c5c5ed191acb436097f45edf5bd8a50f572a5a4296a45ee44ff"
+checksum = "6b505c08ffc21e66f9cfca93ebf46f6aef480d806508fd591b7f628eabee45a7"
 dependencies = [
  "serde",
 ]
@@ -1064,12 +1054,12 @@ dependencies = [
 
 [[package]]
 name = "frnsc-prefetch"
-version = "0.9.1"
+version = "0.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8cc48c4295142e32b6b94988a69701557a9810a90a743a8b01a8899746d7ed9"
+checksum = "fbe8c029ad817943d73e5ee4b9df54df4540e93d2ab44e9544976381a685f7de"
 dependencies = [
  "crc32fast",
- "forensic-rs 0.9.1",
+ "forensic-rs",
 ]
 
 [[package]]
diff --git a/Cargo.toml b/Cargo.toml
index 1c3e951..dcf9427 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -176,8 +176,8 @@ lnk = {version="0.5.1", optional=true}
 # pf2bodyfile
 libc = {version="0.2", optional=true}
 num = {version="0", optional=true}
-frnsc-prefetch = {version="0.11", optional=true}
-forensic-rs = {version="0.11", optional=true}
+frnsc-prefetch = {version="0.13", optional=true}
+forensic-rs = {version="0.13", optional=true}
 
 [dev-dependencies]
 

From e450230bb1af630375afb156f57890e6d766fd6e Mon Sep 17 00:00:00 2001
From: Jan Starke <jan.starke@posteo.de>
Date: Wed, 15 May 2024 12:48:38 +0200
Subject: [PATCH 14/35] use generic W: Write+Send to export timeline data

---
 Cargo.lock                                   |   4 +-
 src/bin/mactime2/application.rs              |   4 +-
 src/bin/mactime2/bodyfile/bodyfile_sorter.rs |  22 ++--
 src/bin/mactime2/bodyfile/macb_flags.rs      |  10 ++
 src/bin/mactime2/error.rs                    |   8 ++
 src/bin/mactime2/output/csv_output.rs        | 105 ++++++++++++++-----
 src/bin/mactime2/output/txt_output.rs        |  65 +++++++++---
 src/common/forensics_timestamp.rs            |   9 ++
 tests/mactime2/is_stable_sorting.rs          |  31 ++----
 tests/mactime2/mod.rs                        |   4 +-
 10 files changed, 186 insertions(+), 76 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index a0f5100..541e0d6 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -702,7 +702,7 @@ dependencies = [
 
 [[package]]
 name = "dfir-toolkit"
-version = "0.10.2"
+version = "0.10.3"
 dependencies = [
  "anyhow",
  "assert-json-diff",
@@ -742,7 +742,7 @@ dependencies = [
  "more-asserts",
  "nt_hive2",
  "num",
- "num-derive 0.4.0",
+ "num-derive 0.3.3",
  "num-traits",
  "ouroboros",
  "phf",
diff --git a/src/bin/mactime2/application.rs b/src/bin/mactime2/application.rs
index e4fffcd..753ce37 100644
--- a/src/bin/mactime2/application.rs
+++ b/src/bin/mactime2/application.rs
@@ -62,8 +62,8 @@ impl Mactime2Application {
                 BodyfileSorter::default().with_receiver(decoder.get_receiver(), options);
 
             sorter = sorter.with_output(match self.format {
-                OutputFormat::Csv => Box::new(CsvOutput::new(self.src_zone, self.dst_zone)),
-                OutputFormat::Txt => Box::new(TxtOutput::new(self.src_zone, self.dst_zone)),
+                OutputFormat::Csv => Box::new(CsvOutput::new(std::io::stdout(), self.src_zone, self.dst_zone)),
+                OutputFormat::Txt => Box::new(TxtOutput::new(std::io::stdout(), self.src_zone, self.dst_zone)),
                 _ => panic!("invalid execution path"),
             });
             Box::new(sorter)
diff --git a/src/bin/mactime2/bodyfile/bodyfile_sorter.rs b/src/bin/mactime2/bodyfile/bodyfile_sorter.rs
index d2f7ea6..aff8040 100644
--- a/src/bin/mactime2/bodyfile/bodyfile_sorter.rs
+++ b/src/bin/mactime2/bodyfile/bodyfile_sorter.rs
@@ -1,7 +1,8 @@
-use dfir_toolkit::common::bodyfile::{Bodyfile3Line, BehavesLikeI64};
+use dfir_toolkit::common::bodyfile::{BehavesLikeI64, Bodyfile3Line};
 use std::borrow::Borrow;
 use std::cmp::Ordering;
 use std::collections::{BTreeMap, HashSet};
+use std::io::{Stdout, Write};
 use std::sync::mpsc::Receiver;
 use std::sync::Arc;
 use std::thread::JoinHandle;
@@ -11,18 +12,19 @@ use crate::filter::{Joinable, RunOptions, Runnable, Sorter};
 
 use super::MACBFlags;
 
-pub trait Mactime2Writer: Send {
-    fn write(&self, timestamp: &i64, entry: &ListEntry) {
-        println!("{}", self.fmt(timestamp, entry));
-    }
-    fn fmt(&self, timestamp: &i64, entry: &ListEntry) -> String;
+pub trait Mactime2Writer<W>: Send
+where
+    W: Write + Send
+{
+    fn write_line(&mut self, timestamp: &i64, entry: &ListEntry) -> std::io::Result<()>;
+    fn into_writer(self) -> W;
 }
 
 #[derive(Default)]
 pub struct BodyfileSorter {
     worker: Option<JoinHandle<Result<(), MactimeError>>>,
     receiver: Option<Receiver<Bodyfile3Line>>,
-    output: Option<Box<dyn Mactime2Writer>>,
+    output: Option<Box<dyn Mactime2Writer<Stdout>>>,
 }
 
 #[derive(Debug)]
@@ -105,14 +107,14 @@ impl BodyfileSorter {
         self
     }
 
-    pub fn with_output(mut self, output: Box<dyn Mactime2Writer>) -> Self {
+    pub fn with_output(mut self, output: Box<dyn Mactime2Writer<Stdout>>) -> Self {
         self.output = Some(output);
         self
     }
 
     fn worker(
         decoder: Receiver<Bodyfile3Line>,
-        output: Box<dyn Mactime2Writer>,
+        mut output: Box<dyn Mactime2Writer<Stdout>>,
     ) -> Result<(), MactimeError> {
         let mut entries: BTreeMap<i64, Vec<ListEntry>> = BTreeMap::new();
         let mut names: HashSet<(String, String)> = HashSet::new();
@@ -189,7 +191,7 @@ impl BodyfileSorter {
 
         for (ts, entries_at_ts) in entries.iter() {
             for line in entries_at_ts {
-                output.write(ts, line);
+                output.write_line(ts, line)?;
             }
         }
         Ok(())
diff --git a/src/bin/mactime2/bodyfile/macb_flags.rs b/src/bin/mactime2/bodyfile/macb_flags.rs
index 95a40b3..bd594d6 100644
--- a/src/bin/mactime2/bodyfile/macb_flags.rs
+++ b/src/bin/mactime2/bodyfile/macb_flags.rs
@@ -1,6 +1,7 @@
 use std::fmt;
 
 use bitflags::bitflags;
+use serde::Serialize;
 
 bitflags! {
     #[derive(PartialEq, Debug, Clone, Copy)]
@@ -22,3 +23,12 @@ impl fmt::Display for MACBFlags {
         write!(f, "{}{}{}{}", m, a, c, b)
     }
 }
+
+impl Serialize for MACBFlags {
+    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
+    where
+        S: serde::Serializer,
+    {
+        serializer.serialize_str(&format!("{self}"))
+    }
+}
diff --git a/src/bin/mactime2/error.rs b/src/bin/mactime2/error.rs
index 81834c8..a4685bd 100644
--- a/src/bin/mactime2/error.rs
+++ b/src/bin/mactime2/error.rs
@@ -2,4 +2,12 @@ use thiserror::Error;
 
 #[derive(Error, Debug)]
 pub enum MactimeError {
+    #[error("An IO Error has occurred: {0}")]
+    IoError(std::io::Error)
+}
+
+impl From<std::io::Error> for MactimeError {
+    fn from(value: std::io::Error) -> Self {
+        Self::IoError(value)
+    }
 }
\ No newline at end of file
diff --git a/src/bin/mactime2/output/csv_output.rs b/src/bin/mactime2/output/csv_output.rs
index 7bf74c7..54b8d92 100644
--- a/src/bin/mactime2/output/csv_output.rs
+++ b/src/bin/mactime2/output/csv_output.rs
@@ -1,36 +1,83 @@
+use std::io::Write;
+
 use chrono_tz::Tz;
+use csv::WriterBuilder;
 use dfir_toolkit::common::ForensicsTimestamp;
+use serde::Serialize;
 
-use crate::bodyfile::{ListEntry, Mactime2Writer};
+use crate::bodyfile::{ListEntry, MACBFlags, Mactime2Writer};
 
-pub(crate) struct CsvOutput {
+pub(crate) struct CsvOutput<W>
+where
+    W: Write + Send,
+{
     src_zone: Tz,
     dst_zone: Tz,
+    writer: csv::Writer<W>,
 }
 
-impl CsvOutput {
-    pub fn new(src_zone: Tz, dst_zone: Tz) -> Self {
-        Self { src_zone, dst_zone }
+pub const CSV_DELIMITER: u8 = b',';
+
+impl<W> CsvOutput<W>
+where
+    W: Write + Send,
+{
+    pub fn new(writer: W, src_zone: Tz, dst_zone: Tz) -> Self {
+        Self {
+            src_zone,
+            dst_zone,
+            writer: WriterBuilder::new()
+                .delimiter(CSV_DELIMITER)
+                .has_headers(false)
+                .from_writer(writer),
+        }
+    }
+    #[allow(dead_code)]
+    pub fn with_writer(mut self, writer: W) -> Self
+    where
+        W: Write + Send + 'static,
+    {
+        self.writer = WriterBuilder::new().from_writer(writer);
+        self
     }
 }
 
-impl Mactime2Writer for CsvOutput {
-    fn fmt(&self, timestamp: &i64, entry: &ListEntry) -> String {
-        let timestamp = ForensicsTimestamp::new(*timestamp, self.src_zone, self.dst_zone);
-        format!(
-            "{},{},{},{},{},{},{},\"{}\"",
-            timestamp,
-            entry.line.get_size(),
-            entry.flags,
-            entry.line.get_mode_as_string(),
-            entry.line.get_uid(),
-            entry.line.get_gid(),
-            entry.line.get_inode(),
-            entry.line.get_name()
-        )
+impl<W> Mactime2Writer<W> for CsvOutput<W>
+where
+    W: Write + Send,
+{
+    fn write_line(&mut self, timestamp: &i64, entry: &ListEntry) -> std::io::Result<()> {
+        let csv_line = CsvLine {
+            timestamp: ForensicsTimestamp::new(*timestamp, self.src_zone, self.dst_zone),
+            size: entry.line.get_size(),
+            flags: entry.flags,
+            mode: entry.line.get_mode_as_string(),
+            uid: entry.line.get_uid(),
+            gid: entry.line.get_gid(),
+            inode: entry.line.get_inode(),
+            name: entry.line.get_name(),
+        };
+        self.writer.serialize(csv_line)?;
+        Ok(())
+    }
+
+    fn into_writer(self) -> W {
+        self.writer.into_inner().unwrap()
     }
 }
 
+#[derive(Serialize)]
+struct CsvLine<'e> {
+    timestamp: ForensicsTimestamp,
+    size: &'e u64,
+    flags: MACBFlags,
+    mode: &'e str,
+    uid: &'e u64,
+    gid: &'e u64,
+    inode: &'e str,
+    name: &'e str,
+}
+
 #[cfg(test)]
 mod tests {
     use crate::bodyfile::ListEntry;
@@ -42,6 +89,9 @@ mod tests {
     use chrono_tz::Tz;
     use chrono_tz::TZ_VARIANTS;
     use dfir_toolkit::common::bodyfile::Bodyfile3Line;
+    use std::io::BufRead;
+    use std::io::BufReader;
+    use std::io::Cursor;
     use std::sync::Arc;
 
     fn random_tz() -> Tz {
@@ -52,7 +102,6 @@ mod tests {
     #[allow(non_snake_case)]
     #[test]
     fn test_correct_ts_UTC() {
-        let output = CsvOutput::new(Tz::UTC, Tz::UTC);
         for _ in 1..10 {
             let unix_ts = rand::random::<u32>() as i64;
             let bf_line = Bodyfile3Line::new().with_crtime(unix_ts.into());
@@ -61,7 +110,11 @@ mod tests {
                 line: Arc::new(bf_line),
             };
 
-            let out_line = output.fmt(&unix_ts, &entry);
+            let mut output = CsvOutput::new(Cursor::new(vec![]), Tz::UTC, Tz::UTC);
+            output.write_line(&unix_ts, &entry).unwrap();
+            let mut output = BufReader::new(Cursor::new(output.into_writer().into_inner())).lines();
+            let out_line = output.next().unwrap().unwrap();
+
             let out_ts = out_line.split(',').next().unwrap();
             let rfc3339 = DateTime::parse_from_rfc3339(out_ts).expect(out_ts);
             assert_eq!(
@@ -80,7 +133,6 @@ mod tests {
     fn test_correct_ts_random_tz() -> Result<(), String> {
         for _ in 1..100 {
             let tz = random_tz();
-            let output = CsvOutput::new(tz, tz);
             let unix_ts = rand::random::<u32>() as i64;
             let bf_line = Bodyfile3Line::new().with_crtime(unix_ts.into());
             let entry = ListEntry {
@@ -88,8 +140,13 @@ mod tests {
                 line: Arc::new(bf_line),
             };
 
-            let out_line = output.fmt(&unix_ts, &entry);
-            let out_ts = out_line.split(',').next().unwrap();
+            let mut output = CsvOutput::new(Cursor::new(vec![]), tz, tz);
+            let delimiter: char = crate::output::CSV_DELIMITER.into();
+            output.write_line(&unix_ts, &entry).unwrap();
+            let mut output = BufReader::new(Cursor::new(output.into_writer().into_inner())).lines();
+            let out_line = output.next().unwrap().unwrap();
+
+            let out_ts = out_line.split(delimiter).next().unwrap();
             let rfc3339 = match DateTime::parse_from_rfc3339(out_ts) {
                 Ok(ts) => ts,
                 Err(e) => return Err(format!("error while parsing '{}': {}", out_ts, e)),
diff --git a/src/bin/mactime2/output/txt_output.rs b/src/bin/mactime2/output/txt_output.rs
index 97330eb..3f63cca 100644
--- a/src/bin/mactime2/output/txt_output.rs
+++ b/src/bin/mactime2/output/txt_output.rs
@@ -1,29 +1,49 @@
 use chrono_tz::Tz;
 use dfir_toolkit::common::ForensicsTimestamp;
-use std::cell::RefCell;
+use std::{cell::RefCell, io::Write};
 
 use crate::bodyfile::{ListEntry, Mactime2Writer};
 
-pub struct TxtOutput {
+pub struct TxtOutput<W>
+where
+    W: Write + Send,
+{
     src_zone: Tz,
     dst_zone: Tz,
     last_ts: (RefCell<i64>, RefCell<String>),
     empty_ts: RefCell<String>,
+    writer: W,
 }
 
-impl TxtOutput {
-    pub fn new(src_zone: Tz, dst_zone: Tz) -> Self {
+impl<W> TxtOutput<W>
+where
+    W: Write + Send,
+{
+    pub fn new(writer: W, src_zone: Tz, dst_zone: Tz) -> Self {
         Self {
             src_zone,
             dst_zone,
             last_ts: (RefCell::new(i64::MIN), RefCell::new("".to_owned())),
             empty_ts: RefCell::new("                         ".to_owned()),
+            writer,
         }
     }
+
+    #[allow(dead_code)]
+    pub fn with_writer(mut self, writer: W) -> Self
+    where
+        W: Write + Send + 'static,
+    {
+        self.writer = writer;
+        self
+    }
 }
 
-impl Mactime2Writer for TxtOutput {
-    fn fmt(&self, timestamp: &i64, entry: &ListEntry) -> String {
+impl<W> Mactime2Writer<W> for TxtOutput<W>
+where
+    W: Write + Send,
+{
+    fn write_line(&mut self, timestamp: &i64, entry: &ListEntry) -> std::io::Result<()> {
         let ts = if *timestamp != *self.last_ts.0.borrow() {
             *self.last_ts.1.borrow_mut() =
                 ForensicsTimestamp::new(*timestamp, self.src_zone, self.dst_zone).to_string();
@@ -32,7 +52,8 @@ impl Mactime2Writer for TxtOutput {
         } else {
             self.empty_ts.borrow()
         };
-        format!(
+        writeln!(
+            &mut self.writer,
             "{} {:>8} {} {:<12} {:<7} {:<7} {} {}",
             ts,
             entry.line.get_size(),
@@ -44,17 +65,23 @@ impl Mactime2Writer for TxtOutput {
             entry.line.get_name()
         )
     }
+
+    fn into_writer(self) -> W {
+        self.writer
+    }
 }
 
 #[cfg(test)]
 mod tests {
     use super::TxtOutput;
-    use crate::bodyfile::{ListEntry, MACBFlags, Mactime2Writer};
+    use crate::bodyfile::Mactime2Writer;
+    use crate::bodyfile::{ListEntry, MACBFlags};
     use chrono::DateTime;
     use chrono_tz::Tz;
     use chrono_tz::TZ_VARIANTS;
     use dfir_toolkit::common::bodyfile::Bodyfile3Line;
     use dfir_toolkit::common::bodyfile::Created;
+    use std::io::{BufRead, BufReader, Cursor};
     use std::sync::Arc;
 
     fn random_tz() -> Tz {
@@ -65,7 +92,6 @@ mod tests {
     #[allow(non_snake_case)]
     #[test]
     fn test_correct_ts_UTC() {
-        let output = TxtOutput::new(Tz::UTC, Tz::UTC);
         for _ in 1..10 {
             let unix_ts = rand::random::<u32>() as i64;
             let bf_line = Bodyfile3Line::new().with_crtime(Created::from(unix_ts));
@@ -74,8 +100,13 @@ mod tests {
                 line: Arc::new(bf_line),
             };
 
-            let out_line = output.fmt(&unix_ts, &entry);
-            let out_line2 = output.fmt(&unix_ts, &entry);
+            let mut output = TxtOutput::new(Cursor::new(vec![]), Tz::UTC, Tz::UTC);
+            output.write_line(&unix_ts, &entry).unwrap();
+            output.write_line(&unix_ts, &entry).unwrap();
+            let mut output = BufReader::new(Cursor::new(output.into_writer().into_inner())).lines();
+
+            let out_line = output.next().unwrap().unwrap();
+            let out_line2 = output.next().unwrap().unwrap();
             assert!(out_line2.starts_with(' '));
 
             let out_ts = out_line.split(' ').next().unwrap();
@@ -83,7 +114,7 @@ mod tests {
             assert_eq!(
                 unix_ts,
                 rfc3339.timestamp(),
-                "Timestamp {} converted to '{}' and back to {}",
+                "Timestamp {} converted to '{}' and back to {}",
                 unix_ts,
                 out_ts,
                 rfc3339.timestamp()
@@ -96,7 +127,6 @@ mod tests {
     fn test_correct_ts_random_tz() -> Result<(), String> {
         for _ in 1..100 {
             let tz = random_tz();
-            let output = TxtOutput::new(tz, tz);
             let unix_ts = rand::random::<u32>() as i64;
             let bf_line = Bodyfile3Line::new().with_crtime(Created::from(unix_ts));
             let entry = ListEntry {
@@ -104,8 +134,13 @@ mod tests {
                 line: Arc::new(bf_line),
             };
 
-            let out_line = output.fmt(&unix_ts, &entry);
-            let out_line2 = output.fmt(&unix_ts, &entry);
+            let mut output = TxtOutput::new(Cursor::new(vec![]), tz, tz);
+            output.write_line(&unix_ts, &entry).unwrap();
+            output.write_line(&unix_ts, &entry).unwrap();
+            let mut output = BufReader::new(Cursor::new(output.into_writer().into_inner())).lines();
+
+            let out_line = output.next().unwrap().unwrap();
+            let out_line2 = output.next().unwrap().unwrap();
             assert!(out_line2.starts_with(' '));
 
             let out_ts = out_line.split(' ').next().unwrap();
diff --git a/src/common/forensics_timestamp.rs b/src/common/forensics_timestamp.rs
index 6027faa..11e7798 100644
--- a/src/common/forensics_timestamp.rs
+++ b/src/common/forensics_timestamp.rs
@@ -5,6 +5,7 @@ use chrono::offset::TimeZone;
 use chrono::{DateTime, FixedOffset, LocalResult, NaiveDateTime};
 use chrono_tz::Tz;
 use lazy_static::lazy_static;
+use serde::Serialize;
 
 lazy_static! {
     static ref TIMESTAMP_FORMAT: Option<String> = {
@@ -84,3 +85,11 @@ impl Display for ForensicsTimestamp {
         }
     }
 }
+
+impl Serialize for ForensicsTimestamp {
+    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
+    where
+        S: serde::Serializer {
+        serializer.serialize_str(&format!("{self}"))
+    }
+}
diff --git a/tests/mactime2/is_stable_sorting.rs b/tests/mactime2/is_stable_sorting.rs
index 740f096..c83b47e 100644
--- a/tests/mactime2/is_stable_sorting.rs
+++ b/tests/mactime2/is_stable_sorting.rs
@@ -1,6 +1,5 @@
-use std::io::{BufReader, Cursor, BufRead};
-use lazy_regex::regex;
 use assert_cmd::Command;
+use std::io::{BufReader, Cursor};
 
 /// tests if the result of `mactime2` is a stable sort, i.e. if pos(a)<=pos(b) then sorted_pos(a) <= sorted_pos(b)
 #[test]
@@ -20,25 +19,13 @@ fn is_stable_sorted() {
         .ok();
     assert!(result.is_ok());
 
-    let reader = BufReader::new(Cursor::new(result.unwrap().stdout));
-    let lines: Vec<_> = reader
-        .lines()
-        .map_while(Result::ok)
-        .map(name_of)
+    let mut reader = csv::ReaderBuilder::new()
+        .has_headers(false)
+        .from_reader(BufReader::new(Cursor::new(result.unwrap().stdout)));
+    let names: Vec<_> = reader
+        .records()
+        .filter_map(Result::ok)
+        .map(|record| record.get(7).unwrap().to_owned())
         .collect();
-    assert_eq!(lines.len(), 3);
-    assert_eq!(lines[0].as_ref().unwrap(), "a");
-    assert_eq!(lines[1].as_ref().unwrap(), "b");
-    assert_eq!(lines[2].as_ref().unwrap(), "c");
+    assert_eq!(names, vec!["a", "b", "c"]);
 }
-
-fn name_of(line: String) -> Option<String> {
-    let re = regex!(r#""(?P<name>[^"]*)""#);
-    let result = re.captures_iter(&line);
-    for c in result {
-        if let Some(name) = c.name("name") {
-            return Some(name.as_str().to_owned())
-        }
-    }
-    None
-}
\ No newline at end of file
diff --git a/tests/mactime2/mod.rs b/tests/mactime2/mod.rs
index 8a5875e..007535d 100644
--- a/tests/mactime2/mod.rs
+++ b/tests/mactime2/mod.rs
@@ -1,4 +1,6 @@
 mod help;
 mod autocomplete;
 mod is_sorted;
-mod is_stable_sorting;
\ No newline at end of file
+mod is_stable_sorting;
+
+mod csv_output;
\ No newline at end of file

From 8b7d7efc78c9d6a069849d20e1259abb5daa61bb Mon Sep 17 00:00:00 2001
From: Jan Starke <jan.starke@posteo.de>
Date: Wed, 15 May 2024 12:57:37 +0200
Subject: [PATCH 15/35] use the csv crate to print csv

---
 Cargo.lock                            |  2 +-
 Cargo.toml                            |  2 +-
 tests/data/mactime2/csv_test.bodyfile |  1 +
 tests/mactime2/csv_output.rs          | 27 +++++++++++++++++++++++++++
 4 files changed, 30 insertions(+), 2 deletions(-)
 create mode 100644 tests/data/mactime2/csv_test.bodyfile
 create mode 100644 tests/mactime2/csv_output.rs

diff --git a/Cargo.lock b/Cargo.lock
index 541e0d6..f9410f0 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -702,7 +702,7 @@ dependencies = [
 
 [[package]]
 name = "dfir-toolkit"
-version = "0.10.3"
+version = "0.10.4"
 dependencies = [
  "anyhow",
  "assert-json-diff",
diff --git a/Cargo.toml b/Cargo.toml
index b0540bf..e4be1bf 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "dfir-toolkit"
-version = "0.10.3"
+version = "0.10.4"
 edition = "2021"
 authors = ["Jan Starke <jan.starke@posteo.de>", "Deborah Mahn <deborah.mahn@dfir-dd.de>"]
 description = "CLI tools for digital forensics and incident response"
diff --git a/tests/data/mactime2/csv_test.bodyfile b/tests/data/mactime2/csv_test.bodyfile
new file mode 100644
index 0000000..cee425d
--- /dev/null
+++ b/tests/data/mactime2/csv_test.bodyfile
@@ -0,0 +1 @@
+0|{"activity_id":null,"channel_name":"Microsoft-Windows-WER-PayloadHealth/Operational","computer":"WIN-J56D9ENVG6H","custom_data":{"EventData":{"#attributes":{"Name":"WER_PAYLOAD_HEALTH_FAIL"},"BytesUploaded":0,"HttpExchangeResult":2147954402,"PayloadSize":4569,"Protocol":"Watson","RequestStatusCode":0,"ServerName":"umwatson.events.data.microsoft.com","Stage":"s1event","TransportHr":2147954402,"UploadDuration":21094}},"event_id":2,"event_record_id":1,"level":4,"provider_name":"Microsoft-Windows-WER-PayloadHealth","timestamp":"2022-11-16T08:26:43.409044Z"}|0||0|0|0|-1|1668587203|-1|-1
\ No newline at end of file
diff --git a/tests/mactime2/csv_output.rs b/tests/mactime2/csv_output.rs
new file mode 100644
index 0000000..f370122
--- /dev/null
+++ b/tests/mactime2/csv_output.rs
@@ -0,0 +1,27 @@
+use std::{
+    io::{BufReader, Cursor},
+    path::PathBuf,
+};
+
+use assert_cmd::Command;
+
+/// tests if the result of `mactime2` is always sorted
+#[test]
+fn csv_output() {
+    let mut cmd = Command::cargo_bin("mactime2").unwrap();
+    let mut data_path = PathBuf::from(std::env::var("CARGO_MANIFEST_DIR").unwrap());
+    data_path.push("tests");
+    data_path.push("data");
+    data_path.push("mactime2");
+    data_path.push("csv_test.bodyfile");
+
+    let result = cmd.arg("-d").arg("-b").arg(data_path).ok();
+    assert!(result.is_ok());
+
+    let mut reader = csv::ReaderBuilder::new()
+        .has_headers(false)
+        .from_reader(BufReader::new(Cursor::new(result.unwrap().stdout)));
+    let first_line = reader.records().next().unwrap().unwrap();
+
+    assert_eq!(first_line.get(7).unwrap(), r##"{"activity_id":null,"channel_name":"Microsoft-Windows-WER-PayloadHealth/Operational","computer":"WIN-J56D9ENVG6H","custom_data":{"EventData":{"#attributes":{"Name":"WER_PAYLOAD_HEALTH_FAIL"},"BytesUploaded":0,"HttpExchangeResult":2147954402,"PayloadSize":4569,"Protocol":"Watson","RequestStatusCode":0,"ServerName":"umwatson.events.data.microsoft.com","Stage":"s1event","TransportHr":2147954402,"UploadDuration":21094}},"event_id":2,"event_record_id":1,"level":4,"provider_name":"Microsoft-Windows-WER-PayloadHealth","timestamp":"2022-11-16T08:26:43.409044Z"}"##);
+}

From 7fa80e415c876cc4cfc7e7f273aeaae5b244c7ff Mon Sep 17 00:00:00 2001
From: Jan Starke <jan.starke@posteo.de>
Date: Wed, 15 May 2024 14:07:55 +0200
Subject: [PATCH 16/35] fix unfinished merge conflict in Cargo.toml

---
 Cargo.lock | 669 ++++++++++++++++++++++++++---------------------------
 1 file changed, 330 insertions(+), 339 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 0832e59..749e8b1 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -17,11 +17,23 @@ version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f26201604c87b1e01bd3d98f8d5d9a8fcbb815e8cedb41ffccbeb4bf593a35fe"
 
+[[package]]
+name = "ahash"
+version = "0.8.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e89da841a80418a9b391ebaea17f5c112ffaaa96f621d2c285b5174da76b9011"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+ "version_check",
+ "zerocopy",
+]
+
 [[package]]
 name = "aho-corasick"
-version = "1.1.2"
+version = "1.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b2969dcb958b36655471fc61f7e416fa76033bdd4bfed0678d8fee1e2d07a1f0"
+checksum = "8e60d3430d3a69478ad0993f19238d2df97c507009a52b3c10addcd7f6bcb916"
 dependencies = [
  "memchr",
 ]
@@ -32,6 +44,12 @@ version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "250f629c0161ad8107cf89319e990051fae62832fd343083bea452d93e2205fd"
 
+[[package]]
+name = "allocator-api2"
+version = "0.2.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c6cb57a04249c6480766f7f7cef5467412af1490f8d1e243141daddada3264f"
+
 [[package]]
 name = "android-tzdata"
 version = "0.1.1"
@@ -49,47 +67,48 @@ dependencies = [
 
 [[package]]
 name = "anstream"
-version = "0.6.12"
+version = "0.6.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "96b09b5178381e0874812a9b157f7fe84982617e48f71f4e3235482775e5b540"
+checksum = "418c75fa768af9c03be99d17643f93f79bbba589895012a80e3452a19ddda15b"
 dependencies = [
  "anstyle",
  "anstyle-parse",
  "anstyle-query",
  "anstyle-wincon",
  "colorchoice",
+ "is_terminal_polyfill",
  "utf8parse",
 ]
 
 [[package]]
 name = "anstyle"
-version = "1.0.6"
+version = "1.0.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8901269c6307e8d93993578286ac0edf7f195079ffff5ebdeea6a59ffb7e36bc"
+checksum = "038dfcf04a5feb68e9c60b21c9625a54c2c0616e79b72b0fd87075a056ae1d1b"
 
 [[package]]
 name = "anstyle-parse"
-version = "0.2.3"
+version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c75ac65da39e5fe5ab759307499ddad880d724eed2f6ce5b5e8a26f4f387928c"
+checksum = "c03a11a9034d92058ceb6ee011ce58af4a9bf61491aa7e1e59ecd24bd40d22d4"
 dependencies = [
  "utf8parse",
 ]
 
 [[package]]
 name = "anstyle-query"
-version = "1.0.2"
+version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e28923312444cdd728e4738b3f9c9cac739500909bb3d3c94b43551b16517648"
+checksum = "a64c907d4e79225ac72e2a354c9ce84d50ebb4586dee56c82b3ee73004f537f5"
 dependencies = [
  "windows-sys 0.52.0",
 ]
 
 [[package]]
 name = "anstyle-wincon"
-version = "3.0.2"
+version = "3.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1cd54b81ec8d6180e24654d0b371ad22fc3dd083b6ff8ba325b72e00c87660a7"
+checksum = "61a38449feb7068f52bb06c12759005cf459ee52bb4adc1d5a7c4322d716fb19"
 dependencies = [
  "anstyle",
  "windows-sys 0.52.0",
@@ -97,9 +116,9 @@ dependencies = [
 
 [[package]]
 name = "anyhow"
-version = "1.0.80"
+version = "1.0.83"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ad32ce52e4161730f7098c077cd2ed6229b5804ccf99e5366be1ab72a98b4e1"
+checksum = "25bdb32cbbdce2b519a9cd7df3a678443100e265d5e25ca763b7572a5104f5f3"
 
 [[package]]
 name = "assert-json-diff"
@@ -128,9 +147,9 @@ dependencies = [
 
 [[package]]
 name = "async-compression"
-version = "0.4.6"
+version = "0.4.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a116f46a969224200a0a97f29cfd4c50e7534e4b4826bd23ea2c3c533039c82c"
+checksum = "9c90a406b4495d129f00461241616194cb8a032c8d1c53c657f0961d5f8e0498"
 dependencies = [
  "flate2",
  "futures-core",
@@ -152,15 +171,15 @@ dependencies = [
 
 [[package]]
 name = "autocfg"
-version = "1.1.0"
+version = "1.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
+checksum = "0c4b4d0bd25bd0b74681c0ad21497610ce1b7c91b1022cd21c80c6fbdd9476b0"
 
 [[package]]
 name = "backtrace"
-version = "0.3.69"
+version = "0.3.71"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2089b7e3f35b9dd2d0ed921ead4f6d318c27680d4a5bd167b3ee120edb105837"
+checksum = "26b05800d2e817c8b3b4b54abd461726265fa9789ae34330622f2db9ee696f9d"
 dependencies = [
  "addr2line",
  "cc",
@@ -234,9 +253,9 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 
 [[package]]
 name = "bitflags"
-version = "2.4.2"
+version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed570934406eb16438a4e976b1b4500774099c13b8cb96eec99f620f05090ddf"
+checksum = "cf4b9d6a944f767f8e5e0db018570623c85f3d925ac718db4e06d0187adb21c1"
 
 [[package]]
 name = "block-buffer"
@@ -260,15 +279,15 @@ dependencies = [
 
 [[package]]
 name = "bumpalo"
-version = "3.15.3"
+version = "3.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ea184aa71bb362a1157c896979544cc23974e08fd265f29ea96b59f0b4a555b"
+checksum = "79296716171880943b8470b5f8d03aa55eb2e645a4874bdbb28adb49162e012c"
 
 [[package]]
 name = "bytecount"
-version = "0.6.7"
+version = "0.6.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e1e5f035d16fc623ae5f74981db80a439803888314e3a555fd6f04acd51a3205"
+checksum = "5ce89b21cab1437276d2650d57e971f9d548a2d9037cc231abdc0562b97498ce"
 
 [[package]]
 name = "byteorder"
@@ -278,24 +297,24 @@ checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
 
 [[package]]
 name = "bytes"
-version = "1.5.0"
+version = "1.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a2bd12c1caf447e69cd4528f47f94d203fd2582878ecb9e9465484c4148a8223"
+checksum = "514de17de45fdb8dc022b1a7975556c53c86f9f0aa5f534b98977b171857c2c9"
 
 [[package]]
 name = "camino"
-version = "1.1.6"
+version = "1.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c59e92b5a388f549b863a7bea62612c09f24c8393560709a54558a9abdfb3b9c"
+checksum = "e0ec6b951b160caa93cc0c7b209e5a3bff7aae9062213451ac99493cd844c239"
 dependencies = [
  "serde",
 ]
 
 [[package]]
 name = "cargo-platform"
-version = "0.1.7"
+version = "0.1.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "694c8807f2ae16faecc43dc17d74b3eb042482789fd0eb64b39a2e04e087053f"
+checksum = "24b1f0365a6c6bb4020cd05806fd0d33c44d38046b8bd7f0e40814b9763cabfc"
 dependencies = [
  "serde",
 ]
@@ -308,16 +327,16 @@ checksum = "4acbb09d9ee8e23699b9634375c72795d095bf268439da88562cf9b501f181fa"
 dependencies = [
  "camino",
  "cargo-platform",
- "semver 1.0.22",
+ "semver 1.0.23",
  "serde",
  "serde_json",
 ]
 
 [[package]]
 name = "cc"
-version = "1.0.88"
+version = "1.0.97"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "02f341c093d19155a6e41631ce5971aac4e9a868262212153124c15fa22d1cdc"
+checksum = "099a5357d84c4c61eb35fc8eafa9a79a902c2f76911e5747ced4e032edd8d9b4"
 
 [[package]]
 name = "cfg-if"
@@ -327,9 +346,9 @@ checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
 
 [[package]]
 name = "chrono"
-version = "0.4.34"
+version = "0.4.38"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5bc015644b92d5890fab7489e49d21f879d5c990186827d42ec511919404f38b"
+checksum = "a21f936df1771bf62b77f047b726c4625ff2e8aa607c01ec06e5a05bd8463401"
 dependencies = [
  "android-tzdata",
  "iana-time-zone",
@@ -337,7 +356,7 @@ dependencies = [
  "num-traits",
  "serde",
  "wasm-bindgen",
- "windows-targets 0.52.3",
+ "windows-targets 0.52.5",
 ]
 
 [[package]]
@@ -364,24 +383,9 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "3.2.25"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4ea181bf566f71cb9a5d17a59e1871af638180a18fb0035c92ae62b705207123"
-dependencies = [
- "atty",
- "bitflags 1.3.2",
- "clap_lex 0.2.4",
- "indexmap 1.9.3",
- "strsim 0.10.0",
- "termcolor",
- "textwrap",
-]
-
-[[package]]
-name = "clap"
-version = "4.5.1"
+version = "4.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c918d541ef2913577a0f9566e9ce27cb35b6df072075769e0b26cb5a554520da"
+checksum = "90bc066a67923782aa8515dbaea16946c5bcc5addbd668bb80af688e53e548a0"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -393,7 +397,7 @@ version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "325f50228f76921784b6d9f2d62de6778d834483248eefecd27279174797e579"
 dependencies = [
- "clap 4.5.1",
+ "clap",
 ]
 
 [[package]]
@@ -402,51 +406,42 @@ version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bb9b20c0dd58e4c2e991c8d203bbeb76c11304d1011659686b5b644bc29aa478"
 dependencies = [
- "clap 4.5.1",
+ "clap",
  "log",
 ]
 
 [[package]]
 name = "clap_builder"
-version = "4.5.1"
+version = "4.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9f3e7391dad68afb0c2ede1bf619f579a3dc9c2ec67f089baa397123a2f3d1eb"
+checksum = "ae129e2e766ae0ec03484e609954119f123cc1fe650337e155d03b022f24f7b4"
 dependencies = [
  "anstream",
  "anstyle",
- "clap_lex 0.7.0",
- "strsim 0.11.0",
+ "clap_lex",
+ "strsim 0.11.1",
  "terminal_size",
 ]
 
 [[package]]
 name = "clap_complete"
-version = "4.5.1"
+version = "4.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "885e4d7d5af40bfb99ae6f9433e292feac98d452dcb3ec3d25dfe7552b77da8c"
+checksum = "dd79504325bf38b10165b02e89b4347300f855f273c4cb30c4a3209e6583275e"
 dependencies = [
- "clap 4.5.1",
+ "clap",
 ]
 
 [[package]]
 name = "clap_derive"
-version = "4.5.0"
+version = "4.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "307bc0538d5f0f83b8248db3087aa92fe504e4691294d0c96c0eabc33f47ba47"
+checksum = "528131438037fd55894f62d6e9f068b8f45ac57ffa77517819645d10aed04f64"
 dependencies = [
- "heck",
+ "heck 0.5.0",
  "proc-macro2",
  "quote",
- "syn 2.0.51",
-]
-
-[[package]]
-name = "clap_lex"
-version = "0.2.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2850f2f5a82cbf437dd5af4d49848fbdfc27c157c3d010345776f952765261c5"
-dependencies = [
- "os_str_bytes",
+ "syn 2.0.63",
 ]
 
 [[package]]
@@ -462,7 +457,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b7fc6734af48458f72f5a3fa7b840903606427d98a710256e808f76a965047d9"
 dependencies = [
  "cfg-if",
- "clap 4.5.1",
+ "clap",
  "is-terminal",
  "libc",
  "tempfile",
@@ -472,9 +467,9 @@ dependencies = [
 
 [[package]]
 name = "colorchoice"
-version = "1.0.0"
+version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "acbf1af155f9b9ef647e42cdc158db4b64a1b61f743629225fde6f3e0be2a7c7"
+checksum = "0b6a852b24ab71dffc585bcb46eaf7959d175cb865a7152e35b348d1b2960422"
 
 [[package]]
 name = "colored"
@@ -646,7 +641,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "strsim 0.10.0",
- "syn 2.0.51",
+ "syn 2.0.63",
 ]
 
 [[package]]
@@ -668,7 +663,7 @@ checksum = "a668eda54683121533a393014d8692171709ff57a7d61f187b6e782719f8933f"
 dependencies = [
  "darling_core 0.20.8",
  "quote",
- "syn 2.0.51",
+ "syn 2.0.63",
 ]
 
 [[package]]
@@ -693,17 +688,17 @@ dependencies = [
 
 [[package]]
 name = "dfir-toolkit"
-version = "0.10.2"
+version = "0.10.3"
 dependencies = [
  "anyhow",
  "assert-json-diff",
  "assert_cmd",
  "base64 0.21.7",
  "binread",
- "bitflags 2.4.2",
+ "bitflags 2.5.0",
  "chrono",
  "chrono-tz",
- "clap 4.5.1",
+ "clap",
  "clap-markdown",
  "clap-verbosity-flag",
  "clap_complete",
@@ -779,18 +774,19 @@ dependencies = [
  "dfirtk-eventdata",
  "proc-macro2",
  "quote",
- "syn 2.0.51",
+ "syn 2.0.63",
 ]
 
 [[package]]
 name = "dialoguer"
-version = "0.10.4"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "59c6f2989294b9a498d3ad5491a79c6deb604617378e1cdc4bfc1c1361fe2f87"
+checksum = "658bce805d770f407bc62102fca7c2c64ceef2fbcb2b8bd19d2765ce093980de"
 dependencies = [
  "console",
  "shell-words",
  "tempfile",
+ "thiserror",
  "zeroize",
 ]
 
@@ -822,7 +818,7 @@ version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "de78e66ac9061e030587b2a2e75cc88f22304913c907b11307bca737141230cb"
 dependencies = [
- "heck",
+ "heck 0.4.1",
  "proc-macro-error",
 ]
 
@@ -834,9 +830,9 @@ checksum = "0d6ef0072f8a535281e4876be788938b528e9a1d43900b82c2569af7da799125"
 
 [[package]]
 name = "either"
-version = "1.10.0"
+version = "1.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "11157ac094ffbdde99aa67b23417ebdd801842852b500e395a45a9c0aac03e4a"
+checksum = "a47c1c47d2f5964e29c61246e81db715514cd532db6b5116a25ea3c03d6780a2"
 
 [[package]]
 name = "elasticsearch"
@@ -930,9 +926,9 @@ checksum = "a246d82be1c9d791c5dfde9a2bd045fc3cbba3fa2b11ad558f27d01712f00569"
 
 [[package]]
 name = "encoding_rs"
-version = "0.8.33"
+version = "0.8.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7268b386296a025e474d5140678f75d6de9493ae55a5d709eeb9dd08149945e1"
+checksum = "b45de904aa0b010bce2ab45264d0631681847fa7b6f2eaa7dab7619943bc4f59"
 dependencies = [
  "cfg-if",
 ]
@@ -954,9 +950,9 @@ checksum = "5443807d6dff69373d433ab9ef5378ad8df50ca6298caf15de6e52e24aaf54d5"
 
 [[package]]
 name = "errno"
-version = "0.3.8"
+version = "0.3.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a258e46cdc063eb8519c00b9fc845fc47bcfca4130e2f08e88665ceda8474245"
+checksum = "534c5cf6194dfab3db3242765c03bbe257cf92f22b38f6bc0c58d59108a820ba"
 dependencies = [
  "libc",
  "windows-sys 0.52.0",
@@ -973,18 +969,19 @@ dependencies = [
 
 [[package]]
 name = "evtx"
-version = "0.8.1"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b3c0a23f64c81e962c993ccb5d9e88bbd62a3fcabdec20b037a8383f7c3e163f"
+checksum = "082a513e8ac6685ee6b4a52d6f774a041d3f6497bdeeabed515df2edd207872b"
 dependencies = [
  "anyhow",
- "bitflags 1.3.2",
+ "bitflags 2.5.0",
  "byteorder",
  "chrono",
- "clap 3.2.25",
+ "clap",
  "crc32fast",
  "dialoguer",
  "encoding",
+ "hashbrown",
  "indoc",
  "log",
  "quick-xml",
@@ -999,15 +996,15 @@ dependencies = [
 
 [[package]]
 name = "fastrand"
-version = "2.0.1"
+version = "2.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "25cbce373ec4653f1a01a31e8a5e5ec0c622dc27ff9c4e6606eefef5cbbed4a5"
+checksum = "9fc0510504f03c51ada170672ac806f1f105a88aa97a5281117e1ddc3368e51a"
 
 [[package]]
 name = "flate2"
-version = "1.0.28"
+version = "1.0.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "46303f565772937ffe1d394a4fac6f411c6013172fadde9dcdb1e147a086940e"
+checksum = "5f54427cfd1c7829e2a139fcefea601bf088ebca651d2bf53ebc600eac295dae"
 dependencies = [
  "crc32fast",
  "miniz_oxide",
@@ -1118,7 +1115,7 @@ checksum = "87750cf4b7a4c0625b1529e4c543c2182106e4dedc60a2a6455e00d212c489ac"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.51",
+ "syn 2.0.63",
 ]
 
 [[package]]
@@ -1163,9 +1160,9 @@ dependencies = [
 
 [[package]]
 name = "getrandom"
-version = "0.2.12"
+version = "0.2.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "190092ea657667030ac6a35e305e62fc4dd69fd98ac98631e5d3a2b1575a12b5"
+checksum = "c4567c8db10ae91089c99af84c68c38da3ec2f087c3f82960bcdbf3656b6f4d7"
 dependencies = [
  "cfg-if",
  "libc",
@@ -1208,7 +1205,7 @@ dependencies = [
  "futures-sink",
  "futures-util",
  "http",
- "indexmap 2.2.3",
+ "indexmap",
  "slab",
  "tokio",
  "tokio-util",
@@ -1217,21 +1214,25 @@ dependencies = [
 
 [[package]]
 name = "hashbrown"
-version = "0.12.3"
+version = "0.14.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
+checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
+dependencies = [
+ "ahash",
+ "allocator-api2",
+]
 
 [[package]]
-name = "hashbrown"
-version = "0.14.3"
+name = "heck"
+version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "290f1a1d9242c78d09ce40a5e87e7554ee637af1351968159f4952f028f75604"
+checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8"
 
 [[package]]
 name = "heck"
-version = "0.4.1"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
 
 [[package]]
 name = "hermit-abi"
@@ -1244,15 +1245,15 @@ dependencies = [
 
 [[package]]
 name = "hermit-abi"
-version = "0.3.8"
+version = "0.3.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "379dada1584ad501b383485dd706b8afb7a70fcbc7f4da7d780638a5a6124a60"
+checksum = "d231dfb89cfffdbc30e7fc41579ed6066ad03abda9e567ccafae602b97ec5024"
 
 [[package]]
 name = "http"
-version = "0.2.11"
+version = "0.2.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8947b1a6fad4393052c7ba1f4cd97bed3e953a95c79c92ad9b051a04611d9fbb"
+checksum = "601cbb57e577e2f5ef5be8e7b83f0f63994f25aa94d673e54a92d5c516d101f1"
 dependencies = [
  "bytes",
  "fnv",
@@ -1360,22 +1361,12 @@ dependencies = [
 
 [[package]]
 name = "indexmap"
-version = "1.9.3"
+version = "2.2.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bd070e393353796e801d209ad339e89596eb4c8d430d18ede6a1cced8fafbd99"
-dependencies = [
- "autocfg",
- "hashbrown 0.12.3",
-]
-
-[[package]]
-name = "indexmap"
-version = "2.2.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "233cf39063f058ea2caae4091bf4a3ef70a653afbc026f5c4a4135d114e3c177"
+checksum = "168fb715dda47215e360912c096649d23d58bf392ac62f73919e831745e40f26"
 dependencies = [
  "equivalent",
- "hashbrown 0.14.3",
+ "hashbrown",
 ]
 
 [[package]]
@@ -1393,9 +1384,9 @@ dependencies = [
 
 [[package]]
 name = "indoc"
-version = "1.0.9"
+version = "2.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bfa799dd5ed20a7e349f3b4639aa80d74549c81716d9ec4f994c9b5815598306"
+checksum = "b248f5224d1d606005e02c97f5aa4e88eeb230488bcc03bc9ca4d7991399f2b5"
 
 [[package]]
 name = "instant"
@@ -1418,11 +1409,17 @@ version = "0.4.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f23ff5ef2b80d608d61efee834934d862cd92461afc0560dedf493e4c033738b"
 dependencies = [
- "hermit-abi 0.3.8",
+ "hermit-abi 0.3.9",
  "libc",
  "windows-sys 0.52.0",
 ]
 
+[[package]]
+name = "is_terminal_polyfill"
+version = "1.70.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8478577c03552c21db0e2724ffb8986a5ce7af88107e6be5d2ee6e158c12800"
+
 [[package]]
 name = "itertools"
 version = "0.12.1"
@@ -1434,15 +1431,15 @@ dependencies = [
 
 [[package]]
 name = "itoa"
-version = "1.0.10"
+version = "1.0.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b1a46d1a171d865aa5f83f92695765caa047a9b4cbae2cbf37dbd613a793fd4c"
+checksum = "49f1f14873335454500d59611f1cf4a4b0f786f9ac11f4312a78e4cf2566695b"
 
 [[package]]
 name = "js-sys"
-version = "0.3.68"
+version = "0.3.69"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "406cda4b368d531c842222cf9d2600a9a4acce8d29423695379c6868a143a9ee"
+checksum = "29c15563dc2726973df627357ce0c9ddddbea194836909d655df6a75d2cf296d"
 dependencies = [
  "wasm-bindgen",
 ]
@@ -1477,7 +1474,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "regex",
- "syn 2.0.51",
+ "syn 2.0.63",
 ]
 
 [[package]]
@@ -1488,9 +1485,9 @@ checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
 
 [[package]]
 name = "libc"
-version = "0.2.153"
+version = "0.2.154"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c198f91728a82281a64e1f4f9eeb25d82cb32a5de251c6bd1b5154d63a8e7bd"
+checksum = "ae743338b92ff9146ce83992f766a31066a91a8c84a45e0e9f21e7cf6de6d346"
 
 [[package]]
 name = "linux-raw-sys"
@@ -1514,9 +1511,9 @@ dependencies = [
 
 [[package]]
 name = "lock_api"
-version = "0.4.11"
+version = "0.4.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c168f8615b12bc01f9c17e2eb0cc07dcae1940121185446edc3744920e8ef45"
+checksum = "07af8b9cdd281b7915f413fa73f29ebd5d55d0d3f0155584dade1ff18cea1b17"
 dependencies = [
  "autocfg",
  "scopeguard",
@@ -1524,9 +1521,9 @@ dependencies = [
 
 [[package]]
 name = "log"
-version = "0.4.20"
+version = "0.4.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5e6163cb8c49088c2c36f57875e58ccd8c87c7427f7fbd50ea6710b2f3f2e8f"
+checksum = "90ed8c1e510134f979dbc4f070f87d4313098b704861a105fe34231c70a3901c"
 
 [[package]]
 name = "marvin32"
@@ -1545,9 +1542,9 @@ checksum = "2532096657941c2fea9c289d370a250971c689d4f143798ff67113ec042024a5"
 
 [[package]]
 name = "memchr"
-version = "2.7.1"
+version = "2.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "523dc4f511e55ab87b694dc30d0f820d60906ef06413f93d4d7a1385599cc149"
+checksum = "6c8640c5d730cb13ebd907d8d04b52f55ac9a2eec55b440c8892f40d56c76c1d"
 
 [[package]]
 name = "memoverlay"
@@ -1575,15 +1572,9 @@ dependencies = [
 
 [[package]]
 name = "mio"
-<<<<<<< 26-pf2bodyfile-creation-time-is-not-available
-version = "0.8.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f3d0b296e374a4e6f3c7b0a1f5a51d748a0d34c85e7dc48fc3fa9a87657fe09"
-=======
 version = "0.8.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a4a650543ca06a924e8b371db273b2756685faae30f8487da1b56505a8f78b0c"
->>>>>>> main
 dependencies = [
  "libc",
  "wasi",
@@ -1640,9 +1631,9 @@ dependencies = [
 
 [[package]]
 name = "num"
-version = "0.4.1"
+version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b05180d69e3da0e530ba2a1dae5110317e49e3b7f3d41be227dc5f92e49ee7af"
+checksum = "35bd024e8b2ff75562e5f34e7f4905839deb4b22955ef5e73d2fea1b9813cb23"
 dependencies = [
  "num-bigint",
  "num-complex",
@@ -1654,20 +1645,19 @@ dependencies = [
 
 [[package]]
 name = "num-bigint"
-version = "0.4.4"
+version = "0.4.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "608e7659b5c3d7cba262d894801b9ec9d00de989e8a82bd4bef91d08da45cdc0"
+checksum = "c165a9ab64cf766f73521c0dd2cfdff64f488b8f0b3e621face3462d3db536d7"
 dependencies = [
- "autocfg",
  "num-integer",
  "num-traits",
 ]
 
 [[package]]
 name = "num-complex"
-version = "0.4.5"
+version = "0.4.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23c6602fda94a57c990fe0df199a035d83576b496aa29f4e634a8ac6004e68a6"
+checksum = "73f88a1307638156682bada9d7604135552957b7818057dcef22705b4d509495"
 dependencies = [
  "num-traits",
 ]
@@ -1697,7 +1687,7 @@ checksum = "ed3955f1a9c7c0c15e092f9c887db08b1fc683305fdf6eb6684f22555355e202"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.51",
+ "syn 2.0.63",
 ]
 
 [[package]]
@@ -1711,9 +1701,9 @@ dependencies = [
 
 [[package]]
 name = "num-iter"
-version = "0.1.44"
+version = "0.1.45"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d869c01cc0c455284163fd0092f1f93835385ccab5a98a0dcc497b2f8bf055a9"
+checksum = "1429034a0490724d0075ebb2bc9e875d6503c3cf69e235a8941aa757d83ef5bf"
 dependencies = [
  "autocfg",
  "num-integer",
@@ -1722,11 +1712,10 @@ dependencies = [
 
 [[package]]
 name = "num-rational"
-version = "0.4.1"
+version = "0.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0638a1c9d0a3c0914158145bc76cff373a75a627e6ecbfb71cbe6f453a5a19b0"
+checksum = "f83d14da390562dca69fc84082e73e548e1ad308d24accdedd2720017cb37824"
 dependencies = [
- "autocfg",
  "num-bigint",
  "num-integer",
  "num-traits",
@@ -1734,9 +1723,9 @@ dependencies = [
 
 [[package]]
 name = "num-traits"
-version = "0.2.18"
+version = "0.2.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da0df0e5185db44f69b44f26786fe401b6c293d1907744beaa7fa62b2e5a517a"
+checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
 dependencies = [
  "autocfg",
 ]
@@ -1747,7 +1736,7 @@ version = "1.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4161fcb6d602d4d2081af7c3a45852d875a03dd337a6bfdd6e06407b61342a43"
 dependencies = [
- "hermit-abi 0.3.8",
+ "hermit-abi 0.3.9",
  "libc",
 ]
 
@@ -1789,17 +1778,11 @@ checksum = "3fdb12b2476b595f9358c5161aa467c2438859caa136dec86c26fdd2efe17b92"
 
 [[package]]
 name = "openssl"
-<<<<<<< 26-pf2bodyfile-creation-time-is-not-available
 version = "0.10.64"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "95a0481286a310808298130d22dd1fef0fa571e05a8f44ec801801e84b216b1f"
-=======
-version = "0.10.60"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "79a4c6c3a2b158f7f8f2a2fc5a969fa3a068df6fc9dbb4a43845436e3af7c800"
->>>>>>> main
 dependencies = [
- "bitflags 2.4.2",
+ "bitflags 2.5.0",
  "cfg-if",
  "foreign-types",
  "libc",
@@ -1816,7 +1799,7 @@ checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.51",
+ "syn 2.0.63",
 ]
 
 [[package]]
@@ -1827,15 +1810,9 @@ checksum = "ff011a302c396a5197692431fc1948019154afc178baf7d8e37367442a4601cf"
 
 [[package]]
 name = "openssl-sys"
-<<<<<<< 26-pf2bodyfile-creation-time-is-not-available
-version = "0.9.101"
+version = "0.9.102"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dda2b0f344e78efc2facf7d195d098df0dd72151b26ab98da807afc26c198dff"
-=======
-version = "0.9.96"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3812c071ba60da8b5677cc12bcb1d42989a65553772897a7e0355545a819838f"
->>>>>>> main
+checksum = "c597637d56fbc83893a35eb0dd04b2b8e7a50c91e64e9493e398b5df4fb45fa2"
 dependencies = [
  "cc",
  "libc",
@@ -1843,12 +1820,6 @@ dependencies = [
  "vcpkg",
 ]
 
-[[package]]
-name = "os_str_bytes"
-version = "6.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2355d85b9a3786f481747ced0e0ff2ba35213a1f9bd406ed906554d7af805a1"
-
 [[package]]
 name = "ouroboros"
 version = "0.18.3"
@@ -1866,19 +1837,19 @@ version = "0.18.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b645dcde5f119c2c454a92d0dfa271a2a3b205da92e4292a68ead4bdbfde1f33"
 dependencies = [
- "heck",
+ "heck 0.4.1",
  "itertools",
  "proc-macro2",
  "proc-macro2-diagnostics",
  "quote",
- "syn 2.0.51",
+ "syn 2.0.63",
 ]
 
 [[package]]
 name = "parking_lot"
-version = "0.12.1"
+version = "0.12.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3742b2c103b9f06bc9fff0a37ff4912935851bee6d36f3c02bcc755bcfec228f"
+checksum = "7e4af0ca4f6caed20e900d564c242b8e5d4903fdacf31d3daf527b66fe6f42fb"
 dependencies = [
  "lock_api",
  "parking_lot_core",
@@ -1886,22 +1857,22 @@ dependencies = [
 
 [[package]]
 name = "parking_lot_core"
-version = "0.9.9"
+version = "0.9.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c42a9226546d68acdd9c0a280d17ce19bfe27a46bf68784e4066115788d008e"
+checksum = "1e401f977ab385c9e4e3ab30627d6f26d00e2c73eef317493c4ec6d468726cf8"
 dependencies = [
  "cfg-if",
  "libc",
- "redox_syscall 0.4.1",
+ "redox_syscall 0.5.1",
  "smallvec",
- "windows-targets 0.48.5",
+ "windows-targets 0.52.5",
 ]
 
 [[package]]
 name = "parse-zoneinfo"
-version = "0.3.0"
+version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c705f256449c60da65e11ff6626e0c16a0a0b96aaa348de61376b249bc340f41"
+checksum = "1f2a05b18d44e2957b88f96ba460715e295bc1d7510468a2f3d3b44535d26c24"
 dependencies = [
  "regex",
 ]
@@ -1971,9 +1942,9 @@ dependencies = [
 
 [[package]]
 name = "pin-project-lite"
-version = "0.2.13"
+version = "0.2.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8afb450f006bf6385ca15ef45d71d2288452bc3683ce2e2cacc0d18e4be60b58"
+checksum = "bda66fc9667c18cb2758a2ac84d1167245054bcf85d5d1aaa6923f45801bdd02"
 
 [[package]]
 name = "pin-utils"
@@ -2064,9 +2035,9 @@ checksum = "dc375e1527247fe1a97d8b7156678dfe7c1af2fc075c9a4db3690ecd2a148068"
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.78"
+version = "1.0.82"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2422ad645d89c99f8f3e6b88a9fdeca7fabeac836b1002371c4367c8f984aae"
+checksum = "8ad3d49ab951a01fbaafe34f2ec74122942fe18a3f9814c3268f1bb72042131b"
 dependencies = [
  "unicode-ident",
 ]
@@ -2079,9 +2050,9 @@ checksum = "af066a9c399a26e020ada66a034357a868728e72cd426f3adcd35f80d88d88c8"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.51",
+ "syn 2.0.63",
  "version_check",
- "yansi 1.0.0-rc.1",
+ "yansi 1.0.1",
 ]
 
 [[package]]
@@ -2090,25 +2061,25 @@ version = "0.9.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "57206b407293d2bcd3af849ce869d52068623f19e1b5ff8e8778e3309439682b"
 dependencies = [
- "bitflags 2.4.2",
+ "bitflags 2.5.0",
  "memchr",
  "unicase",
 ]
 
 [[package]]
 name = "quick-xml"
-version = "0.24.1"
+version = "0.31.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "37dddbbe9df96afafcb8027fcf263971b726530e12f0787f620a7ba5b4846081"
+checksum = "1004a344b30a54e2ee58d66a71b32d2db2feb0a31f9a2d302bf0536f15de2a33"
 dependencies = [
  "memchr",
 ]
 
 [[package]]
 name = "quote"
-version = "1.0.35"
+version = "1.0.36"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "291ec9ab5efd934aaf503a6466c5d5251535d108ee747472c3977cc5acc868ef"
+checksum = "0fa76aaf39101c457836aec0ce2316dbdc3ab723cdda1c6bd4e6ad4208acaca7"
 dependencies = [
  "proc-macro2",
 ]
@@ -2145,9 +2116,9 @@ dependencies = [
 
 [[package]]
 name = "rayon"
-version = "1.8.1"
+version = "1.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fa7237101a77a10773db45d62004a272517633fbcc3df19d96455ede1122e051"
+checksum = "b418a60154510ca1a002a752ca9714984e21e4241e804d32555251faf8b78ffa"
 dependencies = [
  "either",
  "rayon-core",
@@ -2174,11 +2145,11 @@ dependencies = [
 
 [[package]]
 name = "redox_syscall"
-version = "0.4.1"
+version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4722d768eff46b75989dd134e5c353f0d6296e5aaa3132e776cbdb56be7731aa"
+checksum = "469052894dcb553421e483e4209ee581a45100d31b4018de03e5a7ad86374a7e"
 dependencies = [
- "bitflags 1.3.2",
+ "bitflags 2.5.0",
 ]
 
 [[package]]
@@ -2189,9 +2160,9 @@ checksum = "20145670ba436b55d91fc92d25e71160fbfbdd57831631c8d7d36377a476f1cb"
 
 [[package]]
 name = "regex"
-version = "1.10.3"
+version = "1.10.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b62dbe01f0b06f9d8dc7d49e05a0785f153b00b2c227856282f671e0318c9b15"
+checksum = "c117dbdfde9c8308975b6a18d71f3f385c89461f7b3fb054288ecf2a2058ba4c"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -2201,9 +2172,9 @@ dependencies = [
 
 [[package]]
 name = "regex-automata"
-version = "0.4.5"
+version = "0.4.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5bb987efffd3c6d0d8f5f89510bb458559eab11e4f869acb20bf845e016259cd"
+checksum = "86b83b8b9847f9bf95ef68afb0b8e6cdb80f498442f5179a29fad448fcc1eaea"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -2212,15 +2183,15 @@ dependencies = [
 
 [[package]]
 name = "regex-syntax"
-version = "0.8.2"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c08c74e62047bb2de4ff487b251e4a92e24f48745648451635cec7d591162d9f"
+checksum = "adad44e29e4c806119491a7f06f03de4d1af22c3a680dd47f1e6e179439d1f56"
 
 [[package]]
 name = "reqwest"
-version = "0.11.24"
+version = "0.11.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c6920094eb85afde5e4a138be3f2de8bbdf28000f0029e72c45025a56b042251"
+checksum = "dd67538700a17451e7cba03ac727fb961abb7607553461627b97de0b89cf4a62"
 dependencies = [
  "async-compression",
  "base64 0.21.7",
@@ -2260,9 +2231,9 @@ dependencies = [
 
 [[package]]
 name = "rustc-demangle"
-version = "0.1.23"
+version = "0.1.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d626bb9dae77e28219937af045c257c28bfd3f69333c512553507f5f9798cb76"
+checksum = "719b953e2095829ee67db738b3bfa9fa368c94900df327b3f07fe6e794d2fe1f"
 
 [[package]]
 name = "rustc_version"
@@ -2275,11 +2246,11 @@ dependencies = [
 
 [[package]]
 name = "rustix"
-version = "0.38.31"
+version = "0.38.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ea3e1a662af26cd7a3ba09c0297a31af215563ecf42817c98df621387f4e949"
+checksum = "70dc5ec042f7a43c4a73241207cecc9873a06d45debb38b329f8541d85c2730f"
 dependencies = [
- "bitflags 2.4.2",
+ "bitflags 2.5.0",
  "errno",
  "libc",
  "linux-raw-sys",
@@ -2297,15 +2268,15 @@ dependencies = [
 
 [[package]]
 name = "rustversion"
-version = "1.0.14"
+version = "1.0.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ffc183a10b4478d04cbbbfc96d0873219d962dd5accaff2ffbd4ceb7df837f4"
+checksum = "955d28af4278de8121b7ebeb796b6a45735dc01436d898801014aced2773a3d6"
 
 [[package]]
 name = "ryu"
-version = "1.0.17"
+version = "1.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e86697c916019a8588c99b5fac3cead74ec0b4b819707a682fd4d23fa0ce1ba1"
+checksum = "f3cb5ba0dc43242ce17de99c180e96db90b235b8a9fdc9543c96d2209116bd9f"
 
 [[package]]
 name = "same-file"
@@ -2333,11 +2304,11 @@ checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
 [[package]]
 name = "security-framework"
-version = "2.9.2"
+version = "2.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05b64fb303737d99b81884b2c63433e9ae28abebe5eb5045dcdd175dc2ecf4de"
+checksum = "c627723fd09706bacdb5cf41499e95098555af3c3c29d014dc3c458ef6be11c0"
 dependencies = [
- "bitflags 1.3.2",
+ "bitflags 2.5.0",
  "core-foundation",
  "core-foundation-sys",
  "libc",
@@ -2346,9 +2317,9 @@ dependencies = [
 
 [[package]]
 name = "security-framework-sys"
-version = "2.9.1"
+version = "2.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e932934257d3b408ed8f30db49d85ea163bfe74961f017f405b025af298f0c7a"
+checksum = "317936bbbd05227752583946b9e66d7ce3b489f84e11a94a510b4437fef407d7"
 dependencies = [
  "core-foundation-sys",
  "libc",
@@ -2365,9 +2336,9 @@ dependencies = [
 
 [[package]]
 name = "semver"
-version = "1.0.22"
+version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92d43fe69e652f3df9bdc2b85b2854a0825b86e4fb76bc44d945137d053639ca"
+checksum = "61697e0a1c7e512e84a621326239844a24d8207b4669b41bc18b32ea5cbf988b"
 dependencies = [
  "serde",
 ]
@@ -2380,29 +2351,29 @@ checksum = "388a1df253eca08550bef6c72392cfe7c30914bf41df5269b68cbd6ff8f570a3"
 
 [[package]]
 name = "serde"
-version = "1.0.197"
+version = "1.0.202"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3fb1c873e1b9b056a4dc4c0c198b24c3ffa059243875552b2bd0933b1aee4ce2"
+checksum = "226b61a0d411b2ba5ff6d7f73a476ac4f8bb900373459cd00fab8512828ba395"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.197"
+version = "1.0.202"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7eb0b34b42edc17f6b7cac84a52a1c5f0e1bb2227e997ca9011ea3dd34e8610b"
+checksum = "6048858004bcff69094cd972ed40a32500f153bd3be9f716b2eed2e8217c4838"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.51",
+ "syn 2.0.63",
 ]
 
 [[package]]
 name = "serde_json"
-version = "1.0.114"
+version = "1.0.117"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c5f09b1bd632ef549eaa9f60a1f8de742bdbc698e6cee2095fc84dde5f549ae0"
+checksum = "455182ea6142b14f93f4bc5320a2b31c1f266b66a4a5c858b013302a5d8cbfc3"
 dependencies = [
  "itoa",
  "ryu",
@@ -2462,9 +2433,9 @@ checksum = "24188a676b6ae68c3b2cb3a01be17fbf7240ce009799bb56d5b1409051e78fde"
 
 [[package]]
 name = "signal-hook-registry"
-version = "1.4.1"
+version = "1.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d8229b473baa5980ac72ef434c4415e70c4b5e71b423043adb4ba059f89c99a1"
+checksum = "a9e9e0b4211b72e7b8b6e85c807d36c212bdb33ea8587f7569562a84df5465b1"
 dependencies = [
  "libc",
 ]
@@ -2480,9 +2451,9 @@ dependencies = [
 
 [[package]]
 name = "simplelog"
-version = "0.12.1"
+version = "0.12.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "acee08041c5de3d5048c8b3f6f13fafb3026b24ba43c6a695a0c76179b844369"
+checksum = "16257adbfaef1ee58b1363bdc0664c9b8e1e30aed86049635fb5f147d065a9c0"
 dependencies = [
  "log",
  "termcolor",
@@ -2521,15 +2492,15 @@ dependencies = [
 
 [[package]]
 name = "smallvec"
-version = "1.13.1"
+version = "1.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6ecd384b10a64542d77071bd64bd7b231f4ed5940fba55e98c3de13824cf3d7"
+checksum = "3c5e1a9a646d36c3599cd173a41282daf47c44583ad367b8e6837255952e5c67"
 
 [[package]]
 name = "socket2"
-version = "0.5.6"
+version = "0.5.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05ffd9c0a93b7543e062e759284fcf5f5e3b098501104bfbdde4d404db792871"
+checksum = "ce305eb0b4296696835b71df73eb912e0f1ffd2556a501fcede6e0c50349191c"
 dependencies = [
  "libc",
  "windows-sys 0.52.0",
@@ -2549,30 +2520,30 @@ checksum = "73473c0e59e6d5812c5dfe2a064a6444949f089e20eec9a2e5506596494e4623"
 
 [[package]]
 name = "strsim"
-version = "0.11.0"
+version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ee073c9e4cd00e28217186dbe12796d692868f432bf2e97ee73bed0c56dfa01"
+checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
 
 [[package]]
 name = "strum"
-version = "0.26.1"
+version = "0.26.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "723b93e8addf9aa965ebe2d11da6d7540fa2283fcea14b3371ff055f7ba13f5f"
+checksum = "5d8cec3501a5194c432b2b7976db6b7d10ec95c253208b45f83f7136aa985e29"
 dependencies = [
  "strum_macros",
 ]
 
 [[package]]
 name = "strum_macros"
-version = "0.26.1"
+version = "0.26.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a3417fc93d76740d974a01654a09777cb500428cc874ca9f45edfe0c4d4cd18"
+checksum = "c6cf59daf282c0a494ba14fd21610a0325f9f90ec9d1231dea26bcb1d696c946"
 dependencies = [
- "heck",
+ "heck 0.4.1",
  "proc-macro2",
  "quote",
  "rustversion",
- "syn 2.0.51",
+ "syn 2.0.63",
 ]
 
 [[package]]
@@ -2588,9 +2559,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.51"
+version = "2.0.63"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ab617d94515e94ae53b8406c628598680aa0c9587474ecbe58188f7b345d66c"
+checksum = "bf5be731623ca1a1fb7d8be6f261a3be6d3e2337b8a1f97be944d020c8fcb704"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2649,9 +2620,9 @@ dependencies = [
 
 [[package]]
 name = "termcolor"
-version = "1.1.3"
+version = "1.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bab24d30b911b2376f3a13cc2cd443142f0c81dda04c118693e35b3835757755"
+checksum = "06794f8f6c5c898b3275aebefa6b8a1cb24cd2c6c79397ab15774837a0bc5755"
 dependencies = [
  "winapi-util",
 ]
@@ -2697,37 +2668,31 @@ version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3369f5ac52d5eb6ab48c6b4ffdc8efbcad6b89c765749064ba298f2c68a16a76"
 
-[[package]]
-name = "textwrap"
-version = "0.16.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23d434d3f8967a09480fb04132ebe0a3e088c173e6d0ee7897abbdf4eab0f8b9"
-
 [[package]]
 name = "thiserror"
-version = "1.0.57"
+version = "1.0.60"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e45bcbe8ed29775f228095caf2cd67af7a4ccf756ebff23a306bf3e8b47b24b"
+checksum = "579e9083ca58dd9dcf91a9923bb9054071b9ebbd800b342194c9feb0ee89fc18"
 dependencies = [
  "thiserror-impl",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "1.0.57"
+version = "1.0.60"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a953cb265bef375dae3de6663da4d3804eee9682ea80d8e2542529b73c531c81"
+checksum = "e2470041c06ec3ac1ab38d0356a6119054dedaea53e12fbefc0de730a1c08524"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.51",
+ "syn 2.0.63",
 ]
 
 [[package]]
 name = "time"
-version = "0.3.34"
+version = "0.3.36"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8248b6521bb14bc45b4067159b9b6ad792e2d6d754d6c41fb50e29fefe38749"
+checksum = "5dfd88e563464686c916c7e46e623e520ddc6d79fa6641390f2e3fa86e83e885"
 dependencies = [
  "deranged",
  "itoa",
@@ -2748,9 +2713,9 @@ checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3"
 
 [[package]]
 name = "time-macros"
-version = "0.2.17"
+version = "0.2.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ba3a3ef41e6672a2f0f001392bb5dcd3ff0a9992d618ca761a11c3121547774"
+checksum = "3f252a68540fde3a3877aeea552b832b40ab9a69e318efd078774a01ddee1ccf"
 dependencies = [
  "num-conv",
  "time-core",
@@ -2773,9 +2738,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "tokio"
-version = "1.36.0"
+version = "1.37.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61285f6515fa018fb2d1e46eb21223fff441ee8db5d0f1435e8ab4f5cdb80931"
+checksum = "1adbebffeca75fcfd058afa480fb6c0b81e165a0323f9c9d39c9697e37c46787"
 dependencies = [
  "backtrace",
  "bytes",
@@ -2804,7 +2769,7 @@ checksum = "5b8a1e28f2deaa14e508979454cb3a223b10b938b45af148bc0986de36f1923b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.51",
+ "syn 2.0.63",
 ]
 
 [[package]]
@@ -2819,16 +2784,15 @@ dependencies = [
 
 [[package]]
 name = "tokio-util"
-version = "0.7.10"
+version = "0.7.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5419f34732d9eb6ee4c3578b7989078579b7f039cbbb9ca2c4da015749371e15"
+checksum = "9cf6b47b3771c49ac75ad09a6162f53ad4b8088b76ac60e8ec1455b31a189fe1"
 dependencies = [
  "bytes",
  "futures-core",
  "futures-sink",
  "pin-project-lite",
  "tokio",
- "tracing",
 ]
 
 [[package]]
@@ -2900,9 +2864,9 @@ dependencies = [
 
 [[package]]
 name = "unicode-width"
-version = "0.1.11"
+version = "0.1.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e51733f11c9c4f72aa0c160008246859e340b00807569a0da0e7a1079b27ba85"
+checksum = "68f5e5f3158ecfd4b8ff6fe086db7c8467a2dfdac97fe420f2b7c4aa97af66d6"
 
 [[package]]
 name = "url"
@@ -2950,9 +2914,9 @@ dependencies = [
 
 [[package]]
 name = "walkdir"
-version = "2.4.0"
+version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d71d857dc86794ca4c280d616f7da00d2dbfd8cd788846559a6813e6aa4b54ee"
+checksum = "29790946404f91d9c5d06f9874efddea1dc06c5efe94541a7d6863108e3a5e4b"
 dependencies = [
  "same-file",
  "winapi-util",
@@ -2975,9 +2939,9 @@ checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.91"
+version = "0.2.92"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c1e124130aee3fb58c5bdd6b639a0509486b0338acaaae0c84a5124b0f588b7f"
+checksum = "4be2531df63900aeb2bca0daaaddec08491ee64ceecbee5076636a3b026795a8"
 dependencies = [
  "cfg-if",
  "wasm-bindgen-macro",
@@ -2985,24 +2949,24 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-backend"
-version = "0.2.91"
+version = "0.2.92"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c9e7e1900c352b609c8488ad12639a311045f40a35491fb69ba8c12f758af70b"
+checksum = "614d787b966d3989fa7bb98a654e369c762374fd3213d212cfc0251257e747da"
 dependencies = [
  "bumpalo",
  "log",
  "once_cell",
  "proc-macro2",
  "quote",
- "syn 2.0.51",
+ "syn 2.0.63",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-futures"
-version = "0.4.41"
+version = "0.4.42"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "877b9c3f61ceea0e56331985743b13f3d25c406a7098d45180fb5f09bc19ed97"
+checksum = "76bc14366121efc8dbb487ab05bcc9d346b3b5ec0eaa76e46594cabbe51762c0"
 dependencies = [
  "cfg-if",
  "js-sys",
@@ -3012,9 +2976,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.91"
+version = "0.2.92"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b30af9e2d358182b5c7449424f017eba305ed32a7010509ede96cdc4696c46ed"
+checksum = "a1f8823de937b71b9460c0c34e25f3da88250760bec0ebac694b49997550d726"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -3022,28 +2986,28 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.91"
+version = "0.2.92"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "642f325be6301eb8107a83d12a8ac6c1e1c54345a7ef1a9261962dfefda09e66"
+checksum = "e94f17b526d0a461a191c78ea52bbce64071ed5c04c9ffe424dcb38f74171bb7"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.51",
+ "syn 2.0.63",
  "wasm-bindgen-backend",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.91"
+version = "0.2.92"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4f186bd2dcf04330886ce82d6f33dd75a7bfcf69ecf5763b89fcde53b6ac9838"
+checksum = "af190c94f2773fdb3729c55b007a722abb5384da03bc0986df4c289bf5567e96"
 
 [[package]]
 name = "web-sys"
-version = "0.3.68"
+version = "0.3.69"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "96565907687f7aceb35bc5fc03770a8a0471d82e479f25832f54a0e3f4b28446"
+checksum = "77afa9a11836342370f4817622a2f0f418b134426d91a82dfb48f532d2ec13ef"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
@@ -3079,11 +3043,11 @@ checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
 
 [[package]]
 name = "winapi-util"
-version = "0.1.6"
+version = "0.1.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f29e6f9198ba0d26b4c9f07dbe6f9ed633e1f3d5b8b414090084349e46a52596"
+checksum = "4d4cc384e1e73b93bafa6fb4f1df8c41695c8a91cf9c4c64358067d15a7b6c6b"
 dependencies = [
- "winapi 0.3.9",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -3098,7 +3062,7 @@ version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "33ab640c8d7e35bf8ba19b884ba838ceb4fba93a4e8c65a9059d08afcfc683d9"
 dependencies = [
- "windows-targets 0.52.3",
+ "windows-targets 0.52.5",
 ]
 
 [[package]]
@@ -3131,7 +3095,7 @@ version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
 dependencies = [
- "windows-targets 0.52.3",
+ "windows-targets 0.52.5",
 ]
 
 [[package]]
@@ -3151,17 +3115,18 @@ dependencies = [
 
 [[package]]
 name = "windows-targets"
-version = "0.52.3"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d380ba1dc7187569a8a9e91ed34b8ccfc33123bbacb8c0aed2d1ad7f3ef2dc5f"
+checksum = "6f0713a46559409d202e70e28227288446bf7841d3211583a4b53e3f6d96e7eb"
 dependencies = [
- "windows_aarch64_gnullvm 0.52.3",
- "windows_aarch64_msvc 0.52.3",
- "windows_i686_gnu 0.52.3",
- "windows_i686_msvc 0.52.3",
- "windows_x86_64_gnu 0.52.3",
- "windows_x86_64_gnullvm 0.52.3",
- "windows_x86_64_msvc 0.52.3",
+ "windows_aarch64_gnullvm 0.52.5",
+ "windows_aarch64_msvc 0.52.5",
+ "windows_i686_gnu 0.52.5",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc 0.52.5",
+ "windows_x86_64_gnu 0.52.5",
+ "windows_x86_64_gnullvm 0.52.5",
+ "windows_x86_64_msvc 0.52.5",
 ]
 
 [[package]]
@@ -3178,9 +3143,9 @@ checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"
 
 [[package]]
 name = "windows_aarch64_gnullvm"
-version = "0.52.3"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "68e5dcfb9413f53afd9c8f86e56a7b4d86d9a2fa26090ea2dc9e40fba56c6ec6"
+checksum = "7088eed71e8b8dda258ecc8bac5fb1153c5cffaf2578fc8ff5d61e23578d3263"
 
 [[package]]
 name = "windows_aarch64_msvc"
@@ -3196,9 +3161,9 @@ checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"
 
 [[package]]
 name = "windows_aarch64_msvc"
-version = "0.52.3"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8dab469ebbc45798319e69eebf92308e541ce46760b49b18c6b3fe5e8965b30f"
+checksum = "9985fd1504e250c615ca5f281c3f7a6da76213ebd5ccc9561496568a2752afb6"
 
 [[package]]
 name = "windows_i686_gnu"
@@ -3214,9 +3179,15 @@ checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"
 
 [[package]]
 name = "windows_i686_gnu"
-version = "0.52.3"
+version = "0.52.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "88ba073cf16d5372720ec942a8ccbf61626074c6d4dd2e745299726ce8b89670"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2a4e9b6a7cac734a8b4138a4e1044eac3404d8326b6c0f939276560687a033fb"
+checksum = "87f4261229030a858f36b459e748ae97545d6f1ec60e5e0d6a3d32e0dc232ee9"
 
 [[package]]
 name = "windows_i686_msvc"
@@ -3232,9 +3203,9 @@ checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"
 
 [[package]]
 name = "windows_i686_msvc"
-version = "0.52.3"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "28b0ec9c422ca95ff34a78755cfa6ad4a51371da2a5ace67500cf7ca5f232c58"
+checksum = "db3c2bf3d13d5b658be73463284eaf12830ac9a26a90c717b7f771dfe97487bf"
 
 [[package]]
 name = "windows_x86_64_gnu"
@@ -3250,9 +3221,9 @@ checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"
 
 [[package]]
 name = "windows_x86_64_gnu"
-version = "0.52.3"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "704131571ba93e89d7cd43482277d6632589b18ecf4468f591fbae0a8b101614"
+checksum = "4e4246f76bdeff09eb48875a0fd3e2af6aada79d409d33011886d3e1581517d9"
 
 [[package]]
 name = "windows_x86_64_gnullvm"
@@ -3268,9 +3239,9 @@ checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"
 
 [[package]]
 name = "windows_x86_64_gnullvm"
-version = "0.52.3"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42079295511643151e98d61c38c0acc444e52dd42ab456f7ccfd5152e8ecf21c"
+checksum = "852298e482cd67c356ddd9570386e2862b5673c85bd5f88df9ab6802b334c596"
 
 [[package]]
 name = "windows_x86_64_msvc"
@@ -3286,9 +3257,9 @@ checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
 
 [[package]]
 name = "windows_x86_64_msvc"
-version = "0.52.3"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0770833d60a970638e989b3fa9fd2bb1aaadcf88963d1659fd7d9990196ed2d6"
+checksum = "bec47e5bfd1bff0eeaf6d8b485cc1074891a197ab4225d504cb7a1ab88b02bf0"
 
 [[package]]
 name = "winreg"
@@ -3325,9 +3296,29 @@ checksum = "09041cd90cf85f7f8b2df60c646f853b7f535ce68f85244eb6731cf89fa498ec"
 
 [[package]]
 name = "yansi"
-version = "1.0.0-rc.1"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cfe53a6657fd280eaa890a3bc59152892ffa3e30101319d168b781ed6529b049"
+
+[[package]]
+name = "zerocopy"
+version = "0.7.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1367295b8f788d371ce2dbc842c7b709c73ee1364d30351dd300ec2203b12377"
+checksum = "ae87e3fcd617500e5d106f0380cf7b77f3c6092aae37191433159dda23cfb087"
+dependencies = [
+ "zerocopy-derive",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.7.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "15e934569e47891f7d9411f1a451d947a60e000ab3bd24fbb970f000387d1b3b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.63",
+]
 
 [[package]]
 name = "zeroize"

From 3e0c0e6fa1b9102de003f3ff35ea5e41136e92c9 Mon Sep 17 00:00:00 2001
From: Jan Starke <jan.starke@posteo.de>
Date: Wed, 15 May 2024 14:26:09 +0200
Subject: [PATCH 17/35] fix two clippy complaints in pf2bodyfile

---
 src/bin/pf2bodyfile/main.rs | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/src/bin/pf2bodyfile/main.rs b/src/bin/pf2bodyfile/main.rs
index 51d1ad7..34dd336 100644
--- a/src/bin/pf2bodyfile/main.rs
+++ b/src/bin/pf2bodyfile/main.rs
@@ -30,13 +30,11 @@ fn main() -> anyhow::Result<()> {
                         let created = virtual_file
                             .metadata()?
                             .created_opt()
-                            .map(|t| i64::try_from(*t).ok())
-                            .flatten();
+                            .and_then(|t| i64::try_from(*t).ok());
                         let modified = virtual_file
                             .metadata()?
                             .modified_opt()
-                            .map(|t| i64::try_from(*t).ok())
-                            .flatten();
+                            .and_then(|t| i64::try_from(*t).ok());
                         let pf_file = read_prefetch_file(pf_filename, virtual_file)?;
 
                         pf_file.display_prefetch_file(

From b0da727c52b450dc1ec2162ef3ac4c1e65d8c956 Mon Sep 17 00:00:00 2001
From: Jan Starke <jan.starke@posteo.de>
Date: Thu, 16 May 2024 10:03:54 +0200
Subject: [PATCH 18/35] fix deprecated functions

---
 src/common/forensics_timestamp.rs | 34 ++++++++++++++++++++-----------
 src/es4forensics/timestamp.rs     | 11 ++++------
 2 files changed, 26 insertions(+), 19 deletions(-)

diff --git a/src/common/forensics_timestamp.rs b/src/common/forensics_timestamp.rs
index 6027faa..85eed29 100644
--- a/src/common/forensics_timestamp.rs
+++ b/src/common/forensics_timestamp.rs
@@ -2,7 +2,7 @@ use std::fmt::Display;
 
 use chrono::format::StrftimeItems;
 use chrono::offset::TimeZone;
-use chrono::{DateTime, FixedOffset, LocalResult, NaiveDateTime};
+use chrono::{DateTime, FixedOffset};
 use chrono_tz::Tz;
 use lazy_static::lazy_static;
 
@@ -66,17 +66,11 @@ impl ForensicsTimestamp {
 impl Display for ForensicsTimestamp {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
         if self.unix_ts >= 0 {
-            let src_timestamp = match self.src_zone.from_local_datetime(
-                &NaiveDateTime::from_timestamp_opt(self.unix_ts, 0).unwrap_or_else(|| {
-                    panic!("unable to convert '{}' into unix timestamp", self.unix_ts)
-                }),
-            ) {
-                LocalResult::None => {
-                    panic!("INVALID DATETIME");
-                }
-                LocalResult::Single(t) => t,
-                LocalResult::Ambiguous(t1, _t2) => t1,
-            };
+            let src_timestamp = match DateTime::from_timestamp(1715845546, 0) {
+                Some(ts) => ts,
+                None => panic!("unable to convert '{}' into unix timestamp", self.unix_ts),
+            }
+            .with_timezone(&self.src_zone);
 
             Self::display_datetime(&src_timestamp.with_timezone(&self.dst_zone), f)
         } else {
@@ -84,3 +78,19 @@ impl Display for ForensicsTimestamp {
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use chrono_tz::{Europe, UTC};
+
+    use crate::common::ForensicsTimestamp;
+
+    #[test]
+    fn test_time_import() {
+        let ts = ForensicsTimestamp::new(1715845546, Europe::Berlin, Europe::Berlin);
+        assert_eq!(ts.to_string(), "2024-05-16T09:45:46+02:00");
+
+        let ts = ForensicsTimestamp::new(1715845546, Europe::Berlin, UTC);
+        assert_eq!(ts.to_string(), "2024-05-16T07:45:46+00:00");
+    }
+}
diff --git a/src/es4forensics/timestamp.rs b/src/es4forensics/timestamp.rs
index 9d29c86..a093c1d 100644
--- a/src/es4forensics/timestamp.rs
+++ b/src/es4forensics/timestamp.rs
@@ -1,5 +1,5 @@
 use anyhow::{anyhow, Result};
-use chrono::{DateTime, LocalResult, NaiveDateTime, TimeZone, Utc};
+use chrono::{DateTime, TimeZone, Utc};
 use chrono_tz::Tz;
 use serde::Serialize;
 use serde_json::{json, Value};
@@ -36,14 +36,11 @@ impl TryFrom<(i64, &Tz)> for Timestamp {
     type Error = anyhow::Error;
 
     fn try_from((unix_ts, src_tz): (i64, &Tz)) -> Result<Self, Self::Error> {
-        let ts = match src_tz
-            .from_local_datetime(&NaiveDateTime::from_timestamp_opt(unix_ts, 0).unwrap())
-        {
-            LocalResult::None => {
+        let ts = match DateTime::from_timestamp(unix_ts, 0) {
+            Some(ts) => ts.with_timezone(src_tz),
+            None => {
                 return Err(anyhow!("INVALID DATETIME"));
             }
-            LocalResult::Single(t) => t,
-            LocalResult::Ambiguous(t1, _t2) => t1,
         };
         Ok(Self {
             ts: ts.timestamp_millis(),

From 311f26541e0f19b5919c60462fe0c268d75286bb Mon Sep 17 00:00:00 2001
From: Jan Starke <jan.starke@posteo.de>
Date: Thu, 16 May 2024 10:25:04 +0200
Subject: [PATCH 19/35] explicit error handling for calls to metadata()

---
 src/bin/pf2bodyfile/main.rs | 33 +++++++++++++++++----------------
 1 file changed, 17 insertions(+), 16 deletions(-)

diff --git a/src/bin/pf2bodyfile/main.rs b/src/bin/pf2bodyfile/main.rs
index 34dd336..32d3d1a 100644
--- a/src/bin/pf2bodyfile/main.rs
+++ b/src/bin/pf2bodyfile/main.rs
@@ -27,22 +27,23 @@ fn main() -> anyhow::Result<()> {
                 if let Some(pf_os_filename) = input.path().file_name() {
                     if let Some(pf_filename) = pf_os_filename.to_str() {
                         let virtual_file = fs.open(Path::new(&pf_filename.to_string()))?;
-                        let created = virtual_file
-                            .metadata()?
-                            .created_opt()
-                            .and_then(|t| i64::try_from(*t).ok());
-                        let modified = virtual_file
-                            .metadata()?
-                            .modified_opt()
-                            .and_then(|t| i64::try_from(*t).ok());
-                        let pf_file = read_prefetch_file(pf_filename, virtual_file)?;
-
-                        pf_file.display_prefetch_file(
-                            pf_filename,
-                            *cli.include_metrics(),
-                            created,
-                            modified,
-                        )?;
+                        match virtual_file.metadata() {
+                            Ok(metadata) => {
+                                let created = metadata.created_opt().and_then(|t| i64::try_from(*t).ok());
+                                let modified = metadata.modified_opt().and_then(|t| i64::try_from(*t).ok());
+                                let pf_file = read_prefetch_file(pf_filename, virtual_file)?;
+        
+                                pf_file.display_prefetch_file(
+                                    pf_filename,
+                                    *cli.include_metrics(),
+                                    created,
+                                    modified,
+                                )?;
+                            }
+                            Err(why) => {
+                                log::error!("Unable to obtain metadata for {pf_filename}: {why}");
+                            },
+                        }
                     } else {
                         error!("invalid Unicode characters in filename: '{pf_os_filename:?}'")
                     }

From 87466575bff9bc0a2c234b427a0735ca919bdc3e Mon Sep 17 00:00:00 2001
From: Jan Starke <jan.starke@posteo.de>
Date: Thu, 16 May 2024 10:34:29 +0200
Subject: [PATCH 20/35] handle missing timestamps

---
 src/bin/pf2bodyfile/main.rs | 30 ++++++++++++++++++------------
 1 file changed, 18 insertions(+), 12 deletions(-)

diff --git a/src/bin/pf2bodyfile/main.rs b/src/bin/pf2bodyfile/main.rs
index 32d3d1a..c33b661 100644
--- a/src/bin/pf2bodyfile/main.rs
+++ b/src/bin/pf2bodyfile/main.rs
@@ -27,23 +27,29 @@ fn main() -> anyhow::Result<()> {
                 if let Some(pf_os_filename) = input.path().file_name() {
                     if let Some(pf_filename) = pf_os_filename.to_str() {
                         let virtual_file = fs.open(Path::new(&pf_filename.to_string()))?;
+                        let created;
+                        let modified;
                         match virtual_file.metadata() {
                             Ok(metadata) => {
-                                let created = metadata.created_opt().and_then(|t| i64::try_from(*t).ok());
-                                let modified = metadata.modified_opt().and_then(|t| i64::try_from(*t).ok());
-                                let pf_file = read_prefetch_file(pf_filename, virtual_file)?;
-        
-                                pf_file.display_prefetch_file(
-                                    pf_filename,
-                                    *cli.include_metrics(),
-                                    created,
-                                    modified,
-                                )?;
+                                created =
+                                    metadata.created_opt().and_then(|t| i64::try_from(*t).ok());
+                                modified =
+                                    metadata.modified_opt().and_then(|t| i64::try_from(*t).ok());
                             }
                             Err(why) => {
-                                log::error!("Unable to obtain metadata for {pf_filename}: {why}");
-                            },
+                                log::warn!("Unable to obtain metadata for {pf_filename}: {why}");
+                                created = None;
+                                modified = None;
+                            }
                         }
+                        let pf_file = read_prefetch_file(pf_filename, virtual_file).unwrap();
+
+                        pf_file.display_prefetch_file(
+                            pf_filename,
+                            *cli.include_metrics(),
+                            created,
+                            modified,
+                        )?;
                     } else {
                         error!("invalid Unicode characters in filename: '{pf_os_filename:?}'")
                     }

From 972c49d61746c804b0daf7a69a92cc93828204d9 Mon Sep 17 00:00:00 2001
From: Jan Starke <jan.starke@posteo.de>
Date: Thu, 16 May 2024 11:36:01 +0200
Subject: [PATCH 21/35] require more recent rust version

---
 Cargo.toml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/Cargo.toml b/Cargo.toml
index afa24e9..3fc303a 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -7,6 +7,10 @@ description = "CLI tools for digital forensics and incident response"
 repository = "https://github.com/dfir-dd/dfir-toolkit"
 license = "GPL-3.0"
 
+# this version is required, because earlier versions handle missing `created`
+# timestamps as `Uncategorized`, instead of `Unsupported`
+rust-version = "1.78"
+
 [package.metadata.deb]
 maintainer-scripts = "scripts/maintainer"
 

From d36d153f01b8470a67657fab35f356b0da0e418e Mon Sep 17 00:00:00 2001
From: Jan Starke <7724055+janstarke@users.noreply.github.com>
Date: Thu, 16 May 2024 17:08:14 +0200
Subject: [PATCH 22/35] Update Cargo.toml

---
 Cargo.toml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Cargo.toml b/Cargo.toml
index 3fc303a..666bdaa 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "dfir-toolkit"
-version = "0.10.3"
+version = "0.10.4"
 edition = "2021"
 authors = ["Jan Starke <jan.starke@posteo.de>", "Deborah Mahn <deborah.mahn@dfir-dd.de>"]
 description = "CLI tools for digital forensics and incident response"

From 0703f9d26a138be807c6f585b7108f3e7fb2c3fc Mon Sep 17 00:00:00 2001
From: Jan Starke <jan.starke@posteo.de>
Date: Fri, 17 May 2024 09:18:22 +0200
Subject: [PATCH 23/35] fix complaint about inefficient clone method

---
 Cargo.lock                       | 80 ++++++++++++++++----------------
 src/common/bodyfile/bodyfile3.rs |  2 +-
 2 files changed, 41 insertions(+), 41 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 749e8b1..09099c0 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -441,7 +441,7 @@ dependencies = [
  "heck 0.5.0",
  "proc-macro2",
  "quote",
- "syn 2.0.63",
+ "syn 2.0.64",
 ]
 
 [[package]]
@@ -608,12 +608,12 @@ dependencies = [
 
 [[package]]
 name = "darling"
-version = "0.20.8"
+version = "0.20.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "54e36fcd13ed84ffdfda6f5be89b31287cbb80c439841fe69e04841435464391"
+checksum = "83b2eb4d90d12bdda5ed17de686c2acb4c57914f8f921b8da7e112b5a36f3fe1"
 dependencies = [
- "darling_core 0.20.8",
- "darling_macro 0.20.8",
+ "darling_core 0.20.9",
+ "darling_macro 0.20.9",
 ]
 
 [[package]]
@@ -632,16 +632,16 @@ dependencies = [
 
 [[package]]
 name = "darling_core"
-version = "0.20.8"
+version = "0.20.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c2cf1c23a687a1feeb728783b993c4e1ad83d99f351801977dd809b48d0a70f"
+checksum = "622687fe0bac72a04e5599029151f5796111b90f1baaa9b544d807a5e31cd120"
 dependencies = [
  "fnv",
  "ident_case",
  "proc-macro2",
  "quote",
- "strsim 0.10.0",
- "syn 2.0.63",
+ "strsim 0.11.1",
+ "syn 2.0.64",
 ]
 
 [[package]]
@@ -657,13 +657,13 @@ dependencies = [
 
 [[package]]
 name = "darling_macro"
-version = "0.20.8"
+version = "0.20.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a668eda54683121533a393014d8692171709ff57a7d61f187b6e782719f8933f"
+checksum = "733cabb43482b1a1b53eee8583c2b9e8684d592215ea83efd305dd31bc2f0178"
 dependencies = [
- "darling_core 0.20.8",
+ "darling_core 0.20.9",
  "quote",
- "syn 2.0.63",
+ "syn 2.0.64",
 ]
 
 [[package]]
@@ -688,7 +688,7 @@ dependencies = [
 
 [[package]]
 name = "dfir-toolkit"
-version = "0.10.3"
+version = "0.10.4"
 dependencies = [
  "anyhow",
  "assert-json-diff",
@@ -756,7 +756,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "efc96511560e4661da0ada6debede9ed1dc63d8ac2ad8cefc00434e351a8b509"
 dependencies = [
  "anyhow",
- "darling 0.20.8",
+ "darling 0.20.9",
  "evtx",
  "log",
  "quote",
@@ -770,11 +770,11 @@ version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "37be4820fae21cbed1f691dffcb02969b673bfeef4bd3fdee8cb175d1ca27023"
 dependencies = [
- "darling 0.20.8",
+ "darling 0.20.9",
  "dfirtk-eventdata",
  "proc-macro2",
  "quote",
- "syn 2.0.63",
+ "syn 2.0.64",
 ]
 
 [[package]]
@@ -830,9 +830,9 @@ checksum = "0d6ef0072f8a535281e4876be788938b528e9a1d43900b82c2569af7da799125"
 
 [[package]]
 name = "either"
-version = "1.11.0"
+version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a47c1c47d2f5964e29c61246e81db715514cd532db6b5116a25ea3c03d6780a2"
+checksum = "3dca9240753cf90908d7e4aac30f630662b02aebaa1b58a3cadabdb23385b58b"
 
 [[package]]
 name = "elasticsearch"
@@ -1115,7 +1115,7 @@ checksum = "87750cf4b7a4c0625b1529e4c543c2182106e4dedc60a2a6455e00d212c489ac"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.63",
+ "syn 2.0.64",
 ]
 
 [[package]]
@@ -1160,9 +1160,9 @@ dependencies = [
 
 [[package]]
 name = "getrandom"
-version = "0.2.15"
+version = "0.2.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c4567c8db10ae91089c99af84c68c38da3ec2f087c3f82960bcdbf3656b6f4d7"
+checksum = "94b22e06ecb0110981051723910cbf0b5f5e09a2062dd7663334ee79a9d1286c"
 dependencies = [
  "cfg-if",
  "libc",
@@ -1474,7 +1474,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "regex",
- "syn 2.0.63",
+ "syn 2.0.64",
 ]
 
 [[package]]
@@ -1485,15 +1485,15 @@ checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
 
 [[package]]
 name = "libc"
-version = "0.2.154"
+version = "0.2.153"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ae743338b92ff9146ce83992f766a31066a91a8c84a45e0e9f21e7cf6de6d346"
+checksum = "9c198f91728a82281a64e1f4f9eeb25d82cb32a5de251c6bd1b5154d63a8e7bd"
 
 [[package]]
 name = "linux-raw-sys"
-version = "0.4.13"
+version = "0.4.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "01cda141df6706de531b6c46c3a33ecca755538219bd484262fa09410c13539c"
+checksum = "78b3ae25bc7c8c38cec158d1f2757ee79e9b3740fbc7ccf0e59e4b08d793fa89"
 
 [[package]]
 name = "lnk"
@@ -1687,7 +1687,7 @@ checksum = "ed3955f1a9c7c0c15e092f9c887db08b1fc683305fdf6eb6684f22555355e202"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.63",
+ "syn 2.0.64",
 ]
 
 [[package]]
@@ -1799,7 +1799,7 @@ checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.63",
+ "syn 2.0.64",
 ]
 
 [[package]]
@@ -1842,7 +1842,7 @@ dependencies = [
  "proc-macro2",
  "proc-macro2-diagnostics",
  "quote",
- "syn 2.0.63",
+ "syn 2.0.64",
 ]
 
 [[package]]
@@ -2050,7 +2050,7 @@ checksum = "af066a9c399a26e020ada66a034357a868728e72cd426f3adcd35f80d88d88c8"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.63",
+ "syn 2.0.64",
  "version_check",
  "yansi 1.0.1",
 ]
@@ -2366,7 +2366,7 @@ checksum = "6048858004bcff69094cd972ed40a32500f153bd3be9f716b2eed2e8217c4838"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.63",
+ "syn 2.0.64",
 ]
 
 [[package]]
@@ -2543,7 +2543,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "rustversion",
- "syn 2.0.63",
+ "syn 2.0.64",
 ]
 
 [[package]]
@@ -2559,9 +2559,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.63"
+version = "2.0.64"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf5be731623ca1a1fb7d8be6f261a3be6d3e2337b8a1f97be944d020c8fcb704"
+checksum = "7ad3dee41f36859875573074334c200d1add8e4a87bb37113ebd31d926b7b11f"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2685,7 +2685,7 @@ checksum = "e2470041c06ec3ac1ab38d0356a6119054dedaea53e12fbefc0de730a1c08524"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.63",
+ "syn 2.0.64",
 ]
 
 [[package]]
@@ -2769,7 +2769,7 @@ checksum = "5b8a1e28f2deaa14e508979454cb3a223b10b938b45af148bc0986de36f1923b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.63",
+ "syn 2.0.64",
 ]
 
 [[package]]
@@ -2958,7 +2958,7 @@ dependencies = [
  "once_cell",
  "proc-macro2",
  "quote",
- "syn 2.0.63",
+ "syn 2.0.64",
  "wasm-bindgen-shared",
 ]
 
@@ -2992,7 +2992,7 @@ checksum = "e94f17b526d0a461a191c78ea52bbce64071ed5c04c9ffe424dcb38f74171bb7"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.63",
+ "syn 2.0.64",
  "wasm-bindgen-backend",
  "wasm-bindgen-shared",
 ]
@@ -3317,7 +3317,7 @@ checksum = "15e934569e47891f7d9411f1a451d947a60e000ab3bd24fbb970f000387d1b3b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.63",
+ "syn 2.0.64",
 ]
 
 [[package]]
diff --git a/src/common/bodyfile/bodyfile3.rs b/src/common/bodyfile/bodyfile3.rs
index 009c810..e21440e 100644
--- a/src/common/bodyfile/bodyfile3.rs
+++ b/src/common/bodyfile/bodyfile3.rs
@@ -75,7 +75,7 @@ impl Bodyfile3Line {
         [with_mode]   [mode_as_string];
     )]
     pub fn method_name(mut self, attribute_name: &str) -> Self {
-        self.attribute_name = attribute_name.to_owned();
+        attribute_name.clone_into(&mut self.attribute_name);
         self
     }
 

From ed01e15ecffe7be706673977a8c607f0c92db40a Mon Sep 17 00:00:00 2001
From: Jan Starke <jan.starke@posteo.de>
Date: Fri, 17 May 2024 09:23:36 +0200
Subject: [PATCH 24/35] simplified test output

---
 src/bin/mactime2/output/csv_output.rs | 15 ++++++---------
 src/bin/mactime2/output/txt_output.rs | 15 ++++++---------
 2 files changed, 12 insertions(+), 18 deletions(-)

diff --git a/src/bin/mactime2/output/csv_output.rs b/src/bin/mactime2/output/csv_output.rs
index 7bf74c7..f0662a5 100644
--- a/src/bin/mactime2/output/csv_output.rs
+++ b/src/bin/mactime2/output/csv_output.rs
@@ -63,14 +63,12 @@ mod tests {
 
             let out_line = output.fmt(&unix_ts, &entry);
             let out_ts = out_line.split(',').next().unwrap();
-            let rfc3339 = DateTime::parse_from_rfc3339(out_ts).expect(out_ts);
+            let rfc3339 = DateTime::parse_from_rfc3339(out_ts)
+                .expect(out_ts)
+                .timestamp();
             assert_eq!(
-                unix_ts,
-                rfc3339.timestamp(),
-                "Timestamp {} converted to '{}' and back to {}",
-                unix_ts,
-                out_ts,
-                rfc3339.timestamp()
+                unix_ts, rfc3339,
+                "Timestamp {unix_ts} converted to '{out_ts}' and back to {rfc3339}",
             );
         }
     }
@@ -98,8 +96,7 @@ mod tests {
             let calculated_ts = rfc3339.timestamp() + offset;
             assert_eq!(
                 unix_ts, calculated_ts,
-                "Timestamp {} converted to '{}' and back to {} (offset was {}s)",
-                unix_ts, out_ts, calculated_ts, offset
+                "Timestamp {unix_ts} converted to '{out_ts}' and back to {calculated_ts} (offset was {offset}s)",
             );
         }
         Ok(())
diff --git a/src/bin/mactime2/output/txt_output.rs b/src/bin/mactime2/output/txt_output.rs
index 97330eb..4b3d2ed 100644
--- a/src/bin/mactime2/output/txt_output.rs
+++ b/src/bin/mactime2/output/txt_output.rs
@@ -79,14 +79,12 @@ mod tests {
             assert!(out_line2.starts_with(' '));
 
             let out_ts = out_line.split(' ').next().unwrap();
-            let rfc3339 = DateTime::parse_from_rfc3339(out_ts).expect(out_ts);
+            let rfc3339 = DateTime::parse_from_rfc3339(out_ts)
+                .expect(out_ts)
+                .timestamp();
             assert_eq!(
-                unix_ts,
-                rfc3339.timestamp(),
-                "Timestamp {} converted to '{}' and back to {}",
-                unix_ts,
-                out_ts,
-                rfc3339.timestamp()
+                unix_ts, rfc3339,
+                "Timestamp {unix_ts} converted to '{out_ts}' and back to {rfc3339}",
             );
         }
     }
@@ -117,8 +115,7 @@ mod tests {
             let calculated_ts = rfc3339.timestamp() + offset;
             assert_eq!(
                 unix_ts, calculated_ts,
-                "Timestamp {} converted to '{}' and back to {} (offset was {}s)",
-                unix_ts, out_ts, calculated_ts, offset
+                "Timestamp {unix_ts} converted to '{out_ts}' and back to {calculated_ts} (offset was {offset}s)",
             );
         }
         Ok(())

From e690550b444ae3a538072d0792a5a06c7d369739 Mon Sep 17 00:00:00 2001
From: Jan Starke <jan.starke@posteo.de>
Date: Fri, 17 May 2024 09:26:48 +0200
Subject: [PATCH 25/35] fix: ForensicsTimestamp had hard coded timestamp

---
 src/common/forensics_timestamp.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/common/forensics_timestamp.rs b/src/common/forensics_timestamp.rs
index 85eed29..df3ef8f 100644
--- a/src/common/forensics_timestamp.rs
+++ b/src/common/forensics_timestamp.rs
@@ -66,7 +66,7 @@ impl ForensicsTimestamp {
 impl Display for ForensicsTimestamp {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
         if self.unix_ts >= 0 {
-            let src_timestamp = match DateTime::from_timestamp(1715845546, 0) {
+            let src_timestamp = match DateTime::from_timestamp(self.unix_ts, 0) {
                 Some(ts) => ts,
                 None => panic!("unable to convert '{}' into unix timestamp", self.unix_ts),
             }

From bf4bb63c893fb65f65f3c9860cddb28910ece59e Mon Sep 17 00:00:00 2001
From: Jan Starke <jan.starke@posteo.de>
Date: Fri, 17 May 2024 11:40:26 +0200
Subject: [PATCH 26/35] don't support source timestamps anymore

---
 src/bin/mactime2/application.rs            |  8 +---
 src/bin/mactime2/cli.rs                    |  4 --
 src/bin/mactime2/filter.rs                 |  3 --
 src/bin/mactime2/main.rs                   |  3 +-
 src/bin/mactime2/output/csv_output.rs      | 11 +++--
 src/bin/mactime2/output/json_sorter.rs     | 12 ++----
 src/bin/mactime2/output/txt_output.rs      | 13 +++---
 src/bin/ts2date/main.rs                    |  3 +-
 src/common/forensics_timestamp.rs          | 48 +++++++++++++---------
 src/es4forensics/ecs/objects/posix_file.rs |  7 ----
 10 files changed, 48 insertions(+), 64 deletions(-)

diff --git a/src/bin/mactime2/application.rs b/src/bin/mactime2/application.rs
index e4fffcd..05d57e8 100644
--- a/src/bin/mactime2/application.rs
+++ b/src/bin/mactime2/application.rs
@@ -40,7 +40,6 @@ pub (crate) enum OutputFormat {
 pub struct Mactime2Application {
     format: OutputFormat,
     bodyfile: Input,
-    src_zone: Tz,
     dst_zone: Tz,
     strict_mode: bool,
 }
@@ -52,7 +51,6 @@ impl Mactime2Application {
     ) -> Box<dyn Sorter<Result<(), MactimeError>>> {
         let options = RunOptions {
             strict_mode: self.strict_mode,
-            src_zone: self.src_zone,
         };
 
         if matches!(self.format, OutputFormat::Json) {
@@ -62,8 +60,8 @@ impl Mactime2Application {
                 BodyfileSorter::default().with_receiver(decoder.get_receiver(), options);
 
             sorter = sorter.with_output(match self.format {
-                OutputFormat::Csv => Box::new(CsvOutput::new(self.src_zone, self.dst_zone)),
-                OutputFormat::Txt => Box::new(TxtOutput::new(self.src_zone, self.dst_zone)),
+                OutputFormat::Csv => Box::new(CsvOutput::new(self.dst_zone)),
+                OutputFormat::Txt => Box::new(TxtOutput::new(self.dst_zone)),
                 _ => panic!("invalid execution path"),
             });
             Box::new(sorter)
@@ -73,7 +71,6 @@ impl Mactime2Application {
     pub fn run(&self) -> anyhow::Result<()> {
         let options = RunOptions {
             strict_mode: self.strict_mode,
-            src_zone: self.src_zone,
         };
 
         let mut reader = <BodyfileReader as StreamReader<String, ()>>::from(self.bodyfile.clone())?;
@@ -106,7 +103,6 @@ impl From<Cli> for Mactime2Application {
         Self {
             format,
             bodyfile: cli.input_file,
-            src_zone: cli.src_zone.into_tz().unwrap(),
             dst_zone: cli.dst_zone.into_tz().unwrap(),
             strict_mode: cli.strict_mode,
         }
diff --git a/src/bin/mactime2/cli.rs b/src/bin/mactime2/cli.rs
index ce87c36..5213f82 100644
--- a/src/bin/mactime2/cli.rs
+++ b/src/bin/mactime2/cli.rs
@@ -40,10 +40,6 @@ pub struct Cli {
     #[clap(short('j'), display_order(620))]
     pub(crate) json_format: bool,
 
-    /// name of offset of source timezone (or 'list' to display all possible values
-    #[clap(short('f'), long("from-timezone"), display_order(300), default_value_t=TzArgument::Tz(Tz::UTC))]
-    pub src_zone: TzArgument,
-
     /// name of offset of destination timezone (or 'list' to display all possible values
     #[clap(short('t'), long("to-timezone"), display_order(400), default_value_t=TzArgument::Tz(Tz::UTC))]
     pub dst_zone: TzArgument,
diff --git a/src/bin/mactime2/filter.rs b/src/bin/mactime2/filter.rs
index bd186a0..29b677a 100644
--- a/src/bin/mactime2/filter.rs
+++ b/src/bin/mactime2/filter.rs
@@ -1,11 +1,8 @@
 use std::sync::mpsc::{Sender, Receiver};
 
-use chrono_tz::Tz;
-
 #[derive(Copy, Clone)]
 pub struct RunOptions {
     pub strict_mode: bool,
-    pub src_zone: Tz
 }
 
 pub trait Provider<To, R>: Joinable<R> {
diff --git a/src/bin/mactime2/main.rs b/src/bin/mactime2/main.rs
index 55769d3..34923e3 100644
--- a/src/bin/mactime2/main.rs
+++ b/src/bin/mactime2/main.rs
@@ -15,12 +15,11 @@ use dfir_toolkit::common::{FancyParser, TzArgument};
 fn main() -> Result<()> {
     let cli: Cli = Cli::parse_cli();
 
-    if cli.src_zone.is_list() || cli.dst_zone.is_list() {
+    if cli.dst_zone.is_list() {
         TzArgument::display_zones();
         return Ok(());
     }
     debug_assert!(cli.dst_zone.is_tz());
-    debug_assert!(cli.src_zone.is_tz());
 
     let app: Mactime2Application = cli.into();
 
diff --git a/src/bin/mactime2/output/csv_output.rs b/src/bin/mactime2/output/csv_output.rs
index f0662a5..b88e16b 100644
--- a/src/bin/mactime2/output/csv_output.rs
+++ b/src/bin/mactime2/output/csv_output.rs
@@ -4,19 +4,18 @@ use dfir_toolkit::common::ForensicsTimestamp;
 use crate::bodyfile::{ListEntry, Mactime2Writer};
 
 pub(crate) struct CsvOutput {
-    src_zone: Tz,
     dst_zone: Tz,
 }
 
 impl CsvOutput {
-    pub fn new(src_zone: Tz, dst_zone: Tz) -> Self {
-        Self { src_zone, dst_zone }
+    pub fn new(dst_zone: Tz) -> Self {
+        Self { dst_zone }
     }
 }
 
 impl Mactime2Writer for CsvOutput {
     fn fmt(&self, timestamp: &i64, entry: &ListEntry) -> String {
-        let timestamp = ForensicsTimestamp::new(*timestamp, self.src_zone, self.dst_zone);
+        let timestamp = ForensicsTimestamp::from(*timestamp).with_timezone(self.dst_zone);
         format!(
             "{},{},{},{},{},{},{},\"{}\"",
             timestamp,
@@ -52,7 +51,7 @@ mod tests {
     #[allow(non_snake_case)]
     #[test]
     fn test_correct_ts_UTC() {
-        let output = CsvOutput::new(Tz::UTC, Tz::UTC);
+        let output = CsvOutput::new(Tz::UTC);
         for _ in 1..10 {
             let unix_ts = rand::random::<u32>() as i64;
             let bf_line = Bodyfile3Line::new().with_crtime(unix_ts.into());
@@ -78,7 +77,7 @@ mod tests {
     fn test_correct_ts_random_tz() -> Result<(), String> {
         for _ in 1..100 {
             let tz = random_tz();
-            let output = CsvOutput::new(tz, tz);
+            let output = CsvOutput::new(tz);
             let unix_ts = rand::random::<u32>() as i64;
             let bf_line = Bodyfile3Line::new().with_crtime(unix_ts.into());
             let entry = ListEntry {
diff --git a/src/bin/mactime2/output/json_sorter.rs b/src/bin/mactime2/output/json_sorter.rs
index a001a1b..a80b754 100644
--- a/src/bin/mactime2/output/json_sorter.rs
+++ b/src/bin/mactime2/output/json_sorter.rs
@@ -5,7 +5,6 @@ use std::{
     thread::JoinHandle,
 };
 
-use chrono_tz::Tz;
 use dfir_toolkit::{
     common::bodyfile::Bodyfile3Line,
     es4forensics::{objects::PosixFile, Timestamp, TimelineObject},
@@ -20,7 +19,6 @@ use crate::{
 pub struct JsonSorter {
     worker: Option<JoinHandle<Result<(), MactimeError>>>,
     receiver: Option<Receiver<Bodyfile3Line>>,
-    src_zone: Tz,
 }
 
 impl Joinable<Result<(), MactimeError>> for JsonSorter {
@@ -30,11 +28,10 @@ impl Joinable<Result<(), MactimeError>> for JsonSorter {
 }
 
 impl Consumer<Bodyfile3Line> for JsonSorter {
-    fn with_receiver(previous: Receiver<Bodyfile3Line>, options: RunOptions) -> Self {
+    fn with_receiver(previous: Receiver<Bodyfile3Line>, _options: RunOptions) -> Self {
         Self {
             receiver: Some(previous),
             worker: None,
-            src_zone: options.src_zone,
         }
     }
 }
@@ -45,9 +42,8 @@ impl Runnable for JsonSorter {
             .receiver
             .take()
             .expect("no receiver provided; please call with_receiver()");
-        let src_zone = self.src_zone;
         self.worker = Some(std::thread::spawn(move || {
-            Self::json_worker(receiver, src_zone)
+            Self::json_worker(receiver)
         }));
     }
 }
@@ -55,7 +51,7 @@ impl Runnable for JsonSorter {
 impl Sorter<Result<(), MactimeError>> for JsonSorter {}
 
 impl JsonSorter {
-    fn json_worker(decoder: Receiver<Bodyfile3Line>, src_zone: Tz) -> Result<(), MactimeError> {
+    fn json_worker(decoder: Receiver<Bodyfile3Line>) -> Result<(), MactimeError> {
         let mut entries: BTreeMap<Timestamp, BTreeSet<String>> = BTreeMap::new();
         loop {
             let line = Arc::new(match decoder.recv() {
@@ -66,7 +62,7 @@ impl JsonSorter {
             });
 
             let bfline: &Bodyfile3Line = line.borrow();
-            let pf = PosixFile::try_from((bfline, &src_zone)).unwrap();
+            let pf = PosixFile::try_from(bfline).unwrap();
 
             let lines: Vec<(Timestamp, String)> = pf
                 .into_tuples()
diff --git a/src/bin/mactime2/output/txt_output.rs b/src/bin/mactime2/output/txt_output.rs
index 4b3d2ed..c002168 100644
--- a/src/bin/mactime2/output/txt_output.rs
+++ b/src/bin/mactime2/output/txt_output.rs
@@ -5,16 +5,14 @@ use std::cell::RefCell;
 use crate::bodyfile::{ListEntry, Mactime2Writer};
 
 pub struct TxtOutput {
-    src_zone: Tz,
     dst_zone: Tz,
     last_ts: (RefCell<i64>, RefCell<String>),
     empty_ts: RefCell<String>,
 }
 
 impl TxtOutput {
-    pub fn new(src_zone: Tz, dst_zone: Tz) -> Self {
+    pub fn new(dst_zone: Tz) -> Self {
         Self {
-            src_zone,
             dst_zone,
             last_ts: (RefCell::new(i64::MIN), RefCell::new("".to_owned())),
             empty_ts: RefCell::new("                         ".to_owned()),
@@ -25,8 +23,9 @@ impl TxtOutput {
 impl Mactime2Writer for TxtOutput {
     fn fmt(&self, timestamp: &i64, entry: &ListEntry) -> String {
         let ts = if *timestamp != *self.last_ts.0.borrow() {
-            *self.last_ts.1.borrow_mut() =
-                ForensicsTimestamp::new(*timestamp, self.src_zone, self.dst_zone).to_string();
+            *self.last_ts.1.borrow_mut() = ForensicsTimestamp::from(*timestamp)
+                .with_timezone(self.dst_zone)
+                .to_string();
             *self.last_ts.0.borrow_mut() = *timestamp;
             self.last_ts.1.borrow()
         } else {
@@ -65,7 +64,7 @@ mod tests {
     #[allow(non_snake_case)]
     #[test]
     fn test_correct_ts_UTC() {
-        let output = TxtOutput::new(Tz::UTC, Tz::UTC);
+        let output = TxtOutput::new(Tz::UTC);
         for _ in 1..10 {
             let unix_ts = rand::random::<u32>() as i64;
             let bf_line = Bodyfile3Line::new().with_crtime(Created::from(unix_ts));
@@ -94,7 +93,7 @@ mod tests {
     fn test_correct_ts_random_tz() -> Result<(), String> {
         for _ in 1..100 {
             let tz = random_tz();
-            let output = TxtOutput::new(tz, tz);
+            let output = TxtOutput::new(tz);
             let unix_ts = rand::random::<u32>() as i64;
             let bf_line = Bodyfile3Line::new().with_crtime(Created::from(unix_ts));
             let entry = ListEntry {
diff --git a/src/bin/ts2date/main.rs b/src/bin/ts2date/main.rs
index b60c7f8..3d5ea71 100644
--- a/src/bin/ts2date/main.rs
+++ b/src/bin/ts2date/main.rs
@@ -28,8 +28,7 @@ fn main() -> Result<()> {
 
         let out = match re.captures(&content) {
             Some(caps) => {
-                //let ndt = NaiveDateTime::from_timestamp_opt(caps.name("ts").unwrap().as_str().parse::<i64>().unwrap(),0).unwrap();
-                let ts = ForensicsTimestamp::new(caps.name("ts").unwrap().as_str().parse::<i64>().unwrap(),cli.src_zone.into_tz().unwrap(), cli.dst_zone.into_tz().unwrap());
+                let ts = ForensicsTimestamp::from(caps.name("ts").unwrap().as_str().parse::<i64>().unwrap()).with_timezone(cli.dst_zone.into_tz().unwrap());
                 format!("{}{}{}", caps.name("lhs").unwrap().as_str(),
                                             ts,
                                             caps.name("rhs").unwrap().as_str())
diff --git a/src/common/forensics_timestamp.rs b/src/common/forensics_timestamp.rs
index df3ef8f..2b7e09e 100644
--- a/src/common/forensics_timestamp.rs
+++ b/src/common/forensics_timestamp.rs
@@ -2,7 +2,7 @@ use std::fmt::Display;
 
 use chrono::format::StrftimeItems;
 use chrono::offset::TimeZone;
-use chrono::{DateTime, FixedOffset};
+use chrono::{DateTime, FixedOffset, Utc};
 use chrono_tz::Tz;
 use lazy_static::lazy_static;
 
@@ -35,20 +35,40 @@ lazy_static! {
 }
 
 pub struct ForensicsTimestamp {
-    unix_ts: i64,
-    src_zone: Tz,
+    timestamp: DateTime<Utc>,
     dst_zone: Tz,
 }
 
+impl From<i64> for ForensicsTimestamp {
+    fn from(value: i64) -> Self {
+        let timestamp = match DateTime::from_timestamp(value, 0) {
+            Some(ts) => ts,
+            None => panic!("unable to convert '{value}' into unix timestamp"),
+        };
+        Self {
+            timestamp,
+            dst_zone: Tz::UTC,
+        }
+    }
+}
+
 impl ForensicsTimestamp {
-    pub fn new(unix_ts: i64, src_zone: Tz, dst_zone: Tz) -> Self {
+    pub fn new(unix_ts: i64, dst_zone: Tz) -> Self {
+        let timestamp = match DateTime::from_timestamp(unix_ts, 0) {
+            Some(ts) => ts,
+            None => panic!("unable to convert '{unix_ts}' into unix timestamp"),
+        };
         Self {
-            unix_ts,
-            src_zone,
+            timestamp,
             dst_zone,
         }
     }
 
+    pub fn with_timezone(mut self, dst_zone: Tz) -> Self {
+        self.dst_zone = dst_zone;
+        self
+    }
+
     fn display_datetime<TZ: TimeZone>(
         dt: &DateTime<TZ>,
         f: &mut std::fmt::Formatter<'_>,
@@ -65,17 +85,7 @@ impl ForensicsTimestamp {
 
 impl Display for ForensicsTimestamp {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        if self.unix_ts >= 0 {
-            let src_timestamp = match DateTime::from_timestamp(self.unix_ts, 0) {
-                Some(ts) => ts,
-                None => panic!("unable to convert '{}' into unix timestamp", self.unix_ts),
-            }
-            .with_timezone(&self.src_zone);
-
-            Self::display_datetime(&src_timestamp.with_timezone(&self.dst_zone), f)
-        } else {
-            Self::display_datetime(&*ZERO, f)
-        }
+        Self::display_datetime(&self.timestamp.with_timezone(&self.dst_zone), f)
     }
 }
 
@@ -87,10 +97,10 @@ mod tests {
 
     #[test]
     fn test_time_import() {
-        let ts = ForensicsTimestamp::new(1715845546, Europe::Berlin, Europe::Berlin);
+        let ts = ForensicsTimestamp::from(1715845546).with_timezone(Europe::Berlin);
         assert_eq!(ts.to_string(), "2024-05-16T09:45:46+02:00");
 
-        let ts = ForensicsTimestamp::new(1715845546, Europe::Berlin, UTC);
+        let ts = ForensicsTimestamp::from(1715845546).with_timezone(UTC);
         assert_eq!(ts.to_string(), "2024-05-16T07:45:46+00:00");
     }
 }
diff --git a/src/es4forensics/ecs/objects/posix_file.rs b/src/es4forensics/ecs/objects/posix_file.rs
index 5b6d961..60ee71c 100644
--- a/src/es4forensics/ecs/objects/posix_file.rs
+++ b/src/es4forensics/ecs/objects/posix_file.rs
@@ -86,13 +86,6 @@ impl IntoIterator for PosixFile {
     }
 }
 
-impl TryFrom<(Bodyfile3Line, &Tz)> for PosixFile {
-    type Error = anyhow::Error;
-    fn try_from((bfline, src_tz): (Bodyfile3Line, &Tz)) -> Result<Self> {
-        Self::try_from((&bfline, src_tz))
-    }
-}
-
 impl TryFrom<Bodyfile3Line> for PosixFile {
     type Error = anyhow::Error;
     fn try_from(bfline: Bodyfile3Line) -> Result<Self> {

From 2a3bc575d5f2fd17908d074dadf0913ca9d48be3 Mon Sep 17 00:00:00 2001
From: Jan Starke <jan.starke@posteo.de>
Date: Fri, 17 May 2024 11:52:16 +0200
Subject: [PATCH 27/35] fix test cases

---
 src/bin/mactime2/output/csv_output.rs |  5 ++---
 src/bin/mactime2/output/txt_output.rs |  5 ++---
 tests/ts2date.rs                      | 23 -----------------------
 3 files changed, 4 insertions(+), 29 deletions(-)

diff --git a/src/bin/mactime2/output/csv_output.rs b/src/bin/mactime2/output/csv_output.rs
index b88e16b..4347b4c 100644
--- a/src/bin/mactime2/output/csv_output.rs
+++ b/src/bin/mactime2/output/csv_output.rs
@@ -91,11 +91,10 @@ mod tests {
                 Ok(ts) => ts,
                 Err(e) => return Err(format!("error while parsing '{}': {}", out_ts, e)),
             };
-            let offset = rfc3339.offset().local_minus_utc() as i64;
-            let calculated_ts = rfc3339.timestamp() + offset;
+            let calculated_ts = rfc3339.timestamp();
             assert_eq!(
                 unix_ts, calculated_ts,
-                "Timestamp {unix_ts} converted to '{out_ts}' and back to {calculated_ts} (offset was {offset}s)",
+                "Timestamp {unix_ts} converted to '{out_ts}' and back to {calculated_ts}",
             );
         }
         Ok(())
diff --git a/src/bin/mactime2/output/txt_output.rs b/src/bin/mactime2/output/txt_output.rs
index c002168..d108d9a 100644
--- a/src/bin/mactime2/output/txt_output.rs
+++ b/src/bin/mactime2/output/txt_output.rs
@@ -110,11 +110,10 @@ mod tests {
                 Ok(ts) => ts,
                 Err(e) => return Err(format!("error while parsing '{}': {}", out_ts, e)),
             };
-            let offset = rfc3339.offset().local_minus_utc() as i64;
-            let calculated_ts = rfc3339.timestamp() + offset;
+            let calculated_ts = rfc3339.timestamp();
             assert_eq!(
                 unix_ts, calculated_ts,
-                "Timestamp {unix_ts} converted to '{out_ts}' and back to {calculated_ts} (offset was {offset}s)",
+                "Timestamp {unix_ts} converted to '{out_ts}' and back to {calculated_ts}",
             );
         }
         Ok(())
diff --git a/tests/ts2date.rs b/tests/ts2date.rs
index bf8db3e..df6c640 100644
--- a/tests/ts2date.rs
+++ b/tests/ts2date.rs
@@ -49,29 +49,6 @@ fn ts2date_utc2berlin() {
     );
 }
 
-#[test]
-fn ts2date_berlin2utc() {
-    const SAMPLE_TIMELINE_OUT: &str = r#"2023-08-30T14:08:37+00:00|REG|||App Paths - protocolhandler.exe - C:\Program Files\WindowsApps\Microsoft.Office.Desktop_16051.16626.20170.0_x86__8wekyb3d8bbwe\Office16\protocolhandler.exe
-2023-08-30T14:08:37+00:00|REG|||App Paths - sdxhelper.exe - C:\Program Files\WindowsApps\Microsoft.Office.Desktop_16051.16626.20170.0_x86__8wekyb3d8bbwe\Office16\SDXHelper.exe
-2023-08-30T14:08:37+00:00|REG|||App Paths - selfcert.exe - C:\Program Files\WindowsApps\Microsoft.Office.Desktop_16051.16626.20170.0_x86__8wekyb3d8bbwe\Office16\SELFCERT.exe
-2023-08-30T14:06:21+00:00|REG|||App Paths - msaccess.exe - C:\Program Files\WindowsApps\Microsoft.Office.Desktop.Access_16051.16626.20170.0_x86__8wekyb3d8bbwe\Office16\MSACCESS.exe
-"#;
-
-    let mut cmd = Command::cargo_bin("ts2date").unwrap();
-    let result = cmd
-        .arg("-f")
-        .arg("Europe/Berlin")
-        .arg("-t")
-        .arg("UTC")
-        .write_stdin(SAMPLE_TIMELINE)
-        .ok();
-    assert!(result.is_ok());
-
-    assert_eq!(
-        SAMPLE_TIMELINE_OUT,
-        String::from_utf8(result.unwrap().stdout).unwrap()
-    );
-}
 
 #[test]
 fn ts2date_list1() {

From d2b18a43cbd79fbd085f0362502516f8b1eb4037 Mon Sep 17 00:00:00 2001
From: Jan Starke <jan.starke@posteo.de>
Date: Fri, 17 May 2024 12:15:46 +0200
Subject: [PATCH 28/35] add warning message to mactime2

---
 src/bin/mactime2/cli.rs | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/src/bin/mactime2/cli.rs b/src/bin/mactime2/cli.rs
index 5213f82..6f2211f 100644
--- a/src/bin/mactime2/cli.rs
+++ b/src/bin/mactime2/cli.rs
@@ -13,9 +13,17 @@ const BODYFILE_HELP: &str =
 #[cfg(not(feature = "gzip"))]
 const BODYFILE_HELP: &str = "path to input file or '-' for stdin";
 
-/// replacement for `mactime`
+/// Replacement for `mactime`
 #[derive(Parser)]
-#[clap(name="mactime2", author, version, long_about = None)]
+#[clap(name="mactime2", author, version, long_about = None, after_help=
+r##"
+╭────────────────────────────────────────────────────────────────────────────╮
+│IMPORTANT:                                                                  │
+│                                                                            │
+│Note that POSIX specifies that all UNIX timestamps are UTC timestamps. It is│
+│up to you to ensure that the bodyfile only contains UNIX timestamps that    │
+│comply with the POSIX standard.                                             │
+╰────────────────────────────────────────────────────────────────────────────╯"##)]
 
 pub struct Cli {
     #[clap(short('b'), value_parser, value_hint=ValueHint::FilePath, default_value="-", help=BODYFILE_HELP, display_order(100))]

From d0cffa7203b84b1e557c8f4edcd139c468204176 Mon Sep 17 00:00:00 2001
From: Jan Starke <jan.starke@posteo.de>
Date: Mon, 10 Jun 2024 13:54:37 +0200
Subject: [PATCH 29/35] update dependencies

---
 Cargo.lock | 1210 ++++++++++++++++++++++++++++------------------------
 Cargo.toml |    3 +-
 2 files changed, 655 insertions(+), 558 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 8d218ea..deaa8be 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4,9 +4,9 @@ version = 3
 
 [[package]]
 name = "addr2line"
-version = "0.21.0"
+version = "0.22.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a30b2e23b9e17a9f90641c7ab1549cd9b44f296d3ccbf309d2863cfe398a0cb"
+checksum = "6e4503c46a5c0c7844e948c9a4d6acd9f50cccb4de1c48eb9e291ea17470c678"
 dependencies = [
  "gimli",
 ]
@@ -28,11 +28,23 @@ dependencies = [
  "cpufeatures",
 ]
 
+[[package]]
+name = "ahash"
+version = "0.8.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e89da841a80418a9b391ebaea17f5c112ffaaa96f621d2c285b5174da76b9011"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+ "version_check",
+ "zerocopy",
+]
+
 [[package]]
 name = "aho-corasick"
-version = "1.1.1"
+version = "1.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ea5d730647d4fadd988536d06fecce94b7b4f2a7efdae548f1cf4b63205518ab"
+checksum = "8e60d3430d3a69478ad0993f19238d2df97c507009a52b3c10addcd7f6bcb916"
 dependencies = [
  "memchr",
 ]
@@ -43,6 +55,12 @@ version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "250f629c0161ad8107cf89319e990051fae62832fd343083bea452d93e2205fd"
 
+[[package]]
+name = "allocator-api2"
+version = "0.2.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c6cb57a04249c6480766f7f7cef5467412af1490f8d1e243141daddada3264f"
+
 [[package]]
 name = "android-tzdata"
 version = "0.1.1"
@@ -60,57 +78,58 @@ dependencies = [
 
 [[package]]
 name = "anstream"
-version = "0.5.0"
+version = "0.6.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b1f58811cfac344940f1a400b6e6231ce35171f614f26439e80f8c1465c5cc0c"
+checksum = "418c75fa768af9c03be99d17643f93f79bbba589895012a80e3452a19ddda15b"
 dependencies = [
  "anstyle",
  "anstyle-parse",
  "anstyle-query",
  "anstyle-wincon",
  "colorchoice",
+ "is_terminal_polyfill",
  "utf8parse",
 ]
 
 [[package]]
 name = "anstyle"
-version = "1.0.3"
+version = "1.0.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b84bf0a05bbb2a83e5eb6fa36bb6e87baa08193c35ff52bbf6b38d8af2890e46"
+checksum = "038dfcf04a5feb68e9c60b21c9625a54c2c0616e79b72b0fd87075a056ae1d1b"
 
 [[package]]
 name = "anstyle-parse"
-version = "0.2.1"
+version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "938874ff5980b03a87c5524b3ae5b59cf99b1d6bc836848df7bc5ada9643c333"
+checksum = "c03a11a9034d92058ceb6ee011ce58af4a9bf61491aa7e1e59ecd24bd40d22d4"
 dependencies = [
  "utf8parse",
 ]
 
 [[package]]
 name = "anstyle-query"
-version = "1.0.0"
+version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ca11d4be1bab0c8bc8734a9aa7bf4ee8316d462a08c6ac5052f888fef5b494b"
+checksum = "ad186efb764318d35165f1758e7dcef3b10628e26d41a44bc5550652e6804391"
 dependencies = [
- "windows-sys 0.48.0",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
 name = "anstyle-wincon"
-version = "2.1.0"
+version = "3.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "58f54d10c6dfa51283a066ceab3ec1ab78d13fae00aa49243a45e4571fb79dfd"
+checksum = "61a38449feb7068f52bb06c12759005cf459ee52bb4adc1d5a7c4322d716fb19"
 dependencies = [
  "anstyle",
- "windows-sys 0.48.0",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
 name = "anyhow"
-version = "1.0.75"
+version = "1.0.86"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4668cab20f66d8d020e1fbc0ebe47217433c1b6c8f2040faf858554e394ace6"
+checksum = "b3d1d046238990b9cf5bcde22a3fb3584ee5cf65fb2765f454ed428c7a0063da"
 
 [[package]]
 name = "assert-json-diff"
@@ -124,9 +143,9 @@ dependencies = [
 
 [[package]]
 name = "assert_cmd"
-version = "2.0.12"
+version = "2.0.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "88903cb14723e4d4003335bb7f8a14f27691649105346a0f0957466c096adfe6"
+checksum = "ed72493ac66d5804837f480ab3766c72bdfab91a65e565fc54fa9e42db0073a8"
 dependencies = [
  "anstyle",
  "bstr",
@@ -139,9 +158,9 @@ dependencies = [
 
 [[package]]
 name = "async-compression"
-version = "0.4.3"
+version = "0.4.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bb42b2197bf15ccb092b62c74515dbd8b86d0effd934795f6687c93b6e679a2c"
+checksum = "cd066d0b4ef8ecb03a55319dc13aa6910616d0f44008a045bb1835af830abff5"
 dependencies = [
  "flate2",
  "futures-core",
@@ -163,15 +182,15 @@ dependencies = [
 
 [[package]]
 name = "autocfg"
-version = "1.1.0"
+version = "1.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
+checksum = "0c4b4d0bd25bd0b74681c0ad21497610ce1b7c91b1022cd21c80c6fbdd9476b0"
 
 [[package]]
 name = "backtrace"
-version = "0.3.69"
+version = "0.3.72"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2089b7e3f35b9dd2d0ed921ead4f6d318c27680d4a5bd167b3ee120edb105837"
+checksum = "17c6a35df3749d2e8bb1b7b21a976d82b15548788d2735b9d82f329268f71a11"
 dependencies = [
  "addr2line",
  "cc",
@@ -190,9 +209,9 @@ checksum = "b41b7ea54a0c9d92199de89e20e58d49f02f8e699814ef3fdf266f6f748d15c7"
 
 [[package]]
 name = "base64"
-version = "0.21.4"
+version = "0.21.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ba43ea6f343b788c8764558649e08df62f86c6ef251fdaeb1ffd010a9ae50a2"
+checksum = "9d297deb1925b89f2ccc13d7635fa0714f12c87adce1c75356b39ca9b7178567"
 
 [[package]]
 name = "base64ct"
@@ -251,9 +270,9 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 
 [[package]]
 name = "bitflags"
-version = "2.4.0"
+version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4682ae6287fcf752ecaabbfcc7b6f9b72aa33933dc23a554d853aea8eea8635"
+checksum = "cf4b9d6a944f767f8e5e0db018570623c85f3d925ac718db4e06d0187adb21c1"
 
 [[package]]
 name = "block-buffer"
@@ -266,9 +285,9 @@ dependencies = [
 
 [[package]]
 name = "bstr"
-version = "1.6.2"
+version = "1.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c2f7349907b712260e64b0afe2f84692af14a454be26187d9df565c7f69266a"
+checksum = "05efc5cfd9110c8416e471df0e96702d58690178e206e61b7173706673c93706"
 dependencies = [
  "memchr",
  "regex-automata",
@@ -277,27 +296,27 @@ dependencies = [
 
 [[package]]
 name = "bumpalo"
-version = "3.14.0"
+version = "3.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f30e7476521f6f8af1a1c4c0b8cc94f0bee37d91763d0ca2665f299b6cd8aec"
+checksum = "79296716171880943b8470b5f8d03aa55eb2e645a4874bdbb28adb49162e012c"
 
 [[package]]
 name = "bytecount"
-version = "0.6.3"
+version = "0.6.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c676a478f63e9fa2dd5368a42f28bba0d6c560b775f38583c8bbaa7fcd67c9c"
+checksum = "5ce89b21cab1437276d2650d57e971f9d548a2d9037cc231abdc0562b97498ce"
 
 [[package]]
 name = "byteorder"
-version = "1.4.3"
+version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "14c189c53d098945499cdfa7ecc63567cf3886b3332b312a5b4585d8d3a6a610"
+checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
 
 [[package]]
 name = "bytes"
-version = "1.5.0"
+version = "1.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a2bd12c1caf447e69cd4528f47f94d203fd2582878ecb9e9465484c4148a8223"
+checksum = "514de17de45fdb8dc022b1a7975556c53c86f9f0aa5f534b98977b171857c2c9"
 
 [[package]]
 name = "bzip2"
@@ -322,18 +341,18 @@ dependencies = [
 
 [[package]]
 name = "camino"
-version = "1.1.6"
+version = "1.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c59e92b5a388f549b863a7bea62612c09f24c8393560709a54558a9abdfb3b9c"
+checksum = "e0ec6b951b160caa93cc0c7b209e5a3bff7aae9062213451ac99493cd844c239"
 dependencies = [
  "serde",
 ]
 
 [[package]]
 name = "cargo-platform"
-version = "0.1.3"
+version = "0.1.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2cfa25e60aea747ec7e1124f238816749faa93759c6ff5b31f1ccdda137f4479"
+checksum = "24b1f0365a6c6bb4020cd05806fd0d33c44d38046b8bd7f0e40814b9763cabfc"
 dependencies = [
  "serde",
 ]
@@ -346,19 +365,20 @@ checksum = "4acbb09d9ee8e23699b9634375c72795d095bf268439da88562cf9b501f181fa"
 dependencies = [
  "camino",
  "cargo-platform",
- "semver 1.0.19",
+ "semver 1.0.23",
  "serde",
  "serde_json",
 ]
 
 [[package]]
 name = "cc"
-version = "1.0.83"
+version = "1.0.99"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1174fb0b6ec23863f8b971027804a42614e347eafb0a95bf0b12cdae21fc4d0"
+checksum = "96c51067fd44124faa7f870b4b1c969379ad32b2ba805aa959430ceaa384f695"
 dependencies = [
  "jobserver",
  "libc",
+ "once_cell",
 ]
 
 [[package]]
@@ -369,9 +389,9 @@ checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
 
 [[package]]
 name = "chrono"
-version = "0.4.31"
+version = "0.4.38"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f2c685bad3eb3d45a01354cedb7d5faa66194d1d58ba6e267a8de788f79db38"
+checksum = "a21f936df1771bf62b77f047b726c4625ff2e8aa607c01ec06e5a05bd8463401"
 dependencies = [
  "android-tzdata",
  "iana-time-zone",
@@ -379,14 +399,14 @@ dependencies = [
  "num-traits",
  "serde",
  "wasm-bindgen",
- "windows-targets 0.48.5",
+ "windows-targets 0.52.5",
 ]
 
 [[package]]
 name = "chrono-tz"
-version = "0.8.3"
+version = "0.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1369bc6b9e9a7dfdae2055f6ec151fe9c554a9d23d357c0237cee2e25eaabb7"
+checksum = "d59ae0466b83e838b81a54256c39d5d7c20b9d7daa10510a242d9b75abd5936e"
 dependencies = [
  "chrono",
  "chrono-tz-build",
@@ -395,9 +415,9 @@ dependencies = [
 
 [[package]]
 name = "chrono-tz-build"
-version = "0.2.0"
+version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2f5ebdc942f57ed96d560a6d1a459bae5851102a25d5bf89dc04ae453e31ecf"
+checksum = "433e39f13c9a060046954e0592a8d0a4bcb1040125cbf91cb8ee58964cfb350f"
 dependencies = [
  "parse-zoneinfo",
  "phf",
@@ -416,24 +436,9 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "3.2.25"
+version = "4.5.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4ea181bf566f71cb9a5d17a59e1871af638180a18fb0035c92ae62b705207123"
-dependencies = [
- "atty",
- "bitflags 1.3.2",
- "clap_lex 0.2.4",
- "indexmap 1.9.3",
- "strsim",
- "termcolor",
- "textwrap",
-]
-
-[[package]]
-name = "clap"
-version = "4.4.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "824956d0dca8334758a5b7f7e50518d66ea319330cbceedcf76905c2f6ab30e3"
+checksum = "a9689a29b593160de5bc4aacab7b5d54fb52231de70122626c178e6a368994c7"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -445,76 +450,67 @@ version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "325f50228f76921784b6d9f2d62de6778d834483248eefecd27279174797e579"
 dependencies = [
- "clap 4.4.5",
+ "clap",
 ]
 
 [[package]]
 name = "clap-verbosity-flag"
-version = "2.0.1"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1eef05769009513df2eb1c3b4613e7fad873a14c600ff025b08f250f59fee7de"
+checksum = "bb9b20c0dd58e4c2e991c8d203bbeb76c11304d1011659686b5b644bc29aa478"
 dependencies = [
- "clap 4.4.5",
+ "clap",
  "log",
 ]
 
 [[package]]
 name = "clap_builder"
-version = "4.4.5"
+version = "4.5.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "122ec64120a49b4563ccaedcbea7818d069ed8e9aa6d829b82d8a4128936b2ab"
+checksum = "2e5387378c84f6faa26890ebf9f0a92989f8873d4d380467bcd0d8d8620424df"
 dependencies = [
  "anstream",
  "anstyle",
- "clap_lex 0.5.1",
- "strsim",
+ "clap_lex",
+ "strsim 0.11.1",
  "terminal_size",
 ]
 
 [[package]]
 name = "clap_complete"
-version = "4.4.2"
+version = "4.5.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8baeccdb91cd69189985f87f3c7e453a3a451ab5746cf3be6acc92120bd16d24"
+checksum = "d2020fa13af48afc65a9a87335bda648309ab3d154cd03c7ff95b378c7ed39c4"
 dependencies = [
- "clap 4.4.5",
+ "clap",
 ]
 
 [[package]]
 name = "clap_derive"
-version = "4.4.2"
+version = "4.5.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0862016ff20d69b84ef8247369fabf5c008a7417002411897d40ee1f4532b873"
+checksum = "c780290ccf4fb26629baa7a1081e68ced113f1d3ec302fa5948f1c381ebf06c6"
 dependencies = [
- "heck",
+ "heck 0.5.0",
  "proc-macro2",
  "quote",
- "syn 2.0.37",
+ "syn 2.0.66",
 ]
 
 [[package]]
 name = "clap_lex"
-version = "0.2.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2850f2f5a82cbf437dd5af4d49848fbdfc27c157c3d010345776f952765261c5"
-dependencies = [
- "os_str_bytes",
-]
-
-[[package]]
-name = "clap_lex"
-version = "0.5.1"
+version = "0.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cd7cc57abe963c6d3b9d8be5b06ba7c8957a930305ca90304f24ef040aa6f961"
+checksum = "4b82cf0babdbd58558212896d1a4272303a57bdb245c2bf1147185fb45640e70"
 
 [[package]]
 name = "clio"
-version = "0.3.4"
+version = "0.3.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "746ce4269bee03af43b3349f37f420cf5957f8431c531c08dea0441b298b10e0"
+checksum = "b7fc6734af48458f72f5a3fa7b840903606427d98a710256e808f76a965047d9"
 dependencies = [
  "cfg-if",
- "clap 4.4.5",
+ "clap",
  "is-terminal",
  "libc",
  "tempfile",
@@ -524,17 +520,16 @@ dependencies = [
 
 [[package]]
 name = "colorchoice"
-version = "1.0.0"
+version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "acbf1af155f9b9ef647e42cdc158db4b64a1b61f743629225fde6f3e0be2a7c7"
+checksum = "0b6a852b24ab71dffc585bcb46eaf7959d175cb865a7152e35b348d1b2960422"
 
 [[package]]
 name = "colored"
-version = "2.0.4"
+version = "2.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2674ec482fbc38012cf31e6c42ba0177b431a0cb6f15fe40efa5aab1bda516f6"
+checksum = "cbf2150cce219b664a8a70df7a1f933836724b503f8a413af9365b4dcc4d90b8"
 dependencies = [
- "is-terminal",
  "lazy_static",
  "windows-sys 0.48.0",
 ]
@@ -548,20 +543,20 @@ dependencies = [
  "is-terminal",
  "serde",
  "serde_json",
- "yansi",
+ "yansi 0.5.1",
 ]
 
 [[package]]
 name = "console"
-version = "0.15.7"
+version = "0.15.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c926e00cc70edefdc64d3a5ff31cc65bb97a3460097762bd23afb4d8145fccf8"
+checksum = "0e1f83fc076bd6dd27517eacdf25fef6c4dfe5f1d7448bafaaf3a26f13b5e4eb"
 dependencies = [
  "encode_unicode",
  "lazy_static",
  "libc",
  "unicode-width",
- "windows-sys 0.45.0",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -572,9 +567,9 @@ checksum = "245097e9a4535ee1e3e3931fcfcd55a796a44c643e8596ff6566d68f09b87bbc"
 
 [[package]]
 name = "core-foundation"
-version = "0.9.3"
+version = "0.9.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "194a7a9e6de53fa55116934067c844d9d749312f75c6f6d0980e8c252f8c2146"
+checksum = "91e195e091a93c46f7102ec7818a2aa394e1e1771c3ab4825963fa03e45afb8f"
 dependencies = [
  "core-foundation-sys",
  "libc",
@@ -582,60 +577,52 @@ dependencies = [
 
 [[package]]
 name = "core-foundation-sys"
-version = "0.8.4"
+version = "0.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e496a50fda8aacccc86d7529e2c1e0892dbd0f898a6b5645b5561b89c3210efa"
+checksum = "06ea2b9bc92be3c2baa9334a323ebca2d6f074ff852cd1d7b11064035cd3868f"
 
 [[package]]
 name = "cpufeatures"
-version = "0.2.9"
+version = "0.2.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a17b76ff3a4162b0b27f354a0c87015ddad39d35f9c0c36607a3bdd175dde1f1"
+checksum = "53fe5e26ff1b7aef8bca9c6080520cfb8d9333c7568e1829cef191a9723e5504"
 dependencies = [
  "libc",
 ]
 
 [[package]]
 name = "crc32fast"
-version = "1.3.2"
+version = "1.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b540bd8bc810d3885c6ea91e2018302f68baba2129ab3e88f32389ee9370880d"
+checksum = "a97769d94ddab943e4510d138150169a2758b5ef3eb191a9ee688de3e23ef7b3"
 dependencies = [
  "cfg-if",
 ]
 
 [[package]]
 name = "crossbeam-deque"
-version = "0.8.3"
+version = "0.8.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce6fd6f855243022dcecf8702fef0c297d4338e226845fe067f6341ad9fa0cef"
+checksum = "613f8cc01fe9cf1a3eb3d7f488fd2fa8388403e97039e2f73692932e291a770d"
 dependencies = [
- "cfg-if",
  "crossbeam-epoch",
  "crossbeam-utils",
 ]
 
 [[package]]
 name = "crossbeam-epoch"
-version = "0.9.15"
+version = "0.9.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ae211234986c545741a7dc064309f67ee1e5ad243d0e48335adc0484d960bcc7"
+checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e"
 dependencies = [
- "autocfg",
- "cfg-if",
  "crossbeam-utils",
- "memoffset",
- "scopeguard",
 ]
 
 [[package]]
 name = "crossbeam-utils"
-version = "0.8.16"
+version = "0.8.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a22b2d63d4d1dc0b7f1b6b2747dd0088008a9be28b6ddf0b1e7d335e3037294"
-dependencies = [
- "cfg-if",
-]
+checksum = "22ec99545bb0ed0ea7bb9b8e1e9122ea386ff8a48c0922e43f36d45ab09e0e80"
 
 [[package]]
 name = "crypto-common"
@@ -649,9 +636,9 @@ dependencies = [
 
 [[package]]
 name = "csv"
-version = "1.2.2"
+version = "1.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "626ae34994d3d8d668f4269922248239db4ae42d538b14c398b74a52208e8086"
+checksum = "ac574ff4d437a7b5ad237ef331c17ccca63c46479e5b5453eb8e10bb99a759fe"
 dependencies = [
  "csv-core",
  "itoa",
@@ -661,9 +648,9 @@ dependencies = [
 
 [[package]]
 name = "csv-core"
-version = "0.1.10"
+version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b2466559f260f48ad25fe6317b3c8dac77b5bdb5763ac7d9d6103530663bc90"
+checksum = "5efa2b3d7902f4b634a20cae3c9c4e6209dc4779feb6863329607560143efa70"
 dependencies = [
  "memchr",
 ]
@@ -680,12 +667,12 @@ dependencies = [
 
 [[package]]
 name = "darling"
-version = "0.20.3"
+version = "0.20.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0209d94da627ab5605dcccf08bb18afa5009cfbef48d8a8b7d7bdbc79be25c5e"
+checksum = "83b2eb4d90d12bdda5ed17de686c2acb4c57914f8f921b8da7e112b5a36f3fe1"
 dependencies = [
- "darling_core 0.20.3",
- "darling_macro 0.20.3",
+ "darling_core 0.20.9",
+ "darling_macro 0.20.9",
 ]
 
 [[package]]
@@ -698,22 +685,22 @@ dependencies = [
  "ident_case",
  "proc-macro2",
  "quote",
- "strsim",
+ "strsim 0.10.0",
  "syn 1.0.109",
 ]
 
 [[package]]
 name = "darling_core"
-version = "0.20.3"
+version = "0.20.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "177e3443818124b357d8e76f53be906d60937f0d3a90773a664fa63fa253e621"
+checksum = "622687fe0bac72a04e5599029151f5796111b90f1baaa9b544d807a5e31cd120"
 dependencies = [
  "fnv",
  "ident_case",
  "proc-macro2",
  "quote",
- "strsim",
- "syn 2.0.37",
+ "strsim 0.11.1",
+ "syn 2.0.66",
 ]
 
 [[package]]
@@ -729,20 +716,23 @@ dependencies = [
 
 [[package]]
 name = "darling_macro"
-version = "0.20.3"
+version = "0.20.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "836a9bbc7ad63342d6d6e7b815ccab164bc77a2d95d84bc3117a8c0d5c98e2d5"
+checksum = "733cabb43482b1a1b53eee8583c2b9e8684d592215ea83efd305dd31bc2f0178"
 dependencies = [
- "darling_core 0.20.3",
+ "darling_core 0.20.9",
  "quote",
- "syn 2.0.37",
+ "syn 2.0.66",
 ]
 
 [[package]]
 name = "deranged"
-version = "0.3.8"
+version = "0.3.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2696e8a945f658fd14dc3b87242e6b80cd0f36ff04ea560fa39082368847946"
+checksum = "b42b6fa04a440b495c8b04d0e71b707c585f83cb9cb28cf8cd0d976c315e31b4"
+dependencies = [
+ "powerfmt",
+]
 
 [[package]]
 name = "derive-getters"
@@ -762,12 +752,12 @@ dependencies = [
  "anyhow",
  "assert-json-diff",
  "assert_cmd",
- "base64 0.21.4",
+ "base64 0.21.7",
  "binread",
- "bitflags 2.4.0",
+ "bitflags 2.5.0",
  "chrono",
  "chrono-tz",
- "clap 4.4.5",
+ "clap",
  "clap-markdown",
  "clap-verbosity-flag",
  "clap_complete",
@@ -783,7 +773,7 @@ dependencies = [
  "encoding_rs_io",
  "evtx",
  "flate2",
- "forensic-rs",
+ "forensic-rs 0.9.1",
  "frnsc-prefetch",
  "futures",
  "getset",
@@ -797,7 +787,7 @@ dependencies = [
  "more-asserts",
  "nt_hive2",
  "num",
- "num-derive 0.3.3",
+ "num-derive 0.4.2",
  "num-traits",
  "ouroboros",
  "phf",
@@ -826,7 +816,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "efc96511560e4661da0ada6debede9ed1dc63d8ac2ad8cefc00434e351a8b509"
 dependencies = [
  "anyhow",
- "darling 0.20.3",
+ "darling 0.20.9",
  "evtx",
  "log",
  "quote",
@@ -840,22 +830,23 @@ version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "37be4820fae21cbed1f691dffcb02969b673bfeef4bd3fdee8cb175d1ca27023"
 dependencies = [
- "darling 0.20.3",
+ "darling 0.20.9",
  "dfirtk-eventdata",
  "proc-macro2",
  "quote",
- "syn 2.0.37",
+ "syn 2.0.66",
 ]
 
 [[package]]
 name = "dialoguer"
-version = "0.10.4"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "59c6f2989294b9a498d3ad5491a79c6deb604617378e1cdc4bfc1c1361fe2f87"
+checksum = "658bce805d770f407bc62102fca7c2c64ceef2fbcb2b8bd19d2765ce093980de"
 dependencies = [
  "console",
  "shell-words",
  "tempfile",
+ "thiserror",
  "zeroize",
 ]
 
@@ -888,21 +879,21 @@ version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "de78e66ac9061e030587b2a2e75cc88f22304913c907b11307bca737141230cb"
 dependencies = [
- "heck",
+ "heck 0.4.1",
  "proc-macro-error",
 ]
 
 [[package]]
 name = "dyn-clone"
-version = "1.0.14"
+version = "1.0.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23d2f3407d9a573d666de4b5bdf10569d73ca9478087346697dcbae6244bfbcd"
+checksum = "0d6ef0072f8a535281e4876be788938b528e9a1d43900b82c2569af7da799125"
 
 [[package]]
 name = "either"
-version = "1.9.0"
+version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a26ae43d7bcc3b814de94796a5e736d4029efb0ee900c12e2d54c993ad1a1e07"
+checksum = "3dca9240753cf90908d7e4aac30f630662b02aebaa1b58a3cadabdb23385b58b"
 
 [[package]]
 name = "elasticsearch"
@@ -996,9 +987,9 @@ checksum = "a246d82be1c9d791c5dfde9a2bd045fc3cbba3fa2b11ad558f27d01712f00569"
 
 [[package]]
 name = "encoding_rs"
-version = "0.8.33"
+version = "0.8.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7268b386296a025e474d5140678f75d6de9493ae55a5d709eeb9dd08149945e1"
+checksum = "b45de904aa0b010bce2ab45264d0631681847fa7b6f2eaa7dab7619943bc4f59"
 dependencies = [
  "cfg-if",
 ]
@@ -1020,23 +1011,12 @@ checksum = "5443807d6dff69373d433ab9ef5378ad8df50ca6298caf15de6e52e24aaf54d5"
 
 [[package]]
 name = "errno"
-version = "0.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "136526188508e25c6fef639d7927dfb3e0e3084488bf202267829cf7fc23dbdd"
-dependencies = [
- "errno-dragonfly",
- "libc",
- "windows-sys 0.48.0",
-]
-
-[[package]]
-name = "errno-dragonfly"
-version = "0.1.2"
+version = "0.3.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aa68f1b12764fab894d2755d2518754e71b4fd80ecfb822714a1206c2aab39bf"
+checksum = "534c5cf6194dfab3db3242765c03bbe257cf92f22b38f6bc0c58d59108a820ba"
 dependencies = [
- "cc",
  "libc",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -1050,18 +1030,19 @@ dependencies = [
 
 [[package]]
 name = "evtx"
-version = "0.8.1"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b3c0a23f64c81e962c993ccb5d9e88bbd62a3fcabdec20b037a8383f7c3e163f"
+checksum = "082a513e8ac6685ee6b4a52d6f774a041d3f6497bdeeabed515df2edd207872b"
 dependencies = [
  "anyhow",
- "bitflags 1.3.2",
+ "bitflags 2.5.0",
  "byteorder",
  "chrono",
- "clap 3.2.25",
+ "clap",
  "crc32fast",
  "dialoguer",
  "encoding",
+ "hashbrown",
  "indoc",
  "log",
  "quick-xml",
@@ -1076,15 +1057,15 @@ dependencies = [
 
 [[package]]
 name = "fastrand"
-version = "2.0.1"
+version = "2.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "25cbce373ec4653f1a01a31e8a5e5ec0c622dc27ff9c4e6606eefef5cbbed4a5"
+checksum = "9fc0510504f03c51ada170672ac806f1f105a88aa97a5281117e1ddc3368e51a"
 
 [[package]]
 name = "flate2"
-version = "1.0.27"
+version = "1.0.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c6c98ee8095e9d1dcbf2fcc6d95acccb90d1c81db1e44725c6a984b1dbdfb010"
+checksum = "5f54427cfd1c7829e2a139fcefea601bf088ebca651d2bf53ebc600eac295dae"
 dependencies = [
  "crc32fast",
  "miniz_oxide",
@@ -1121,30 +1102,39 @@ dependencies = [
  "thiserror",
 ]
 
+[[package]]
+name = "forensic-rs"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6b505c08ffc21e66f9cfca93ebf46f6aef480d806508fd591b7f628eabee45a7"
+dependencies = [
+ "serde",
+]
+
 [[package]]
 name = "form_urlencoded"
-version = "1.2.0"
+version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a62bc1cf6f830c2ec14a513a9fb124d0a213a629668a4186f329db21fe045652"
+checksum = "e13624c2627564efccf4934284bdd98cbaa14e79b0b5a141218e507b3a823456"
 dependencies = [
  "percent-encoding",
 ]
 
 [[package]]
 name = "frnsc-prefetch"
-version = "0.9.0"
+version = "0.9.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2ed2131c091273267486b2dabcc96c2bb6d7374d27f7827c37d98de86daa2a2f"
+checksum = "2cbc724922a1619a2ebc340fecb993ae937700dc144b4d206bf7c85a70415277"
 dependencies = [
  "crc32fast",
- "forensic-rs",
+ "forensic-rs 0.13.0",
 ]
 
 [[package]]
 name = "futures"
-version = "0.3.28"
+version = "0.3.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23342abe12aba583913b2e62f22225ff9c950774065e4bfb61a19cd9770fec40"
+checksum = "645c6916888f6cb6350d2550b80fb63e734897a8498abe35cfb732b6487804b0"
 dependencies = [
  "futures-channel",
  "futures-core",
@@ -1157,9 +1147,9 @@ dependencies = [
 
 [[package]]
 name = "futures-channel"
-version = "0.3.28"
+version = "0.3.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "955518d47e09b25bbebc7a18df10b81f0c766eaf4c4f1cccef2fca5f2a4fb5f2"
+checksum = "eac8f7d7865dcb88bd4373ab671c8cf4508703796caa2b1985a9ca867b3fcb78"
 dependencies = [
  "futures-core",
  "futures-sink",
@@ -1167,15 +1157,15 @@ dependencies = [
 
 [[package]]
 name = "futures-core"
-version = "0.3.28"
+version = "0.3.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4bca583b7e26f571124fe5b7561d49cb2868d79116cfa0eefce955557c6fee8c"
+checksum = "dfc6580bb841c5a68e9ef15c77ccc837b40a7504914d52e47b8b0e9bbda25a1d"
 
 [[package]]
 name = "futures-executor"
-version = "0.3.28"
+version = "0.3.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ccecee823288125bd88b4d7f565c9e58e41858e47ab72e8ea2d64e93624386e0"
+checksum = "a576fc72ae164fca6b9db127eaa9a9dda0d61316034f33a0a0d4eda41f02b01d"
 dependencies = [
  "futures-core",
  "futures-task",
@@ -1184,38 +1174,38 @@ dependencies = [
 
 [[package]]
 name = "futures-io"
-version = "0.3.28"
+version = "0.3.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4fff74096e71ed47f8e023204cfd0aa1289cd54ae5430a9523be060cdb849964"
+checksum = "a44623e20b9681a318efdd71c299b6b222ed6f231972bfe2f224ebad6311f0c1"
 
 [[package]]
 name = "futures-macro"
-version = "0.3.28"
+version = "0.3.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "89ca545a94061b6365f2c7355b4b32bd20df3ff95f02da9329b34ccc3bd6ee72"
+checksum = "87750cf4b7a4c0625b1529e4c543c2182106e4dedc60a2a6455e00d212c489ac"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.37",
+ "syn 2.0.66",
 ]
 
 [[package]]
 name = "futures-sink"
-version = "0.3.28"
+version = "0.3.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f43be4fe21a13b9781a69afa4985b0f6ee0e1afab2c6f454a8cf30e2b2237b6e"
+checksum = "9fb8e00e87438d937621c1c6269e53f536c14d3fbd6a042bb24879e57d474fb5"
 
 [[package]]
 name = "futures-task"
-version = "0.3.28"
+version = "0.3.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "76d3d132be6c0e6aa1534069c705a74a5997a356c0dc2f86a47765e5617c5b65"
+checksum = "38d84fa142264698cdce1a9f9172cf383a0c82de1bddcf3092901442c4097004"
 
 [[package]]
 name = "futures-util"
-version = "0.3.28"
+version = "0.3.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26b01e40b772d54cf6c6d721c1d1abd0647a0106a12ecaa1c186273392a69533"
+checksum = "3d6401deb83407ab3da39eba7e33987a73c3df0c82b4bb5813ee871c19c41d48"
 dependencies = [
  "futures-channel",
  "futures-core",
@@ -1241,9 +1231,9 @@ dependencies = [
 
 [[package]]
 name = "getrandom"
-version = "0.2.10"
+version = "0.2.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "be4136b2a15dd319360be1c07d9933517ccf0be8f16bf62a3bee4f0d618df427"
+checksum = "c4567c8db10ae91089c99af84c68c38da3ec2f087c3f82960bcdbf3656b6f4d7"
 dependencies = [
  "cfg-if",
  "libc",
@@ -1264,9 +1254,9 @@ dependencies = [
 
 [[package]]
 name = "gimli"
-version = "0.28.0"
+version = "0.29.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6fb8d784f27acf97159b40fc4db5ecd8aa23b9ad5ef69cdd136d3bc80665f0c0"
+checksum = "40ecd4077b5ae9fd2e9e169b102c6c330d0605168eb0e8bf79952b256dbefffd"
 
 [[package]]
 name = "glob"
@@ -1276,9 +1266,9 @@ checksum = "d2fabcfbdc87f4758337ca535fb41a6d701b65693ce38287d856d1674551ec9b"
 
 [[package]]
 name = "h2"
-version = "0.3.24"
+version = "0.3.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bb2c4422095b67ee78da96fbb51a4cc413b3b25883c7717ff7ca1ab31022c9c9"
+checksum = "81fe527a889e1532da5c525686d96d4c2e74cdd345badf8dfef9f6b39dd5f5e8"
 dependencies = [
  "bytes",
  "fnv",
@@ -1286,7 +1276,7 @@ dependencies = [
  "futures-sink",
  "futures-util",
  "http",
- "indexmap 2.1.0",
+ "indexmap",
  "slab",
  "tokio",
  "tokio-util",
@@ -1295,21 +1285,25 @@ dependencies = [
 
 [[package]]
 name = "hashbrown"
-version = "0.12.3"
+version = "0.14.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
+checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
+dependencies = [
+ "ahash",
+ "allocator-api2",
+]
 
 [[package]]
-name = "hashbrown"
-version = "0.14.3"
+name = "heck"
+version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "290f1a1d9242c78d09ce40a5e87e7554ee637af1351968159f4952f028f75604"
+checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8"
 
 [[package]]
 name = "heck"
-version = "0.4.1"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
 
 [[package]]
 name = "hermit-abi"
@@ -1322,9 +1316,9 @@ dependencies = [
 
 [[package]]
 name = "hermit-abi"
-version = "0.3.3"
+version = "0.3.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d77f7ec81a6d05a3abb01ab6eb7590f6083d08449fe5a1c8b1e620283546ccb7"
+checksum = "d231dfb89cfffdbc30e7fc41579ed6066ad03abda9e567ccafae602b97ec5024"
 
 [[package]]
 name = "hmac"
@@ -1337,9 +1331,9 @@ dependencies = [
 
 [[package]]
 name = "http"
-version = "0.2.9"
+version = "0.2.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bd6effc99afb63425aff9b05836f029929e345a6148a14b7ecd5ab67af944482"
+checksum = "601cbb57e577e2f5ef5be8e7b83f0f63994f25aa94d673e54a92d5c516d101f1"
 dependencies = [
  "bytes",
  "fnv",
@@ -1348,9 +1342,9 @@ dependencies = [
 
 [[package]]
 name = "http-body"
-version = "0.4.5"
+version = "0.4.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d5f38f16d184e36f2408a55281cd658ecbd3ca05cce6d6510a176eca393e26d1"
+checksum = "7ceab25649e9960c0311ea418d17bee82c0dcec1bd053b5f9a66e265a693bed2"
 dependencies = [
  "bytes",
  "http",
@@ -1371,9 +1365,9 @@ checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
 
 [[package]]
 name = "hyper"
-version = "0.14.27"
+version = "0.14.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ffb1cfd654a8219eaef89881fdb3bb3b1cdc5fa75ded05d6933b2b382e395468"
+checksum = "f361cde2f109281a220d4307746cdfd5ee3f410da58a70377762396775634b33"
 dependencies = [
  "bytes",
  "futures-channel",
@@ -1386,7 +1380,7 @@ dependencies = [
  "httpdate",
  "itoa",
  "pin-project-lite",
- "socket2 0.4.9",
+ "socket2",
  "tokio",
  "tower-service",
  "tracing",
@@ -1408,16 +1402,16 @@ dependencies = [
 
 [[package]]
 name = "iana-time-zone"
-version = "0.1.57"
+version = "0.1.60"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2fad5b825842d2b38bd206f3e81d6957625fd7f0a361e345c30e01a0ae2dd613"
+checksum = "e7ffbb5a1b541ea2561f8c41c087286cc091e21e556a4f09a8f6cbf17b69b141"
 dependencies = [
  "android_system_properties",
  "core-foundation-sys",
  "iana-time-zone-haiku",
  "js-sys",
  "wasm-bindgen",
- "windows",
+ "windows-core",
 ]
 
 [[package]]
@@ -1437,9 +1431,9 @@ checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39"
 
 [[package]]
 name = "idna"
-version = "0.4.0"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d20d6b07bfbc108882d88ed8e37d39636dcc260e15e30c45e6ba089610b917c"
+checksum = "634d9b1461af396cad843f47fdba5597a4f9e6ddd4bfb6ff5d85028c25cb12f6"
 dependencies = [
  "unicode-bidi",
  "unicode-normalization",
@@ -1447,29 +1441,19 @@ dependencies = [
 
 [[package]]
 name = "indexmap"
-version = "1.9.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bd070e393353796e801d209ad339e89596eb4c8d430d18ede6a1cced8fafbd99"
-dependencies = [
- "autocfg",
- "hashbrown 0.12.3",
-]
-
-[[package]]
-name = "indexmap"
-version = "2.1.0"
+version = "2.2.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d530e1a18b1cb4c484e6e34556a0d948706958449fca0cab753d649f2bce3d1f"
+checksum = "168fb715dda47215e360912c096649d23d58bf392ac62f73919e831745e40f26"
 dependencies = [
  "equivalent",
- "hashbrown 0.14.3",
+ "hashbrown",
 ]
 
 [[package]]
 name = "indicatif"
-version = "0.17.7"
+version = "0.17.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fb28741c9db9a713d93deb3bb9515c20788cef5815265bee4980e87bde7e0f25"
+checksum = "763a5a8f45087d6bcea4222e7b72c291a054edf80e4ef6efd2a4979878c7bea3"
 dependencies = [
  "console",
  "instant",
@@ -1480,9 +1464,9 @@ dependencies = [
 
 [[package]]
 name = "indoc"
-version = "1.0.9"
+version = "2.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bfa799dd5ed20a7e349f3b4639aa80d74549c81716d9ec4f994c9b5815598306"
+checksum = "b248f5224d1d606005e02c97f5aa4e88eeb230488bcc03bc9ca4d7991399f2b5"
 
 [[package]]
 name = "inout"
@@ -1495,59 +1479,65 @@ dependencies = [
 
 [[package]]
 name = "instant"
-version = "0.1.12"
+version = "0.1.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a5bbe824c507c5da5956355e86a746d82e0e1464f65d862cc5e71da70e94b2c"
+checksum = "e0242819d153cba4b4b05a5a8f2a7e9bbf97b6055b2a002b395c96b5ff3c0222"
 dependencies = [
  "cfg-if",
 ]
 
 [[package]]
 name = "ipnet"
-version = "2.8.0"
+version = "2.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "28b29a3cd74f0f4598934efe3aeba42bae0eb4680554128851ebbecb02af14e6"
+checksum = "8f518f335dce6725a761382244631d86cf0ccb2863413590b31338feb467f9c3"
 
 [[package]]
 name = "is-terminal"
-version = "0.4.9"
+version = "0.4.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb0889898416213fab133e1d33a0e5858a48177452750691bde3666d0fdbaf8b"
+checksum = "f23ff5ef2b80d608d61efee834934d862cd92461afc0560dedf493e4c033738b"
 dependencies = [
- "hermit-abi 0.3.3",
- "rustix",
- "windows-sys 0.48.0",
+ "hermit-abi 0.3.9",
+ "libc",
+ "windows-sys 0.52.0",
 ]
 
+[[package]]
+name = "is_terminal_polyfill"
+version = "1.70.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8478577c03552c21db0e2724ffb8986a5ce7af88107e6be5d2ee6e158c12800"
+
 [[package]]
 name = "itertools"
-version = "0.11.0"
+version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b1c173a5686ce8bfa551b3563d0c2170bf24ca44da99c7ca4bfdab5418c3fe57"
+checksum = "ba291022dbbd398a455acf126c1e341954079855bc60dfdda641363bd6922569"
 dependencies = [
  "either",
 ]
 
 [[package]]
 name = "itoa"
-version = "1.0.9"
+version = "1.0.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "af150ab688ff2122fcef229be89cb50dd66af9e01a4ff320cc137eecc9bacc38"
+checksum = "49f1f14873335454500d59611f1cf4a4b0f786f9ac11f4312a78e4cf2566695b"
 
 [[package]]
 name = "jobserver"
-version = "0.1.28"
+version = "0.1.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ab46a6e9526ddef3ae7f787c06f0f2600639ba80ea3eade3d8e670a2230f51d6"
+checksum = "d2b099aaa34a9751c5bf0878add70444e1ed2dd73f347be99003d4577277de6e"
 dependencies = [
  "libc",
 ]
 
 [[package]]
 name = "js-sys"
-version = "0.3.64"
+version = "0.3.69"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c5f195fe497f702db0f318b07fdd68edb16955aed830df8363d837542f8f935a"
+checksum = "29c15563dc2726973df627357ce0c9ddddbea194836909d655df6a75d2cf296d"
 dependencies = [
  "wasm-bindgen",
 ]
@@ -1564,9 +1554,9 @@ dependencies = [
 
 [[package]]
 name = "lazy-regex"
-version = "3.0.2"
+version = "3.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e723bd417b2df60a0f6a2b6825f297ea04b245d4ba52b5a22cb679bdf58b05fa"
+checksum = "5d12be4595afdf58bd19e4a9f4e24187da2a66700786ff660a418e9059937a4c"
 dependencies = [
  "lazy-regex-proc_macros",
  "once_cell",
@@ -1575,14 +1565,14 @@ dependencies = [
 
 [[package]]
 name = "lazy-regex-proc_macros"
-version = "3.0.1"
+version = "3.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0f0a1d9139f0ee2e862e08a9c5d0ba0470f2aa21cd1e1aa1b1562f83116c725f"
+checksum = "44bcd58e6c97a7fcbaffcdc95728b393b8d98933bfadad49ed4097845b57ef0b"
 dependencies = [
  "proc-macro2",
  "quote",
  "regex",
- "syn 2.0.37",
+ "syn 2.0.66",
 ]
 
 [[package]]
@@ -1593,15 +1583,15 @@ checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
 
 [[package]]
 name = "libc"
-version = "0.2.148"
+version = "0.2.155"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9cdc71e17332e86d2e1d38c1f99edcb6288ee11b815fb1a4b049eaa2114d369b"
+checksum = "97b3888a4aecf77e811145cadf6eef5901f4782c53886191b2f693f24761847c"
 
 [[package]]
 name = "linux-raw-sys"
-version = "0.4.10"
+version = "0.4.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da2479e8c062e40bf0066ffa0bc823de0a9368974af99c9f6df941d2c231e03f"
+checksum = "78b3ae25bc7c8c38cec158d1f2757ee79e9b3740fbc7ccf0e59e4b08d793fa89"
 
 [[package]]
 name = "lnk"
@@ -1619,9 +1609,9 @@ dependencies = [
 
 [[package]]
 name = "lock_api"
-version = "0.4.10"
+version = "0.4.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c1cc9717a20b1bb222f333e6a92fd32f7d8a18ddc5a3191a11af45dcbf4dcd16"
+checksum = "07af8b9cdd281b7915f413fa73f29ebd5d55d0d3f0155584dade1ff18cea1b17"
 dependencies = [
  "autocfg",
  "scopeguard",
@@ -1629,9 +1619,9 @@ dependencies = [
 
 [[package]]
 name = "log"
-version = "0.4.20"
+version = "0.4.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5e6163cb8c49088c2c36f57875e58ccd8c87c7427f7fbd50ea6710b2f3f2e8f"
+checksum = "90ed8c1e510134f979dbc4f070f87d4313098b704861a105fe34231c70a3901c"
 
 [[package]]
 name = "marvin32"
@@ -1650,24 +1640,15 @@ checksum = "2532096657941c2fea9c289d370a250971c689d4f143798ff67113ec042024a5"
 
 [[package]]
 name = "memchr"
-version = "2.6.3"
+version = "2.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f232d6ef707e1956a43342693d2a31e72989554d58299d7a88738cc95b0d35c"
-
-[[package]]
-name = "memoffset"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a634b1c61a95585bd15607c6ab0c4e5b226e695ff2800ba0cdccddf208c406c"
-dependencies = [
- "autocfg",
-]
+checksum = "6c8640c5d730cb13ebd907d8d04b52f55ac9a2eec55b440c8892f40d56c76c1d"
 
 [[package]]
 name = "memoverlay"
-version = "0.1.2"
+version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "320146b1366d0d61e342c22290a727191a4e4b5335ac7127314e03bed1274cab"
+checksum = "4fc3283db27665ac5cbeef50846f5fbff8884c91f72b0c28f4ce6783050be939"
 dependencies = [
  "thiserror",
 ]
@@ -1680,18 +1661,18 @@ checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
 
 [[package]]
 name = "miniz_oxide"
-version = "0.7.1"
+version = "0.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e7810e0be55b428ada41041c41f32c9f1a42817901b4ccf45fa3d4b6561e74c7"
+checksum = "87dfd01fe195c66b572b37921ad8803d010623c0aca821bea2302239d155cdae"
 dependencies = [
  "adler",
 ]
 
 [[package]]
 name = "mio"
-version = "0.8.8"
+version = "0.8.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "927a765cd3fc26206e66b296465fa9d3e5ab003e651c1b3c060e7956d96b19d2"
+checksum = "a4a650543ca06a924e8b371db273b2756685faae30f8487da1b56505a8f78b0c"
 dependencies = [
  "libc",
  "wasi",
@@ -1706,11 +1687,10 @@ checksum = "1fafa6961cabd9c63bcd77a45d7e3b7f3b552b70417831fb0f56db717e72407e"
 
 [[package]]
 name = "native-tls"
-version = "0.2.11"
+version = "0.2.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07226173c32f2926027b63cce4bcd8076c3552846cbe7925f3aaffeac0a3b92e"
+checksum = "a8614eb2c83d59d1c8cc974dd3f920198647674a0a035e1af1fa58707e317466"
 dependencies = [
- "lazy_static",
  "libc",
  "log",
  "openssl",
@@ -1724,9 +1704,9 @@ dependencies = [
 
 [[package]]
 name = "nt_hive2"
-version = "4.0.1"
+version = "4.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ca47f34aeed287416db8078e4eba566fb9c6db687183bf3d22ad548b97dbe78"
+checksum = "ebfb93c85708165debe103d54b9df9e00ed1a60df8969baa03f8610bee506ecf"
 dependencies = [
  "anyhow",
  "binread",
@@ -1736,10 +1716,11 @@ dependencies = [
  "chrono",
  "derive-getters",
  "encoding_rs",
+ "getset",
  "log",
  "marvin32",
  "memoverlay",
- "num-derive 0.4.0",
+ "num-derive 0.4.2",
  "num-traits",
  "thiserror",
  "winstructs",
@@ -1747,9 +1728,9 @@ dependencies = [
 
 [[package]]
 name = "num"
-version = "0.4.1"
+version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b05180d69e3da0e530ba2a1dae5110317e49e3b7f3d41be227dc5f92e49ee7af"
+checksum = "35bd024e8b2ff75562e5f34e7f4905839deb4b22955ef5e73d2fea1b9813cb23"
 dependencies = [
  "num-bigint",
  "num-complex",
@@ -1761,24 +1742,29 @@ dependencies = [
 
 [[package]]
 name = "num-bigint"
-version = "0.4.4"
+version = "0.4.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "608e7659b5c3d7cba262d894801b9ec9d00de989e8a82bd4bef91d08da45cdc0"
+checksum = "c165a9ab64cf766f73521c0dd2cfdff64f488b8f0b3e621face3462d3db536d7"
 dependencies = [
- "autocfg",
  "num-integer",
  "num-traits",
 ]
 
 [[package]]
 name = "num-complex"
-version = "0.4.4"
+version = "0.4.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ba157ca0885411de85d6ca030ba7e2a83a28636056c7c699b07c8b6f7383214"
+checksum = "73f88a1307638156682bada9d7604135552957b7818057dcef22705b4d509495"
 dependencies = [
  "num-traits",
 ]
 
+[[package]]
+name = "num-conv"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9"
+
 [[package]]
 name = "num-derive"
 version = "0.3.3"
@@ -1792,30 +1778,29 @@ dependencies = [
 
 [[package]]
 name = "num-derive"
-version = "0.4.0"
+version = "0.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9e6a0fd4f737c707bd9086cc16c925f294943eb62eb71499e9fd4cf71f8b9f4e"
+checksum = "ed3955f1a9c7c0c15e092f9c887db08b1fc683305fdf6eb6684f22555355e202"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.37",
+ "syn 2.0.66",
 ]
 
 [[package]]
 name = "num-integer"
-version = "0.1.45"
+version = "0.1.46"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "225d3389fb3509a24c93f5c29eb6bde2586b98d9f016636dff58d7c6f7569cd9"
+checksum = "7969661fd2958a5cb096e56c8e1ad0444ac2bbcd0061bd28660485a44879858f"
 dependencies = [
- "autocfg",
  "num-traits",
 ]
 
 [[package]]
 name = "num-iter"
-version = "0.1.43"
+version = "0.1.45"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d03e6c028c5dc5cac6e2dec0efda81fc887605bb3d884578bb6d6bf7514e252"
+checksum = "1429034a0490724d0075ebb2bc9e875d6503c3cf69e235a8941aa757d83ef5bf"
 dependencies = [
  "autocfg",
  "num-integer",
@@ -1824,11 +1809,10 @@ dependencies = [
 
 [[package]]
 name = "num-rational"
-version = "0.4.1"
+version = "0.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0638a1c9d0a3c0914158145bc76cff373a75a627e6ecbfb71cbe6f453a5a19b0"
+checksum = "f83d14da390562dca69fc84082e73e548e1ad308d24accdedd2720017cb37824"
 dependencies = [
- "autocfg",
  "num-bigint",
  "num-integer",
  "num-traits",
@@ -1836,9 +1820,9 @@ dependencies = [
 
 [[package]]
 name = "num-traits"
-version = "0.2.16"
+version = "0.2.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f30b0abd723be7e2ffca1272140fac1a2f084c77ec3e123c192b66af1ee9e6c2"
+checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
 dependencies = [
  "autocfg",
 ]
@@ -1849,15 +1833,15 @@ version = "1.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4161fcb6d602d4d2081af7c3a45852d875a03dd337a6bfdd6e06407b61342a43"
 dependencies = [
- "hermit-abi 0.3.3",
+ "hermit-abi 0.3.9",
  "libc",
 ]
 
 [[package]]
 name = "num_threads"
-version = "0.1.6"
+version = "0.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2819ce041d2ee131036f4fc9d6ae7ae125a3a40e97ba64d04fe799ad9dabbb44"
+checksum = "5c7398b9c8b70908f6371f47ed36737907c87c52af34c268fed0bf0ceb92ead9"
 dependencies = [
  "libc",
 ]
@@ -1876,26 +1860,26 @@ checksum = "b8f8bdf33df195859076e54ab11ee78a1b208382d3a26ec40d142ffc1ecc49ef"
 
 [[package]]
 name = "object"
-version = "0.32.1"
+version = "0.35.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9cf5f9dd3933bd50a9e1f149ec995f39ae2c496d31fd772c1fd45ebc27e902b0"
+checksum = "b8ec7ab813848ba4522158d5517a6093db1ded27575b070f4177b8d12b41db5e"
 dependencies = [
  "memchr",
 ]
 
 [[package]]
 name = "once_cell"
-version = "1.18.0"
+version = "1.19.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd8b5dd2ae5ed71462c540258bedcb51965123ad7e7ccf4b9a8cafaa4a63576d"
+checksum = "3fdb12b2476b595f9358c5161aa467c2438859caa136dec86c26fdd2efe17b92"
 
 [[package]]
 name = "openssl"
-version = "0.10.57"
+version = "0.10.64"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bac25ee399abb46215765b1cb35bc0212377e58a061560d8b29b024fd0430e7c"
+checksum = "95a0481286a310808298130d22dd1fef0fa571e05a8f44ec801801e84b216b1f"
 dependencies = [
- "bitflags 2.4.0",
+ "bitflags 2.5.0",
  "cfg-if",
  "foreign-types",
  "libc",
@@ -1912,7 +1896,7 @@ checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.37",
+ "syn 2.0.66",
 ]
 
 [[package]]
@@ -1923,9 +1907,9 @@ checksum = "ff011a302c396a5197692431fc1948019154afc178baf7d8e37367442a4601cf"
 
 [[package]]
 name = "openssl-sys"
-version = "0.9.93"
+version = "0.9.102"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "db4d56a4c0478783083cfafcc42493dd4a981d41669da64b4572a2a089b51b1d"
+checksum = "c597637d56fbc83893a35eb0dd04b2b8e7a50c91e64e9493e398b5df4fb45fa2"
 dependencies = [
  "cc",
  "libc",
@@ -1933,17 +1917,11 @@ dependencies = [
  "vcpkg",
 ]
 
-[[package]]
-name = "os_str_bytes"
-version = "6.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4d5d9eb14b174ee9aa2ef96dc2b94637a2d4b6e7cb873c7e171f0c20c6cf3eac"
-
 [[package]]
 name = "ouroboros"
-version = "0.18.0"
+version = "0.18.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1c86de06555b970aec45229b27291b53154f21a5743a163419f4e4c0b065dcde"
+checksum = "944fa20996a25aded6b4795c6d63f10014a7a83f8be9828a11860b08c5fc4a67"
 dependencies = [
  "aliasable",
  "ouroboros_macro",
@@ -1952,23 +1930,23 @@ dependencies = [
 
 [[package]]
 name = "ouroboros_macro"
-version = "0.18.0"
+version = "0.18.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8cad0c4b129e9696e37cb712b243777b90ef489a0bfaa0ac34e7d9b860e4f134"
+checksum = "39b0deead1528fd0e5947a8546a9642a9777c25f6e1e26f34c97b204bbb465bd"
 dependencies = [
- "heck",
+ "heck 0.4.1",
  "itertools",
- "proc-macro-error",
  "proc-macro2",
+ "proc-macro2-diagnostics",
  "quote",
- "syn 2.0.37",
+ "syn 2.0.66",
 ]
 
 [[package]]
 name = "parking_lot"
-version = "0.12.1"
+version = "0.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3742b2c103b9f06bc9fff0a37ff4912935851bee6d36f3c02bcc755bcfec228f"
+checksum = "f1bf18183cf54e8d6059647fc3063646a1801cf30896933ec2311622cc4b9a27"
 dependencies = [
  "lock_api",
  "parking_lot_core",
@@ -1976,22 +1954,22 @@ dependencies = [
 
 [[package]]
 name = "parking_lot_core"
-version = "0.9.8"
+version = "0.9.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "93f00c865fe7cabf650081affecd3871070f26767e7b2070a3ffae14c654b447"
+checksum = "1e401f977ab385c9e4e3ab30627d6f26d00e2c73eef317493c4ec6d468726cf8"
 dependencies = [
  "cfg-if",
  "libc",
- "redox_syscall 0.3.5",
+ "redox_syscall 0.5.1",
  "smallvec",
- "windows-targets 0.48.5",
+ "windows-targets 0.52.5",
 ]
 
 [[package]]
 name = "parse-zoneinfo"
-version = "0.3.0"
+version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c705f256449c60da65e11ff6626e0c16a0a0b96aaa348de61376b249bc340f41"
+checksum = "1f2a05b18d44e2957b88f96ba460715e295bc1d7510468a2f3d3b44535d26c24"
 dependencies = [
  "regex",
 ]
@@ -2040,9 +2018,9 @@ dependencies = [
 
 [[package]]
 name = "percent-encoding"
-version = "2.3.0"
+version = "2.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b2a4787296e9989611394c33f193f676704af1686e70b8f8033ab5ba9a35a94"
+checksum = "e3148f5046208a5d56bcfc03053e3ca6334e51da8dfb19b6cdc8b306fae3283e"
 
 [[package]]
 name = "phf"
@@ -2084,9 +2062,9 @@ dependencies = [
 
 [[package]]
 name = "pin-project-lite"
-version = "0.2.13"
+version = "0.2.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8afb450f006bf6385ca15ef45d71d2288452bc3683ce2e2cacc0d18e4be60b58"
+checksum = "bda66fc9667c18cb2758a2ac84d1167245054bcf85d5d1aaa6923f45801bdd02"
 
 [[package]]
 name = "pin-utils"
@@ -2096,15 +2074,21 @@ checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
 
 [[package]]
 name = "pkg-config"
-version = "0.3.27"
+version = "0.3.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26072860ba924cbfa98ea39c8c19b4dd6a4a25423dbdf219c1eca91aa0cf6964"
+checksum = "d231b230927b5e4ad203db57bbcbee2802f6bce620b1e4a9024a07d94e2907ec"
 
 [[package]]
 name = "portable-atomic"
-version = "1.4.3"
+version = "1.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7170ef9988bc169ba16dd36a7fa041e5c4cbeb6a35b76d4c03daded371eae7c0"
+
+[[package]]
+name = "powerfmt"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "31114a898e107c51bb1609ffaf55a0e011cf6a4d7f1170d0015a165082c0338b"
+checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
 
 [[package]]
 name = "ppv-lite86"
@@ -2114,13 +2098,12 @@ checksum = "5b40af805b3121feab8a3c29f04d8ad262fa8e0561883e7653e024ae4479e6de"
 
 [[package]]
 name = "predicates"
-version = "3.0.4"
+version = "3.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6dfc28575c2e3f19cb3c73b93af36460ae898d426eba6fc15b9bd2a5220758a0"
+checksum = "68b87bfd4605926cdfefc1c3b5f8fe560e3feca9d5552cf68c466d3d8236c7e8"
 dependencies = [
  "anstyle",
  "difflib",
- "itertools",
  "predicates-core",
 ]
 
@@ -2172,38 +2155,51 @@ checksum = "dc375e1527247fe1a97d8b7156678dfe7c1af2fc075c9a4db3690ecd2a148068"
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.67"
+version = "1.0.85"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3d433d9f1a3e8c1263d9456598b16fec66f4acc9a74dacffd35c7bb09b3a1328"
+checksum = "22244ce15aa966053a896d1accb3a6e68469b97c7f33f284b99f0d576879fc23"
 dependencies = [
  "unicode-ident",
 ]
 
+[[package]]
+name = "proc-macro2-diagnostics"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af066a9c399a26e020ada66a034357a868728e72cd426f3adcd35f80d88d88c8"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.66",
+ "version_check",
+ "yansi 1.0.1",
+]
+
 [[package]]
 name = "pulldown-cmark"
-version = "0.9.3"
+version = "0.9.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77a1a2f1f0a7ecff9c31abbe177637be0e97a0aef46cf8738ece09327985d998"
+checksum = "57206b407293d2bcd3af849ce869d52068623f19e1b5ff8e8778e3309439682b"
 dependencies = [
- "bitflags 1.3.2",
+ "bitflags 2.5.0",
  "memchr",
  "unicase",
 ]
 
 [[package]]
 name = "quick-xml"
-version = "0.24.1"
+version = "0.31.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "37dddbbe9df96afafcb8027fcf263971b726530e12f0787f620a7ba5b4846081"
+checksum = "1004a344b30a54e2ee58d66a71b32d2db2feb0a31f9a2d302bf0536f15de2a33"
 dependencies = [
  "memchr",
 ]
 
 [[package]]
 name = "quote"
-version = "1.0.33"
+version = "1.0.36"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5267fca4496028628a95160fc423a33e8b2e6af8a5302579e322e4b520293cae"
+checksum = "0fa76aaf39101c457836aec0ce2316dbdc3ab723cdda1c6bd4e6ad4208acaca7"
 dependencies = [
  "proc-macro2",
 ]
@@ -2240,9 +2236,9 @@ dependencies = [
 
 [[package]]
 name = "rayon"
-version = "1.8.0"
+version = "1.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c27db03db7734835b3f53954b534c91069375ce6ccaa2e065441e07d9b6cdb1"
+checksum = "b418a60154510ca1a002a752ca9714984e21e4241e804d32555251faf8b78ffa"
 dependencies = [
  "either",
  "rayon-core",
@@ -2250,9 +2246,9 @@ dependencies = [
 
 [[package]]
 name = "rayon-core"
-version = "1.12.0"
+version = "1.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ce3fb6ad83f861aac485e76e1985cd109d9a3713802152be56c3b1f0e0658ed"
+checksum = "1465873a3dfdaa8ae7cb14b4383657caab0b3e8a0aa9ae8e04b044854c8dfce2"
 dependencies = [
  "crossbeam-deque",
  "crossbeam-utils",
@@ -2269,27 +2265,24 @@ dependencies = [
 
 [[package]]
 name = "redox_syscall"
-version = "0.3.5"
+version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "567664f262709473930a4bf9e51bf2ebf3348f2e748ccc50dea20646858f8f29"
+checksum = "469052894dcb553421e483e4209ee581a45100d31b4018de03e5a7ad86374a7e"
 dependencies = [
- "bitflags 1.3.2",
+ "bitflags 2.5.0",
 ]
 
 [[package]]
 name = "redox_termios"
-version = "0.1.2"
+version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8440d8acb4fd3d277125b4bd01a6f38aee8d814b3b5fc09b3f2b825d37d3fe8f"
-dependencies = [
- "redox_syscall 0.2.16",
-]
+checksum = "20145670ba436b55d91fc92d25e71160fbfbdd57831631c8d7d36377a476f1cb"
 
 [[package]]
 name = "regex"
-version = "1.9.5"
+version = "1.10.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "697061221ea1b4a94a624f67d0ae2bfe4e22b8a17b6a192afb11046542cc8c47"
+checksum = "b91213439dad192326a0d7c6ee3955910425f441d7038e0d6933b0aec5c4517f"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -2299,9 +2292,9 @@ dependencies = [
 
 [[package]]
 name = "regex-automata"
-version = "0.3.8"
+version = "0.4.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c2f401f4955220693b56f8ec66ee9c78abffd8d1c4f23dc41a23839eb88f0795"
+checksum = "38caf58cc5ef2fed281f89292ef23f6365465ed9a41b7a7754eb4e26496c92df"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -2310,18 +2303,18 @@ dependencies = [
 
 [[package]]
 name = "regex-syntax"
-version = "0.7.5"
+version = "0.8.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dbb5fb1acd8a1a18b3dd5be62d25485eb770e05afb408a9627d14d451bae12da"
+checksum = "7a66a03ae7c801facd77a29370b4faec201768915ac14a721ba36f20bc9c209b"
 
 [[package]]
 name = "reqwest"
-version = "0.11.20"
+version = "0.11.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3e9ad3fe7488d7e34558a2033d45a0c90b72d97b4f80705666fea71472e2e6a1"
+checksum = "dd67538700a17451e7cba03ac727fb961abb7607553461627b97de0b89cf4a62"
 dependencies = [
  "async-compression",
- "base64 0.21.4",
+ "base64 0.21.7",
  "bytes",
  "encoding_rs",
  "futures-core",
@@ -2339,9 +2332,12 @@ dependencies = [
  "once_cell",
  "percent-encoding",
  "pin-project-lite",
+ "rustls-pemfile",
  "serde",
  "serde_json",
  "serde_urlencoded",
+ "sync_wrapper",
+ "system-configuration",
  "tokio",
  "tokio-native-tls",
  "tokio-util",
@@ -2355,9 +2351,9 @@ dependencies = [
 
 [[package]]
 name = "rustc-demangle"
-version = "0.1.23"
+version = "0.1.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d626bb9dae77e28219937af045c257c28bfd3f69333c512553507f5f9798cb76"
+checksum = "719b953e2095829ee67db738b3bfa9fa368c94900df327b3f07fe6e794d2fe1f"
 
 [[package]]
 name = "rustc_version"
@@ -2370,28 +2366,37 @@ dependencies = [
 
 [[package]]
 name = "rustix"
-version = "0.38.19"
+version = "0.38.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "745ecfa778e66b2b63c88a61cb36e0eea109e803b0b86bf9879fbc77c70e86ed"
+checksum = "70dc5ec042f7a43c4a73241207cecc9873a06d45debb38b329f8541d85c2730f"
 dependencies = [
- "bitflags 2.4.0",
+ "bitflags 2.5.0",
  "errno",
  "libc",
  "linux-raw-sys",
- "windows-sys 0.48.0",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "rustls-pemfile"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1c74cae0a4cf6ccbbf5f359f08efdf8ee7e1dc532573bf0db71968cb56b1448c"
+dependencies = [
+ "base64 0.21.7",
 ]
 
 [[package]]
 name = "rustversion"
-version = "1.0.14"
+version = "1.0.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ffc183a10b4478d04cbbbfc96d0873219d962dd5accaff2ffbd4ceb7df837f4"
+checksum = "955d28af4278de8121b7ebeb796b6a45735dc01436d898801014aced2773a3d6"
 
 [[package]]
 name = "ryu"
-version = "1.0.15"
+version = "1.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ad4cc8da4ef723ed60bced201181d83791ad433213d8c24efffda1eec85d741"
+checksum = "f3cb5ba0dc43242ce17de99c180e96db90b235b8a9fdc9543c96d2209116bd9f"
 
 [[package]]
 name = "same-file"
@@ -2404,11 +2409,11 @@ dependencies = [
 
 [[package]]
 name = "schannel"
-version = "0.1.22"
+version = "0.1.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c3733bf4cf7ea0880754e19cb5a462007c4a8c1914bff372ccc95b464f1df88"
+checksum = "fbc91545643bcf3a0bbb6569265615222618bdf33ce4ffbbd13c4bbd4c093534"
 dependencies = [
- "windows-sys 0.48.0",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -2419,11 +2424,11 @@ checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
 [[package]]
 name = "security-framework"
-version = "2.9.2"
+version = "2.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05b64fb303737d99b81884b2c63433e9ae28abebe5eb5045dcdd175dc2ecf4de"
+checksum = "c627723fd09706bacdb5cf41499e95098555af3c3c29d014dc3c458ef6be11c0"
 dependencies = [
- "bitflags 1.3.2",
+ "bitflags 2.5.0",
  "core-foundation",
  "core-foundation-sys",
  "libc",
@@ -2432,9 +2437,9 @@ dependencies = [
 
 [[package]]
 name = "security-framework-sys"
-version = "2.9.1"
+version = "2.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e932934257d3b408ed8f30db49d85ea163bfe74961f017f405b025af298f0c7a"
+checksum = "317936bbbd05227752583946b9e66d7ce3b489f84e11a94a510b4437fef407d7"
 dependencies = [
  "core-foundation-sys",
  "libc",
@@ -2451,9 +2456,9 @@ dependencies = [
 
 [[package]]
 name = "semver"
-version = "1.0.19"
+version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ad977052201c6de01a8ef2aa3378c4bd23217a056337d1d6da40468d267a4fb0"
+checksum = "61697e0a1c7e512e84a621326239844a24d8207b4669b41bc18b32ea5cbf988b"
 dependencies = [
  "serde",
 ]
@@ -2466,29 +2471,29 @@ checksum = "388a1df253eca08550bef6c72392cfe7c30914bf41df5269b68cbd6ff8f570a3"
 
 [[package]]
 name = "serde"
-version = "1.0.188"
+version = "1.0.203"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf9e0fcba69a370eed61bcf2b728575f726b50b55cba78064753d708ddc7549e"
+checksum = "7253ab4de971e72fb7be983802300c30b5a7f0c2e56fab8abfc6a214307c0094"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.188"
+version = "1.0.203"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4eca7ac642d82aa35b60049a6eccb4be6be75e599bd2e9adb5f875a737654af2"
+checksum = "500cbc0ebeb6f46627f50f3f5811ccf6bf00643be300b4c3eabc0ef55dc5b5ba"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.37",
+ "syn 2.0.66",
 ]
 
 [[package]]
 name = "serde_json"
-version = "1.0.107"
+version = "1.0.117"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6b420ce6e3d8bd882e9b243c6eed35dbc9a6110c9769e74b584e0d68d1f20c65"
+checksum = "455182ea6142b14f93f4bc5320a2b31c1f266b66a4a5c858b013302a5d8cbfc3"
 dependencies = [
  "itoa",
  "ryu",
@@ -2559,9 +2564,9 @@ checksum = "24188a676b6ae68c3b2cb3a01be17fbf7240ce009799bb56d5b1409051e78fde"
 
 [[package]]
 name = "signal-hook-registry"
-version = "1.4.1"
+version = "1.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d8229b473baa5980ac72ef434c4415e70c4b5e71b423043adb4ba059f89c99a1"
+checksum = "a9e9e0b4211b72e7b8b6e85c807d36c212bdb33ea8587f7569562a84df5465b1"
 dependencies = [
  "libc",
 ]
@@ -2577,9 +2582,9 @@ dependencies = [
 
 [[package]]
 name = "simplelog"
-version = "0.12.1"
+version = "0.12.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "acee08041c5de3d5048c8b3f6f13fafb3026b24ba43c6a695a0c76179b844369"
+checksum = "16257adbfaef1ee58b1363bdc0664c9b8e1e30aed86049635fb5f147d065a9c0"
 dependencies = [
  "log",
  "termcolor",
@@ -2618,28 +2623,18 @@ dependencies = [
 
 [[package]]
 name = "smallvec"
-version = "1.11.1"
+version = "1.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "942b4a808e05215192e39f4ab80813e599068285906cc91aa64f923db842bd5a"
+checksum = "3c5e1a9a646d36c3599cd173a41282daf47c44583ad367b8e6837255952e5c67"
 
 [[package]]
 name = "socket2"
-version = "0.4.9"
+version = "0.5.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "64a4a911eed85daf18834cfaa86a79b7d266ff93ff5ba14005426219480ed662"
+checksum = "ce305eb0b4296696835b71df73eb912e0f1ffd2556a501fcede6e0c50349191c"
 dependencies = [
  "libc",
- "winapi 0.3.9",
-]
-
-[[package]]
-name = "socket2"
-version = "0.5.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4031e820eb552adee9295814c0ced9e5cf38ddf1e8b7d566d6de8e2538ea989e"
-dependencies = [
- "libc",
- "windows-sys 0.48.0",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -2654,26 +2649,32 @@ version = "0.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "73473c0e59e6d5812c5dfe2a064a6444949f089e20eec9a2e5506596494e4623"
 
+[[package]]
+name = "strsim"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
+
 [[package]]
 name = "strum"
-version = "0.25.0"
+version = "0.26.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "290d54ea6f91c969195bdbcd7442c8c2a2ba87da8bf60a7ee86a235d4bc1e125"
+checksum = "5d8cec3501a5194c432b2b7976db6b7d10ec95c253208b45f83f7136aa985e29"
 dependencies = [
  "strum_macros",
 ]
 
 [[package]]
 name = "strum_macros"
-version = "0.25.2"
+version = "0.26.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ad8d03b598d3d0fff69bf533ee3ef19b8eeb342729596df84bcc7e1f96ec4059"
+checksum = "4c6bee85a5a24955dc440386795aa378cd9cf82acd5f764469152d2270e581be"
 dependencies = [
- "heck",
+ "heck 0.5.0",
  "proc-macro2",
  "quote",
  "rustversion",
- "syn 2.0.37",
+ "syn 2.0.66",
 ]
 
 [[package]]
@@ -2695,26 +2696,52 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.37"
+version = "2.0.66"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7303ef2c05cd654186cb250d29049a24840ca25d2747c25c0381c8d9e2f582e8"
+checksum = "c42f3f41a2de00b01c0aaad383c5a45241efc8b2d1eda5661812fda5f3cdcff5"
 dependencies = [
  "proc-macro2",
  "quote",
  "unicode-ident",
 ]
 
+[[package]]
+name = "sync_wrapper"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2047c6ded9c721764247e62cd3b03c09ffc529b2ba5b10ec482ae507a4a70160"
+
+[[package]]
+name = "system-configuration"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba3a3adc5c275d719af8cb4272ea1c4a6d668a777f37e115f6d11ddbc1c8e0e7"
+dependencies = [
+ "bitflags 1.3.2",
+ "core-foundation",
+ "system-configuration-sys",
+]
+
+[[package]]
+name = "system-configuration-sys"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a75fb188eb626b924683e3b95e3a48e63551fcfb51949de2f06a9d91dbee93c9"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
 [[package]]
 name = "tempfile"
-version = "3.8.0"
+version = "3.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb94d2f3cc536af71caac6b6fcebf65860b347e7ce0cc9ebe8f70d3e521054ef"
+checksum = "85b77fafb263dd9d05cbeac119526425676db3784113aa9295c88498cbf8bff1"
 dependencies = [
  "cfg-if",
  "fastrand",
- "redox_syscall 0.3.5",
  "rustix",
- "windows-sys 0.48.0",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -2730,9 +2757,9 @@ dependencies = [
 
 [[package]]
 name = "termcolor"
-version = "1.1.3"
+version = "1.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bab24d30b911b2376f3a13cc2cd443142f0c81dda04c118693e35b3835757755"
+checksum = "06794f8f6c5c898b3275aebefa6b8a1cb24cd2c6c79397ab15774837a0bc5755"
 dependencies = [
  "winapi-util",
 ]
@@ -2778,42 +2805,38 @@ version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3369f5ac52d5eb6ab48c6b4ffdc8efbcad6b89c765749064ba298f2c68a16a76"
 
-[[package]]
-name = "textwrap"
-version = "0.16.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "222a222a5bfe1bba4a77b45ec488a741b3cb8872e5e499451fd7d0129c9c7c3d"
-
 [[package]]
 name = "thiserror"
-version = "1.0.49"
+version = "1.0.61"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1177e8c6d7ede7afde3585fd2513e611227efd6481bd78d2e82ba1ce16557ed4"
+checksum = "c546c80d6be4bc6a00c0f01730c08df82eaa7a7a61f11d656526506112cc1709"
 dependencies = [
  "thiserror-impl",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "1.0.49"
+version = "1.0.61"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "10712f02019e9288794769fba95cd6847df9874d49d871d062172f9dd41bc4cc"
+checksum = "46c3384250002a6d5af4d114f2845d37b57521033f30d5c3f46c4d70e1197533"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.37",
+ "syn 2.0.66",
 ]
 
 [[package]]
 name = "time"
-version = "0.3.29"
+version = "0.3.36"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "426f806f4089c493dcac0d24c29c01e2c38baf8e30f1b716ee37e83d200b18fe"
+checksum = "5dfd88e563464686c916c7e46e623e520ddc6d79fa6641390f2e3fa86e83e885"
 dependencies = [
  "deranged",
  "itoa",
  "libc",
+ "num-conv",
  "num_threads",
+ "powerfmt",
  "serde",
  "time-core",
  "time-macros",
@@ -2827,10 +2850,11 @@ checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3"
 
 [[package]]
 name = "time-macros"
-version = "0.2.15"
+version = "0.2.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4ad70d68dba9e1f8aceda7aa6711965dfec1cac869f311a51bd08b3a2ccbce20"
+checksum = "3f252a68540fde3a3877aeea552b832b40ab9a69e318efd078774a01ddee1ccf"
 dependencies = [
+ "num-conv",
  "time-core",
 ]
 
@@ -2851,9 +2875,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "tokio"
-version = "1.32.0"
+version = "1.38.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "17ed6077ed6cd6c74735e21f37eb16dc3935f96878b1fe961074089cc80893f9"
+checksum = "ba4f4a02a7a80d6f274636f0aa95c7e383b912d41fe721a31f29e29698585a4a"
 dependencies = [
  "backtrace",
  "bytes",
@@ -2863,7 +2887,7 @@ dependencies = [
  "parking_lot",
  "pin-project-lite",
  "signal-hook-registry",
- "socket2 0.5.4",
+ "socket2",
  "tokio-macros",
  "windows-sys 0.48.0",
 ]
@@ -2876,13 +2900,13 @@ checksum = "2e57fbf1da3f18c8a95469f8973c138b0a99f4ae761885c3646b0c61139b0522"
 
 [[package]]
 name = "tokio-macros"
-version = "2.1.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "630bdcf245f78637c13ec01ffae6187cca34625e8c63150d424b59e55af2675e"
+checksum = "5f5ae998a069d4b5aba8ee9dad856af7d520c3699e6159b185c2acd48155d39a"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.37",
+ "syn 2.0.66",
 ]
 
 [[package]]
@@ -2897,16 +2921,15 @@ dependencies = [
 
 [[package]]
 name = "tokio-util"
-version = "0.7.9"
+version = "0.7.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d68074620f57a0b21594d9735eb2e98ab38b17f80d3fcb189fca266771ca60d"
+checksum = "9cf6b47b3771c49ac75ad09a6162f53ad4b8088b76ac60e8ec1455b31a189fe1"
 dependencies = [
  "bytes",
  "futures-core",
  "futures-sink",
  "pin-project-lite",
  "tokio",
- "tracing",
 ]
 
 [[package]]
@@ -2917,29 +2940,28 @@ checksum = "b6bc1c9ce2b5135ac7f93c72918fc37feb872bdc6a5533a8b85eb4b86bfdae52"
 
 [[package]]
 name = "tracing"
-version = "0.1.37"
+version = "0.1.40"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ce8c33a8d48bd45d624a6e523445fd21ec13d3653cd51f681abf67418f54eb8"
+checksum = "c3523ab5a71916ccf420eebdf5521fcef02141234bbc0b8a49f2fdc4544364ef"
 dependencies = [
- "cfg-if",
  "pin-project-lite",
  "tracing-core",
 ]
 
 [[package]]
 name = "tracing-core"
-version = "0.1.31"
+version = "0.1.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0955b8137a1df6f1a2e9a37d8a6656291ff0297c1a97c24e0d8425fe2312f79a"
+checksum = "c06d3da6113f116aaee68e4d601191614c9053067f9ab7f6edbcb161237daa54"
 dependencies = [
  "once_cell",
 ]
 
 [[package]]
 name = "try-lock"
-version = "0.2.4"
+version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3528ecfd12c466c6f163363caf2d02a71161dd5e1cc6ae7b34207ea2d42d81ed"
+checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
 
 [[package]]
 name = "typenum"
@@ -2958,9 +2980,9 @@ dependencies = [
 
 [[package]]
 name = "unicode-bidi"
-version = "0.3.13"
+version = "0.3.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92888ba5573ff080736b3648696b70cafad7d250551175acbaa4e0385b3e1460"
+checksum = "08f95100a766bf4f8f28f90d77e0a5461bbdb219042e7679bebe79004fed8d75"
 
 [[package]]
 name = "unicode-ident"
@@ -2970,24 +2992,24 @@ checksum = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b"
 
 [[package]]
 name = "unicode-normalization"
-version = "0.1.22"
+version = "0.1.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c5713f0fc4b5db668a2ac63cdb7bb4469d8c9fed047b1d0292cc7b0ce2ba921"
+checksum = "a56d1686db2308d901306f92a263857ef59ea39678a5458e7cb17f01415101f5"
 dependencies = [
  "tinyvec",
 ]
 
 [[package]]
 name = "unicode-width"
-version = "0.1.11"
+version = "0.1.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e51733f11c9c4f72aa0c160008246859e340b00807569a0da0e7a1079b27ba85"
+checksum = "0336d538f7abc86d282a4189614dfaa90810dfc2c6f6427eaf88e16311dd225d"
 
 [[package]]
 name = "url"
-version = "2.4.1"
+version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "143b538f18257fac9cad154828a57c6bf5157e1aa604d4816b5995bf6de87ae5"
+checksum = "31e6302e3bb753d46e83516cae55ae196fc0c309407cf11ab35cc51a4c2a4633"
 dependencies = [
  "form_urlencoded",
  "idna",
@@ -2996,9 +3018,9 @@ dependencies = [
 
 [[package]]
 name = "utf8parse"
-version = "0.2.1"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "711b9620af191e0cdc7468a8d14e709c3dcdb115b36f838e601583af800a370a"
+checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
 
 [[package]]
 name = "vcpkg"
@@ -3029,9 +3051,9 @@ dependencies = [
 
 [[package]]
 name = "walkdir"
-version = "2.4.0"
+version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d71d857dc86794ca4c280d616f7da00d2dbfd8cd788846559a6813e6aa4b54ee"
+checksum = "29790946404f91d9c5d06f9874efddea1dc06c5efe94541a7d6863108e3a5e4b"
 dependencies = [
  "same-file",
  "winapi-util",
@@ -3054,9 +3076,9 @@ checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.87"
+version = "0.2.92"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7706a72ab36d8cb1f80ffbf0e071533974a60d0a308d01a5d0375bf60499a342"
+checksum = "4be2531df63900aeb2bca0daaaddec08491ee64ceecbee5076636a3b026795a8"
 dependencies = [
  "cfg-if",
  "wasm-bindgen-macro",
@@ -3064,24 +3086,24 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-backend"
-version = "0.2.87"
+version = "0.2.92"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ef2b6d3c510e9625e5fe6f509ab07d66a760f0885d858736483c32ed7809abd"
+checksum = "614d787b966d3989fa7bb98a654e369c762374fd3213d212cfc0251257e747da"
 dependencies = [
  "bumpalo",
  "log",
  "once_cell",
  "proc-macro2",
  "quote",
- "syn 2.0.37",
+ "syn 2.0.66",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-futures"
-version = "0.4.37"
+version = "0.4.42"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c02dbc21516f9f1f04f187958890d7e6026df8d16540b7ad9492bc34a67cea03"
+checksum = "76bc14366121efc8dbb487ab05bcc9d346b3b5ec0eaa76e46594cabbe51762c0"
 dependencies = [
  "cfg-if",
  "js-sys",
@@ -3091,9 +3113,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.87"
+version = "0.2.92"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dee495e55982a3bd48105a7b947fd2a9b4a8ae3010041b9e0faab3f9cd028f1d"
+checksum = "a1f8823de937b71b9460c0c34e25f3da88250760bec0ebac694b49997550d726"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -3101,28 +3123,28 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.87"
+version = "0.2.92"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "54681b18a46765f095758388f2d0cf16eb8d4169b639ab575a8f5693af210c7b"
+checksum = "e94f17b526d0a461a191c78ea52bbce64071ed5c04c9ffe424dcb38f74171bb7"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.37",
+ "syn 2.0.66",
  "wasm-bindgen-backend",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.87"
+version = "0.2.92"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca6ad05a4870b2bf5fe995117d3728437bd27d7cd5f06f13c17443ef369775a1"
+checksum = "af190c94f2773fdb3729c55b007a722abb5384da03bc0986df4c289bf5567e96"
 
 [[package]]
 name = "web-sys"
-version = "0.3.64"
+version = "0.3.69"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b85cbef8c220a6abc02aefd892dfc0fc23afb1c6a426316ec33253a3877249b"
+checksum = "77afa9a11836342370f4817622a2f0f418b134426d91a82dfb48f532d2ec13ef"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
@@ -3158,11 +3180,11 @@ checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
 
 [[package]]
 name = "winapi-util"
-version = "0.1.6"
+version = "0.1.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f29e6f9198ba0d26b4c9f07dbe6f9ed633e1f3d5b8b414090084349e46a52596"
+checksum = "4d4cc384e1e73b93bafa6fb4f1df8c41695c8a91cf9c4c64358067d15a7b6c6b"
 dependencies = [
- "winapi 0.3.9",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -3172,12 +3194,12 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
-name = "windows"
-version = "0.48.0"
+name = "windows-core"
+version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e686886bc078bc1b0b600cac0147aadb815089b6e4da64016cbd754b6342700f"
+checksum = "33ab640c8d7e35bf8ba19b884ba838ceb4fba93a4e8c65a9059d08afcfc683d9"
 dependencies = [
- "windows-targets 0.48.5",
+ "windows-targets 0.52.5",
 ]
 
 [[package]]
@@ -3195,15 +3217,6 @@ dependencies = [
  "windows_x86_64_msvc 0.42.2",
 ]
 
-[[package]]
-name = "windows-sys"
-version = "0.45.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75283be5efb2831d37ea142365f009c02ec203cd29a3ebecbc093d52315b66d0"
-dependencies = [
- "windows-targets 0.42.2",
-]
-
 [[package]]
 name = "windows-sys"
 version = "0.48.0"
@@ -3214,18 +3227,12 @@ dependencies = [
 ]
 
 [[package]]
-name = "windows-targets"
-version = "0.42.2"
+name = "windows-sys"
+version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e5180c00cd44c9b1c88adb3693291f1cd93605ded80c250a75d472756b4d071"
+checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
 dependencies = [
- "windows_aarch64_gnullvm 0.42.2",
- "windows_aarch64_msvc 0.42.2",
- "windows_i686_gnu 0.42.2",
- "windows_i686_msvc 0.42.2",
- "windows_x86_64_gnu 0.42.2",
- "windows_x86_64_gnullvm 0.42.2",
- "windows_x86_64_msvc 0.42.2",
+ "windows-targets 0.52.5",
 ]
 
 [[package]]
@@ -3243,6 +3250,22 @@ dependencies = [
  "windows_x86_64_msvc 0.48.5",
 ]
 
+[[package]]
+name = "windows-targets"
+version = "0.52.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6f0713a46559409d202e70e28227288446bf7841d3211583a4b53e3f6d96e7eb"
+dependencies = [
+ "windows_aarch64_gnullvm 0.52.5",
+ "windows_aarch64_msvc 0.52.5",
+ "windows_i686_gnu 0.52.5",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc 0.52.5",
+ "windows_x86_64_gnu 0.52.5",
+ "windows_x86_64_gnullvm 0.52.5",
+ "windows_x86_64_msvc 0.52.5",
+]
+
 [[package]]
 name = "windows_aarch64_gnullvm"
 version = "0.42.2"
@@ -3255,6 +3278,12 @@ version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"
 
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7088eed71e8b8dda258ecc8bac5fb1153c5cffaf2578fc8ff5d61e23578d3263"
+
 [[package]]
 name = "windows_aarch64_msvc"
 version = "0.42.2"
@@ -3267,6 +3296,12 @@ version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"
 
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9985fd1504e250c615ca5f281c3f7a6da76213ebd5ccc9561496568a2752afb6"
+
 [[package]]
 name = "windows_i686_gnu"
 version = "0.42.2"
@@ -3279,6 +3314,18 @@ version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"
 
+[[package]]
+name = "windows_i686_gnu"
+version = "0.52.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "88ba073cf16d5372720ec942a8ccbf61626074c6d4dd2e745299726ce8b89670"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.52.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "87f4261229030a858f36b459e748ae97545d6f1ec60e5e0d6a3d32e0dc232ee9"
+
 [[package]]
 name = "windows_i686_msvc"
 version = "0.42.2"
@@ -3291,6 +3338,12 @@ version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"
 
+[[package]]
+name = "windows_i686_msvc"
+version = "0.52.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db3c2bf3d13d5b658be73463284eaf12830ac9a26a90c717b7f771dfe97487bf"
+
 [[package]]
 name = "windows_x86_64_gnu"
 version = "0.42.2"
@@ -3303,6 +3356,12 @@ version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"
 
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4e4246f76bdeff09eb48875a0fd3e2af6aada79d409d33011886d3e1581517d9"
+
 [[package]]
 name = "windows_x86_64_gnullvm"
 version = "0.42.2"
@@ -3315,6 +3374,12 @@ version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"
 
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "852298e482cd67c356ddd9570386e2862b5673c85bd5f88df9ab6802b334c596"
+
 [[package]]
 name = "windows_x86_64_msvc"
 version = "0.42.2"
@@ -3327,6 +3392,12 @@ version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
 
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bec47e5bfd1bff0eeaf6d8b485cc1074891a197ab4225d504cb7a1ab88b02bf0"
+
 [[package]]
 name = "winreg"
 version = "0.50.0"
@@ -3360,16 +3431,43 @@ version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "09041cd90cf85f7f8b2df60c646f853b7f535ce68f85244eb6731cf89fa498ec"
 
+[[package]]
+name = "yansi"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cfe53a6657fd280eaa890a3bc59152892ffa3e30101319d168b781ed6529b049"
+
+[[package]]
+name = "zerocopy"
+version = "0.7.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae87e3fcd617500e5d106f0380cf7b77f3c6092aae37191433159dda23cfb087"
+dependencies = [
+ "zerocopy-derive",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.7.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "15e934569e47891f7d9411f1a451d947a60e000ab3bd24fbb970f000387d1b3b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.66",
+]
+
 [[package]]
 name = "zeroize"
-version = "1.6.0"
+version = "1.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2a0956f1ba7c7909bfb66c2e9e4124ab6f6482560f6628b5aaeba39207c9aad9"
+checksum = "ced3678a2879b30306d323f4542626697a464a97c0a07c9aebf7ebca65cd4dde"
 
 [[package]]
 name = "zip"
 version = "0.6.6"
-source = "git+https://github.com/janstarke/zip.git#a03b4e8ff9895f2cf5d4cea470a4e51f271e9929"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "760394e246e4c28189f19d488c058bf16f564016aefac5d32bb1f3b51d5e9261"
 dependencies = [
  "aes",
  "byteorder",
@@ -3406,9 +3504,9 @@ dependencies = [
 
 [[package]]
 name = "zstd-sys"
-version = "2.0.9+zstd.1.5.5"
+version = "2.0.10+zstd.1.5.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9e16efa8a874a0481a574084d34cc26fdb3b99627480f785888deb6386506656"
+checksum = "c253a4914af5bafc8fa8c86ee400827e83cf6ec01195ec1f1ed8441bf00d65aa"
 dependencies = [
  "cc",
  "pkg-config",
diff --git a/Cargo.toml b/Cargo.toml
index f996e8a..c42ca16 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -186,8 +186,7 @@ frnsc-prefetch = {version="0.9", optional=true}
 forensic-rs = {version="0.9.1", optional=true}
 
 # zip2bodyfile
-# zip = {version="0.6", optional=true}
-zip = {version="0.6", optional=true, git="https://github.com/janstarke/zip.git"}
+zip = {version="0.6", optional=true}
 
 [dev-dependencies]
 

From 5351569f822b60af25fee6f0327efc64a833a7bf Mon Sep 17 00:00:00 2001
From: Jan Starke <jan.starke@posteo.de>
Date: Mon, 10 Jun 2024 16:57:04 +0200
Subject: [PATCH 30/35] fix #47: use clap-markdown-dfir

---
 Cargo.lock              | 46 +++++++++++++++++++++++++++++++++++++----
 Cargo.toml              |  5 +++--
 doc/cleanhive.md        |  4 ++--
 doc/es4forensics.md     | 10 +++++++--
 doc/evtx2bodyfile.md    |  7 +++++--
 doc/evtxanalyze.md      | 13 +++++++-----
 doc/evtxcat.md          |  7 +++++--
 doc/evtxls.md           | 14 ++++++++++---
 doc/evtxscan.md         |  7 +++++--
 doc/hivescan.md         |  7 +++++--
 doc/ipgrep.md           |  7 +++++--
 doc/lnk2bodyfile.md     |  4 ++--
 doc/mactime2.md         | 22 +++++++++++++++-----
 doc/pf2bodyfile.md      |  7 +++++--
 doc/pol_export.md       |  4 ++--
 doc/regdump.md          | 13 ++++++++++--
 doc/ts2date.md          |  4 ++--
 doc/zip2bodyfile.md     |  7 +++++--
 src/bin/mactime2/cli.rs | 20 ++++++++----------
 src/common/parse_cli.rs |  2 +-
 20 files changed, 153 insertions(+), 57 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 6ca13cc..5a7b865 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -448,10 +448,10 @@ dependencies = [
 ]
 
 [[package]]
-name = "clap-markdown"
-version = "0.1.3"
+name = "clap-markdown-dfir"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "325f50228f76921784b6d9f2d62de6778d834483248eefecd27279174797e579"
+checksum = "ab533b2e36fe7d2b5ef22ad06eb610e5232993bc15a7b8d2e49ace9d64f300df"
 dependencies = [
  "clap",
 ]
@@ -521,6 +521,27 @@ dependencies = [
  "windows-sys 0.42.0",
 ]
 
+[[package]]
+name = "color-print"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ee543c60ff3888934877a5671f45494dd27ed4ba25c6670b9a7576b7ed7a8c0"
+dependencies = [
+ "color-print-proc-macro",
+]
+
+[[package]]
+name = "color-print-proc-macro"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77ff1a80c5f3cb1ca7c06ffdd71b6a6dd6d8f896c42141fbd43f50ed28dcdb93"
+dependencies = [
+ "nom",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.66",
+]
+
 [[package]]
 name = "colorchoice"
 version = "1.0.1"
@@ -793,10 +814,11 @@ dependencies = [
  "chrono",
  "chrono-tz",
  "clap",
- "clap-markdown",
+ "clap-markdown-dfir",
  "clap-verbosity-flag",
  "clap_complete",
  "clio",
+ "color-print",
  "colored",
  "colored_json",
  "csv",
@@ -1838,6 +1860,12 @@ version = "0.3.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
 
+[[package]]
+name = "minimal-lexical"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
+
 [[package]]
 name = "miniz_oxide"
 version = "0.7.3"
@@ -1881,6 +1909,16 @@ dependencies = [
  "tempfile",
 ]
 
+[[package]]
+name = "nom"
+version = "7.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d273983c5a657a70a3e8f2a01329822f3b8c8172b73826411a55751e404a0a4a"
+dependencies = [
+ "memchr",
+ "minimal-lexical",
+]
+
 [[package]]
 name = "nt_hive2"
 version = "4.2.1"
diff --git a/Cargo.toml b/Cargo.toml
index 393171d..72caf5c 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -98,7 +98,7 @@ required-features = ["zip2bodyfile"]
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 [features]
 default = ["pol_export", "mactime2", "evtxtools", "regdump", "hivescan", "cleanhive", "ipgrep", "ts2date", "lnk2bodyfile", "pf2bodyfile", "zip2bodyfile"]
-mactime2 = ["gzip", "elastic", "chrono-tz", "thiserror", "bitflags", "encoding_rs_io"]
+mactime2 = ["gzip", "elastic", "chrono-tz", "thiserror", "bitflags", "encoding_rs_io", "color-print"]
 gzip = ["flate2"]
 elastic = ["elasticsearch", "tokio", "futures", "serde_json", "sha2", "base64", "num-traits", "num-derive", "strum", "strum_macros", "tokio-async-drop"]
 evtxtools = ["evtxscan", "evtxcat", "evtxls", "evtxanalyze", "evtx2bodyfile"]
@@ -133,7 +133,7 @@ winstructs = "0.3.0"
 lazy_static = "1.4"
 regex = {version = "1", optional=true}
 
-clap-markdown = "0.1.3"
+clap-markdown-dfir = "0.2.0"
 clap_complete = "4"
 clio = {version="0.3", features=["clap-parse"] }
 #clio = {path="../clio", features=["clap-parse"]}
@@ -145,6 +145,7 @@ flate2 = {version="1", optional=true}
 thiserror = {version="1", optional=true}
 bitflags = {version="2", optional=true}
 encoding_rs_io = {version="0.1", optional=true}
+color-print = {version="0.3.6", optional=true}
 
 # evtxtools
 dfirtk-eventdata = {version="0.1.2", optional=true}
diff --git a/doc/cleanhive.md b/doc/cleanhive.md
index 4548d2e..989060c 100644
--- a/doc/cleanhive.md
+++ b/doc/cleanhive.md
@@ -19,8 +19,8 @@ merges logfiles into a hive file
 ###### **Options:**
 
 * `-L`, `--log <LOGFILES>` — transaction LOG file(s). This argument can be specified one or two times
-* `-v`, `--verbose` — More output per occurrence
-* `-q`, `--quiet` — Less output per occurrence
+* `-v`, `--verbose` — Increase logging verbosity
+* `-q`, `--quiet` — Decrease logging verbosity
 * `-O`, `--output <DST_HIVE>` — name of the file to which the cleaned hive will be written
 
   Default value: `-`
diff --git a/doc/es4forensics.md b/doc/es4forensics.md
index ee1f07b..efef149 100644
--- a/doc/es4forensics.md
+++ b/doc/es4forensics.md
@@ -22,6 +22,9 @@ This crates provides structs and functions to insert timeline data into an elast
 ###### **Options:**
 
 * `--strict` — strict mode: do not only warn, but abort if an error occurs
+
+  Possible values: `true`, `false`
+
 * `-I`, `--index <INDEX_NAME>` — name of the elasticsearch index
 * `-H`, `--host <HOST>` — server name or IP address of elasticsearch server
 
@@ -38,12 +41,15 @@ This crates provides structs and functions to insert timeline data into an elast
 * `-k`, `--insecure` — omit certificate validation
 
   Default value: `false`
+
+  Possible values: `true`, `false`
+
 * `-U`, `--username <USERNAME>` — username for elasticsearch server
 
   Default value: `elastic`
 * `-W`, `--password <PASSWORD>` — password for authenticating at elasticsearch
-* `-v`, `--verbose` — More output per occurrence
-* `-q`, `--quiet` — Less output per occurrence
+* `-v`, `--verbose` — Increase logging verbosity
+* `-q`, `--quiet` — Decrease logging verbosity
 
 
 
diff --git a/doc/evtx2bodyfile.md b/doc/evtx2bodyfile.md
index 3021022..edd4c05 100644
--- a/doc/evtx2bodyfile.md
+++ b/doc/evtx2bodyfile.md
@@ -25,8 +25,11 @@ creates bodyfile from Windows evtx files
   Possible values: `json`, `bodyfile`
 
 * `-S`, `--strict` — fail upon read error
-* `-v`, `--verbose` — More output per occurrence
-* `-q`, `--quiet` — Less output per occurrence
+
+  Possible values: `true`, `false`
+
+* `-v`, `--verbose` — Increase logging verbosity
+* `-q`, `--quiet` — Decrease logging verbosity
 
 
 
diff --git a/doc/evtxanalyze.md b/doc/evtxanalyze.md
index ebb1dae..8a913e2 100644
--- a/doc/evtxanalyze.md
+++ b/doc/evtxanalyze.md
@@ -23,8 +23,8 @@ crate provide functions to analyze evtx files
 
 ###### **Options:**
 
-* `-v`, `--verbose` — More output per occurrence
-* `-q`, `--quiet` — Less output per occurrence
+* `-v`, `--verbose` — Increase logging verbosity
+* `-q`, `--quiet` — Decrease logging verbosity
 
 
 
@@ -36,7 +36,7 @@ generate a process tree
 
 ###### **Arguments:**
 
-* `<EVTX_FILE>` — Name of the evtx file to parse
+* `<EVTX_FILE>` — Name of the evtx file to parse (should be the path to "Security.evtx")
 
 ###### **Options:**
 
@@ -58,12 +58,15 @@ display sessions
 
 ###### **Arguments:**
 
-* `<EVTX_FILES_DIR>` — Names of the evtx files to parse
+* `<EVTX_FILES_DIR>` — Names of the evtx files directory to parse. Be aware that this tool assumes some file names. If you renamed the files, session analysis wil not work correctly
 
 ###### **Options:**
 
 * `--include-anonymous` — include anonymous sessions
 
+  Possible values: `true`, `false`
+
+
 
 
 ## `evtxanalyze session`
@@ -74,7 +77,7 @@ display one single session
 
 ###### **Arguments:**
 
-* `<EVTX_FILES_DIR>` — Names of the evtx files to parse
+* `<EVTX_FILES_DIR>` — Names of the evtx files directory to parse. Be aware that this tool assumes some file names. If you renamed the files, session analysis wil not work correctly
 * `<SESSION_ID>` — Session ID
 
 
diff --git a/doc/evtxcat.md b/doc/evtxcat.md
index 5e30f51..b0c4b05 100644
--- a/doc/evtxcat.md
+++ b/doc/evtxcat.md
@@ -22,14 +22,17 @@ Display one or more events from an evtx file
 * `--max <MAX>` — filter: maximal event record identifier
 * `-i`, `--id <ID>` — show only the one event with this record identifier
 * `-T`, `--display-table` — don't display the records in a table format
+
+  Possible values: `true`, `false`
+
 * `-F`, `--format <FORMAT>` — output format
 
   Default value: `xml`
 
   Possible values: `json`, `xml`
 
-* `-v`, `--verbose` — More output per occurrence
-* `-q`, `--quiet` — Less output per occurrence
+* `-v`, `--verbose` — Increase logging verbosity
+* `-q`, `--quiet` — Decrease logging verbosity
 
 
 
diff --git a/doc/evtxls.md b/doc/evtxls.md
index 2cb1abe..e3d5d96 100644
--- a/doc/evtxls.md
+++ b/doc/evtxls.md
@@ -21,7 +21,12 @@ Display one or more events from an evtx file
 * `-d`, `--delimiter <DELIMITER>` — use this delimiter instead of generating fixed space columns
 * `-i`, `--include <INCLUDED_EVENT_IDS>` — List events with only the specified event ids, separated by ','
 * `-x`, `--exclude <EXCLUDED_EVENT_IDS>` — Exclude events with the specified event ids, separated by ','
-* `-c`, `--colors` — highlight interesting content using colors
+* `-C`, `--color <DISPLAY_COLORS>` — highlight interesting content using colors
+
+  Default value: `auto`
+
+  Possible values: `auto`, `always`, `never`
+
 * `-f`, `--from <NOT_BEFORE>` — hide events older than the specified date (hint: use RFC 3339 syntax)
 * `-t`, `--to <NOT_AFTER>` — hide events newer than the specified date (hint: use RFC 3339 syntax)
 * `-r`, `--regex <HIGHLIGHT>` — highlight event data based on this regular expression
@@ -56,8 +61,11 @@ Display one or more events from an evtx file
 * `-B`, `--hide-base-fields` — don't display any common event fields at all. This corresponds to specifying '--base-fields' without any values (which is not allowed, that's why there is this flag)
 
   Default value: `false`
-* `-v`, `--verbose` — More output per occurrence
-* `-q`, `--quiet` — Less output per occurrence
+
+  Possible values: `true`, `false`
+
+* `-v`, `--verbose` — Increase logging verbosity
+* `-q`, `--quiet` — Decrease logging verbosity
 
 
 
diff --git a/doc/evtxscan.md b/doc/evtxscan.md
index b612996..21930ea 100644
--- a/doc/evtxscan.md
+++ b/doc/evtxscan.md
@@ -19,11 +19,14 @@ Find time skews in an evtx file
 ###### **Options:**
 
 * `-S`, `--show-records` — display also the contents of the records befor and after a time skew
+
+  Possible values: `true`, `false`
+
 * `-N`, `--negative-tolerance <NEGATIVE_TOLERANCE>` — negative tolerance limit (in seconds): time skews to the past below this limit will be ignored
 
   Default value: `5`
-* `-v`, `--verbose` — More output per occurrence
-* `-q`, `--quiet` — Less output per occurrence
+* `-v`, `--verbose` — Increase logging verbosity
+* `-q`, `--quiet` — Decrease logging verbosity
 
 
 
diff --git a/doc/hivescan.md b/doc/hivescan.md
index 0edfb85..ae0b69b 100644
--- a/doc/hivescan.md
+++ b/doc/hivescan.md
@@ -19,10 +19,13 @@ scans a registry hive file for deleted entries
 ###### **Options:**
 
 * `-L`, `--log <LOGFILES>` — transaction LOG file(s). This argument can be specified one or two times
-* `-v`, `--verbose` — More output per occurrence
-* `-q`, `--quiet` — Less output per occurrence
+* `-v`, `--verbose` — Increase logging verbosity
+* `-q`, `--quiet` — Decrease logging verbosity
 * `-b` — output as bodyfile format
 
+  Possible values: `true`, `false`
+
+
 
 
 <hr/>
diff --git a/doc/ipgrep.md b/doc/ipgrep.md
index c947391..09cbac3 100644
--- a/doc/ipgrep.md
+++ b/doc/ipgrep.md
@@ -28,8 +28,11 @@ search for IP addresses in text files
 
 * `-I`, `--ignore-ips <IGNORE_IPS>` — ignore any of the specified IP addresses. Values are delimited with comma
 * `-c`, `--colors` — highlight interesting content using colors
-* `-v`, `--verbose` — More output per occurrence
-* `-q`, `--quiet` — Less output per occurrence
+
+  Possible values: `true`, `false`
+
+* `-v`, `--verbose` — Increase logging verbosity
+* `-q`, `--quiet` — Decrease logging verbosity
 
 
 
diff --git a/doc/lnk2bodyfile.md b/doc/lnk2bodyfile.md
index 3d528de..1daa9d7 100644
--- a/doc/lnk2bodyfile.md
+++ b/doc/lnk2bodyfile.md
@@ -20,8 +20,8 @@ Parse Windows LNK files and create bodyfile output
 
 ###### **Options:**
 
-* `-v`, `--verbose` — More output per occurrence
-* `-q`, `--quiet` — Less output per occurrence
+* `-v`, `--verbose` — Increase logging verbosity
+* `-q`, `--quiet` — Decrease logging verbosity
 
 
 
diff --git a/doc/mactime2.md b/doc/mactime2.md
index e038dc3..de57075 100644
--- a/doc/mactime2.md
+++ b/doc/mactime2.md
@@ -8,10 +8,16 @@ This document contains the help content for the `mactime2` command-line program.
 
 ## `mactime2`
 
-replacement for `mactime`
+Replacement for `mactime`
 
 **Usage:** `mactime2 [OPTIONS]`
 
+IMPORTANT
+
+Note that POSIX specifies that all UNIX timestamps are UTC timestamps. It is
+up to you to ensure that the bodyfile only contains UNIX timestamps that
+comply with the POSIX standard.
+
 ###### **Options:**
 
 * `-b <INPUT_FILE>` — path to input file or '-' for stdin (files ending with .gz will be treated as being gzipped)
@@ -22,16 +28,22 @@ replacement for `mactime`
   Possible values: `csv`, `txt`, `json`, `elastic`
 
 * `-d` — output as CSV instead of TXT. This is a conveniance option, which is identical to `--format=csv` and will be removed in a future release. If you specified `--format` and `-d`, the latter will be ignored
+
+  Possible values: `true`, `false`
+
 * `-j` — output as JSON instead of TXT. This is a conveniance option, which is identical to `--format=json` and will be removed in a future release. If you specified `--format` and `-j`, the latter will be ignored
-* `-f`, `--from-timezone <SRC_ZONE>` — name of offset of source timezone (or 'list' to display all possible values
 
-  Default value: `UTC`
+  Possible values: `true`, `false`
+
 * `-t`, `--to-timezone <DST_ZONE>` — name of offset of destination timezone (or 'list' to display all possible values
 
   Default value: `UTC`
 * `--strict` — strict mode: do not only warn, but abort if an error occurs
-* `-v`, `--verbose` — More output per occurrence
-* `-q`, `--quiet` — Less output per occurrence
+
+  Possible values: `true`, `false`
+
+* `-v`, `--verbose` — Increase logging verbosity
+* `-q`, `--quiet` — Decrease logging verbosity
 
 
 
diff --git a/doc/pf2bodyfile.md b/doc/pf2bodyfile.md
index 748437b..8229311 100644
--- a/doc/pf2bodyfile.md
+++ b/doc/pf2bodyfile.md
@@ -19,8 +19,11 @@ creates bodyfile from Windows Prefetch files
 ###### **Options:**
 
 * `-I` — show not only the executed files, but all references files -- such as libraries -- as well
-* `-v`, `--verbose` — More output per occurrence
-* `-q`, `--quiet` — Less output per occurrence
+
+  Possible values: `true`, `false`
+
+* `-v`, `--verbose` — Increase logging verbosity
+* `-q`, `--quiet` — Decrease logging verbosity
 
 
 
diff --git a/doc/pol_export.md b/doc/pol_export.md
index 3d0f28d..20037b7 100644
--- a/doc/pol_export.md
+++ b/doc/pol_export.md
@@ -18,8 +18,8 @@ Exporter for Windows Registry Policy Files
 
 ###### **Options:**
 
-* `-v`, `--verbose` — More output per occurrence
-* `-q`, `--quiet` — Less output per occurrence
+* `-v`, `--verbose` — Increase logging verbosity
+* `-q`, `--quiet` — Decrease logging verbosity
 
 
 
diff --git a/doc/regdump.md b/doc/regdump.md
index 4c9edd0..5cb965a 100644
--- a/doc/regdump.md
+++ b/doc/regdump.md
@@ -20,10 +20,19 @@ parses registry hive files and prints a bodyfile
 
 * `-L`, `--log <LOGFILES>` — transaction LOG file(s). This argument can be specified one or two times
 * `-b`, `--bodyfile` — print as bodyfile format
+
+  Possible values: `true`, `false`
+
 * `-I`, `--ignore-base-block` — ignore the base block (e.g. if it was encrypted by some ransomware)
+
+  Possible values: `true`, `false`
+
 * `-T`, `--hide-timestamps` — hide timestamps, if output is in reg format
-* `-v`, `--verbose` — More output per occurrence
-* `-q`, `--quiet` — Less output per occurrence
+
+  Possible values: `true`, `false`
+
+* `-v`, `--verbose` — Increase logging verbosity
+* `-q`, `--quiet` — Decrease logging verbosity
 
 
 
diff --git a/doc/ts2date.md b/doc/ts2date.md
index 94bc467..02fb7a3 100644
--- a/doc/ts2date.md
+++ b/doc/ts2date.md
@@ -23,8 +23,8 @@ replaces UNIX timestamps in a stream by a formatted date
 
 ###### **Options:**
 
-* `-v`, `--verbose` — More output per occurrence
-* `-q`, `--quiet` — Less output per occurrence
+* `-v`, `--verbose` — Increase logging verbosity
+* `-q`, `--quiet` — Decrease logging verbosity
 * `-f`, `--from-timezone <SRC_ZONE>` — name of offset of source timezone (or 'list' to display all possible values
 
   Default value: `UTC`
diff --git a/doc/zip2bodyfile.md b/doc/zip2bodyfile.md
index 651470b..eb7107f 100644
--- a/doc/zip2bodyfile.md
+++ b/doc/zip2bodyfile.md
@@ -19,8 +19,11 @@ creates bodyfile from ZIP Archives based on the contained files and folders
 ###### **Options:**
 
 * `--show-archive-name` — show the name of the archive in the bodyfile output
-* `-v`, `--verbose` — More output per occurrence
-* `-q`, `--quiet` — Less output per occurrence
+
+  Possible values: `true`, `false`
+
+* `-v`, `--verbose` — Increase logging verbosity
+* `-q`, `--quiet` — Decrease logging verbosity
 
 
 
diff --git a/src/bin/mactime2/cli.rs b/src/bin/mactime2/cli.rs
index 6f2211f..9beb263 100644
--- a/src/bin/mactime2/cli.rs
+++ b/src/bin/mactime2/cli.rs
@@ -13,17 +13,15 @@ const BODYFILE_HELP: &str =
 #[cfg(not(feature = "gzip"))]
 const BODYFILE_HELP: &str = "path to input file or '-' for stdin";
 
+const AFTER_HELP: &str = color_print::cstr!(r##"<red><bold>IMPORTANT</bold>
+
+Note that POSIX specifies that all UNIX timestamps are UTC timestamps. It is
+up to you to ensure that the bodyfile only contains UNIX timestamps that
+comply with the POSIX standard.</red>"##);
+
 /// Replacement for `mactime`
 #[derive(Parser)]
-#[clap(name="mactime2", author, version, long_about = None, after_help=
-r##"
-╭────────────────────────────────────────────────────────────────────────────╮
-│IMPORTANT:                                                                  │
-│                                                                            │
-│Note that POSIX specifies that all UNIX timestamps are UTC timestamps. It is│
-│up to you to ensure that the bodyfile only contains UNIX timestamps that    │
-│comply with the POSIX standard.                                             │
-╰────────────────────────────────────────────────────────────────────────────╯"##)]
+#[clap(name="mactime2", author, version, long_about = None, after_help=AFTER_HELP)]
 
 pub struct Cli {
     #[clap(short('b'), value_parser, value_hint=ValueHint::FilePath, default_value="-", help=BODYFILE_HELP, display_order(100))]
@@ -38,12 +36,12 @@ pub struct Cli {
     )]
     pub(crate) output_format: Option<OutputFormat>,
 
-    /// output as CSV instead of TXT. This is a conveniance option, which is identical to `--format=csv`
+    /// output as CSV instead of TXT. This is a convenience option, which is identical to `--format=csv`
     /// and will be removed in a future release. If you specified `--format` and `-d`, the latter will be ignored.
     #[clap(short('d'), display_order(610))]
     pub(crate) csv_format: bool,
 
-    /// output as JSON instead of TXT. This is a conveniance option, which is identical to `--format=json`
+    /// output as JSON instead of TXT. This is a convenience option, which is identical to `--format=json`
     /// and will be removed in a future release. If you specified `--format` and `-j`, the latter will be ignored.
     #[clap(short('j'), display_order(620))]
     pub(crate) json_format: bool,
diff --git a/src/common/parse_cli.rs b/src/common/parse_cli.rs
index 97f3241..3ed2faa 100644
--- a/src/common/parse_cli.rs
+++ b/src/common/parse_cli.rs
@@ -40,7 +40,7 @@ where
             .get_matches();
 
         if matches.contains_id("markdown-help") {
-            clap_markdown::print_help_markdown::<P>();
+            clap_markdown_dfir::print_help_markdown::<P>(Default::default());
             exit(0);
         }
     }

From 8ffc2bda4c1efe25d0c44449bcdf6d008d967d8e Mon Sep 17 00:00:00 2001
From: Jan Starke <jan.starke@posteo.de>
Date: Mon, 10 Jun 2024 17:07:47 +0200
Subject: [PATCH 31/35] use lower version number

---
 Cargo.lock | 4 ++--
 Cargo.toml | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 2f3bf7b..6ac07b9 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -803,7 +803,7 @@ dependencies = [
 
 [[package]]
 name = "dfir-toolkit"
-version = "0.11.1"
+version = "0.11.0"
 dependencies = [
  "anyhow",
  "assert-json-diff",
@@ -844,7 +844,7 @@ dependencies = [
  "more-asserts",
  "nt_hive2",
  "num",
- "num-derive 0.4.2",
+ "num-derive 0.3.3",
  "num-traits",
  "ouroboros",
  "phf",
diff --git a/Cargo.toml b/Cargo.toml
index 72caf5c..40886f2 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "dfir-toolkit"
-version = "0.11.1"
+version = "0.11.0"
 edition = "2021"
 authors = ["Jan Starke <jan.starke@posteo.de>", "Deborah Mahn <deborah.mahn@dfir-dd.de>"]
 description = "CLI tools for digital forensics and incident response"

From c286fbd0439b9759d969ef861b61595561704ec0 Mon Sep 17 00:00:00 2001
From: Jan Starke <jan.starke@posteo.de>
Date: Wed, 12 Jun 2024 23:24:45 +0200
Subject: [PATCH 32/35] add old csv format

---
 src/bin/mactime2/application.rs           |   9 +-
 src/bin/mactime2/cli.rs                   |  10 ++
 src/bin/mactime2/output/mod.rs            |   2 +
 src/bin/mactime2/output/old_csv_output.rs | 129 ++++++++++++++++++++++
 4 files changed, 149 insertions(+), 1 deletion(-)
 create mode 100644 src/bin/mactime2/output/old_csv_output.rs

diff --git a/src/bin/mactime2/application.rs b/src/bin/mactime2/application.rs
index e0989e4..2a0f88c 100644
--- a/src/bin/mactime2/application.rs
+++ b/src/bin/mactime2/application.rs
@@ -3,6 +3,8 @@ use clap::ValueEnum;
 use clio::Input;
 use strum_macros::Display;
 
+use crate::output::OldCsvOutput;
+
 use super::bodyfile::{BodyfileDecoder, BodyfileReader, BodyfileSorter};
 use super::cli::Cli;
 use super::error::MactimeError;
@@ -38,6 +40,7 @@ pub (crate) enum OutputFormat {
 
 pub struct Mactime2Application {
     format: OutputFormat,
+    old_csv: bool,
     bodyfile: Input,
     dst_zone: Tz,
     strict_mode: bool,
@@ -59,7 +62,10 @@ impl Mactime2Application {
                 BodyfileSorter::default().with_receiver(decoder.get_receiver(), options);
 
             sorter = sorter.with_output(match self.format {
-                OutputFormat::Csv => Box::new(CsvOutput::new(std::io::stdout(), self.dst_zone)),
+                OutputFormat::Csv => if self.old_csv {
+                    Box::new(OldCsvOutput::new(std::io::stdout(), self.dst_zone))
+                } else {
+                    Box::new(CsvOutput::new(std::io::stdout(), self.dst_zone))}
                 OutputFormat::Txt => Box::new(TxtOutput::new(std::io::stdout(), self.dst_zone)),
                 _ => panic!("invalid execution path"),
             });
@@ -101,6 +107,7 @@ impl From<Cli> for Mactime2Application {
 
         Self {
             format,
+            old_csv: cli.old_csv,
             bodyfile: cli.input_file,
             dst_zone: cli.dst_zone.into_tz().unwrap(),
             strict_mode: cli.strict_mode,
diff --git a/src/bin/mactime2/cli.rs b/src/bin/mactime2/cli.rs
index 9beb263..8c703ff 100644
--- a/src/bin/mactime2/cli.rs
+++ b/src/bin/mactime2/cli.rs
@@ -39,8 +39,18 @@ pub struct Cli {
     /// output as CSV instead of TXT. This is a convenience option, which is identical to `--format=csv`
     /// and will be removed in a future release. If you specified `--format` and `-d`, the latter will be ignored.
     #[clap(short('d'), display_order(610))]
+    #[arg(group="csv")]
     pub(crate) csv_format: bool,
 
+    /// use the old CSV format that was used by legacy mactime.
+    /// 
+    /// Keep in mind that in this format, fields which contain commas will
+    /// not be wrapped by quotes, as RFC4180 requires it. So, this format
+    /// is not RFC4180-compliant, which means that you might not be able
+    /// to use the output together with csv processing tools.
+    #[clap(long("old-csv"), display_order(615))]
+    pub(crate) old_csv: bool,
+
     /// output as JSON instead of TXT. This is a convenience option, which is identical to `--format=json`
     /// and will be removed in a future release. If you specified `--format` and `-j`, the latter will be ignored.
     #[clap(short('j'), display_order(620))]
diff --git a/src/bin/mactime2/output/mod.rs b/src/bin/mactime2/output/mod.rs
index 1296d9b..c6b8115 100644
--- a/src/bin/mactime2/output/mod.rs
+++ b/src/bin/mactime2/output/mod.rs
@@ -1,7 +1,9 @@
 mod csv_output;
+mod old_csv_output;
 mod txt_output;
 mod json_sorter;
 
 pub (crate) use csv_output::*;
+pub (crate) use old_csv_output::*;
 pub (crate) use txt_output::*;
 pub (crate) use json_sorter::*;
\ No newline at end of file
diff --git a/src/bin/mactime2/output/old_csv_output.rs b/src/bin/mactime2/output/old_csv_output.rs
new file mode 100644
index 0000000..ae8d1ec
--- /dev/null
+++ b/src/bin/mactime2/output/old_csv_output.rs
@@ -0,0 +1,129 @@
+use std::io::Write;
+
+use chrono_tz::Tz;
+use dfir_toolkit::common::ForensicsTimestamp;
+
+use crate::bodyfile::{ListEntry, Mactime2Writer};
+
+pub(crate) struct OldCsvOutput<W>
+where
+    W: Write + Send,
+{
+    dst_zone: Tz,
+    writer: W,
+}
+
+impl<W> OldCsvOutput<W>
+where
+    W: Write + Send,
+{
+    pub fn new(writer: W, dst_zone: Tz) -> Self {
+        Self { dst_zone, writer }
+    }
+}
+
+impl<W> Mactime2Writer<W> for OldCsvOutput<W>
+where
+    W: Write + Send,
+{
+    fn write_line(&mut self, timestamp: &i64, entry: &ListEntry) -> std::io::Result<()> {
+        let timestamp = ForensicsTimestamp::from(*timestamp).with_timezone(self.dst_zone);
+        write!(
+            self.writer,
+            "{},{},{},{},{},{},{},\"{}\"",
+            timestamp,
+            entry.line.get_size(),
+            entry.flags,
+            entry.line.get_mode_as_string(),
+            entry.line.get_uid(),
+            entry.line.get_gid(),
+            entry.line.get_inode(),
+            entry.line.get_name()
+        )
+    }
+
+    fn into_writer(self) -> W {
+        self.writer
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::bodyfile::ListEntry;
+    use crate::bodyfile::MACBFlags;
+    use crate::bodyfile::Mactime2Writer;
+
+    use super::OldCsvOutput;
+    use chrono::DateTime;
+    use chrono_tz::Tz;
+    use chrono_tz::TZ_VARIANTS;
+    use dfir_toolkit::common::bodyfile::Bodyfile3Line;
+    use std::io::Cursor;
+    use std::io::{BufRead, BufReader};
+    use std::sync::Arc;
+
+    fn random_tz() -> Tz {
+        let index = rand::random::<usize>() % TZ_VARIANTS.len();
+        TZ_VARIANTS[index]
+    }
+
+    #[allow(non_snake_case)]
+    #[test]
+    fn test_correct_ts_UTC() {
+        for _ in 1..10 {
+            let unix_ts = rand::random::<u32>() as i64;
+            let bf_line = Bodyfile3Line::new().with_crtime(unix_ts.into());
+            let entry = ListEntry {
+                flags: MACBFlags::B,
+                line: Arc::new(bf_line),
+            };
+
+            let mut output = OldCsvOutput::new(Cursor::new(vec![]), Tz::UTC);
+
+            output.write_line(&unix_ts, &entry).unwrap();
+            let mut output = BufReader::new(Cursor::new(output.into_writer().into_inner())).lines();
+            let out_line = output.next().unwrap().unwrap();
+
+            let out_ts = out_line.split(',').next().unwrap();
+            let rfc3339 = DateTime::parse_from_rfc3339(out_ts)
+                .expect(out_ts)
+                .timestamp();
+            assert_eq!(
+                unix_ts, rfc3339,
+                "Timestamp {unix_ts} converted to '{out_ts}' and back to {rfc3339}",
+            );
+        }
+    }
+
+    #[allow(non_snake_case)]
+    #[test]
+    fn test_correct_ts_random_tz() -> Result<(), String> {
+        for _ in 1..100 {
+            let tz = random_tz();
+            let mut output = OldCsvOutput::new(Cursor::new(vec![]), tz);
+
+            let unix_ts = rand::random::<u32>() as i64;
+            let bf_line = Bodyfile3Line::new().with_crtime(unix_ts.into());
+            let entry = ListEntry {
+                flags: MACBFlags::B,
+                line: Arc::new(bf_line),
+            };
+
+            output.write_line(&unix_ts, &entry).unwrap();
+            let mut output = BufReader::new(Cursor::new(output.into_writer().into_inner())).lines();
+            let out_line = output.next().unwrap().unwrap();
+
+            let out_ts = out_line.split(',').next().unwrap();
+            let rfc3339 = match DateTime::parse_from_rfc3339(out_ts) {
+                Ok(ts) => ts,
+                Err(e) => return Err(format!("error while parsing '{}': {}", out_ts, e)),
+            };
+            let calculated_ts = rfc3339.timestamp();
+            assert_eq!(
+                unix_ts, calculated_ts,
+                "Timestamp {unix_ts} converted to '{out_ts}' and back to {calculated_ts}",
+            );
+        }
+        Ok(())
+    }
+}

From 6736b0fcc4eb42adf0b98400c6850dd1f5f206b0 Mon Sep 17 00:00:00 2001
From: Jan Starke <jan.starke@posteo.de>
Date: Wed, 12 Jun 2024 23:28:14 +0200
Subject: [PATCH 33/35] use correct newlines with old csv format

---
 src/bin/mactime2/output/old_csv_output.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/bin/mactime2/output/old_csv_output.rs b/src/bin/mactime2/output/old_csv_output.rs
index ae8d1ec..a2be1aa 100644
--- a/src/bin/mactime2/output/old_csv_output.rs
+++ b/src/bin/mactime2/output/old_csv_output.rs
@@ -28,7 +28,7 @@ where
 {
     fn write_line(&mut self, timestamp: &i64, entry: &ListEntry) -> std::io::Result<()> {
         let timestamp = ForensicsTimestamp::from(*timestamp).with_timezone(self.dst_zone);
-        write!(
+        writeln!(
             self.writer,
             "{},{},{},{},{},{},{},\"{}\"",
             timestamp,

From 9e706562db1c6df1cb49f0cce314c0f8a5b12c7d Mon Sep 17 00:00:00 2001
From: Jan Starke <jan.starke@posteo.de>
Date: Thu, 13 Jun 2024 11:16:29 +0200
Subject: [PATCH 34/35] use format for old-csv

---
 src/bin/mactime2/application.rs | 23 +++++++++++++++++------
 src/bin/mactime2/cli.rs         |  9 ---------
 2 files changed, 17 insertions(+), 15 deletions(-)

diff --git a/src/bin/mactime2/application.rs b/src/bin/mactime2/application.rs
index 2a0f88c..e2ffb8d 100644
--- a/src/bin/mactime2/application.rs
+++ b/src/bin/mactime2/application.rs
@@ -23,24 +23,35 @@ enum InputFormat {
 }
 
 #[derive(ValueEnum, Clone, Display)]
-pub (crate) enum OutputFormat {
+pub(crate) enum OutputFormat {
+    /// Comma-Separated Values compliant to RFC 4180
     #[strum(serialize = "csv")]
     Csv,
 
+    /// legacy text format, inherited from the old mactime
     #[strum(serialize = "txt")]
     Txt,
 
+    /// Javascript Object Notation
     #[strum(serialize = "json")]
     Json,
 
+    /// JSON-format to be used by elasticsearch
     #[cfg(feature = "elastic")]
     #[strum(serialize = "elastic")]
     Elastic,
+
+    /// Use the old CSV format that was used by legacy mactime.
+    /// Keep in mind that in this format, fields which contain commas will
+    /// not be wrapped by quotes, as RFC4180 requires it. So, this format
+    /// is not RFC4180-compliant, which means that you might not be able
+    /// to use the output together with csv processing tools.
+    #[strum(serialize = "old-csv")]
+    OldCsv,
 }
 
 pub struct Mactime2Application {
     format: OutputFormat,
-    old_csv: bool,
     bodyfile: Input,
     dst_zone: Tz,
     strict_mode: bool,
@@ -62,10 +73,11 @@ impl Mactime2Application {
                 BodyfileSorter::default().with_receiver(decoder.get_receiver(), options);
 
             sorter = sorter.with_output(match self.format {
-                OutputFormat::Csv => if self.old_csv {
+                OutputFormat::OldCsv => {
                     Box::new(OldCsvOutput::new(std::io::stdout(), self.dst_zone))
-                } else {
-                    Box::new(CsvOutput::new(std::io::stdout(), self.dst_zone))}
+                }
+
+                OutputFormat::Csv => Box::new(CsvOutput::new(std::io::stdout(), self.dst_zone)),
                 OutputFormat::Txt => Box::new(TxtOutput::new(std::io::stdout(), self.dst_zone)),
                 _ => panic!("invalid execution path"),
             });
@@ -107,7 +119,6 @@ impl From<Cli> for Mactime2Application {
 
         Self {
             format,
-            old_csv: cli.old_csv,
             bodyfile: cli.input_file,
             dst_zone: cli.dst_zone.into_tz().unwrap(),
             strict_mode: cli.strict_mode,
diff --git a/src/bin/mactime2/cli.rs b/src/bin/mactime2/cli.rs
index 8c703ff..faab3df 100644
--- a/src/bin/mactime2/cli.rs
+++ b/src/bin/mactime2/cli.rs
@@ -42,15 +42,6 @@ pub struct Cli {
     #[arg(group="csv")]
     pub(crate) csv_format: bool,
 
-    /// use the old CSV format that was used by legacy mactime.
-    /// 
-    /// Keep in mind that in this format, fields which contain commas will
-    /// not be wrapped by quotes, as RFC4180 requires it. So, this format
-    /// is not RFC4180-compliant, which means that you might not be able
-    /// to use the output together with csv processing tools.
-    #[clap(long("old-csv"), display_order(615))]
-    pub(crate) old_csv: bool,
-
     /// output as JSON instead of TXT. This is a convenience option, which is identical to `--format=json`
     /// and will be removed in a future release. If you specified `--format` and `-j`, the latter will be ignored.
     #[clap(short('j'), display_order(620))]

From 7829d978e6ea94817bdf72c56aa72425a37deb68 Mon Sep 17 00:00:00 2001
From: Jan Starke <jan.starke@posteo.de>
Date: Thu, 13 Jun 2024 11:25:02 +0200
Subject: [PATCH 35/35] use shorter comment for old-csv

---
 src/bin/mactime2/application.rs | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/src/bin/mactime2/application.rs b/src/bin/mactime2/application.rs
index e2ffb8d..8fb6cb2 100644
--- a/src/bin/mactime2/application.rs
+++ b/src/bin/mactime2/application.rs
@@ -41,11 +41,7 @@ pub(crate) enum OutputFormat {
     #[strum(serialize = "elastic")]
     Elastic,
 
-    /// Use the old CSV format that was used by legacy mactime.
-    /// Keep in mind that in this format, fields which contain commas will
-    /// not be wrapped by quotes, as RFC4180 requires it. So, this format
-    /// is not RFC4180-compliant, which means that you might not be able
-    /// to use the output together with csv processing tools.
+    /// Use the old (non RFC compliant) CSV format that was used by legacy mactime.
     #[strum(serialize = "old-csv")]
     OldCsv,
 }