diff --git a/flow/record/base.py b/flow/record/base.py index 0d10f71..8c127d2 100644 --- a/flow/record/base.py +++ b/flow/record/base.py @@ -1124,6 +1124,11 @@ def iter_timestamped_records(record: Record) -> Iterator[Record]: record_name = record._desc.name for field in dt_fields: ts_record = TimestampRecord(getattr(record, field.name), field.name) + # Preserve metadata from the original record so it isn't shadowed by + # the freshly-created TimestampRecord's None defaults in ChainMap. + ts_record._source = record._source + ts_record._classification = record._classification + ts_record._generated = record._generated # we extend ``ts_record`` with original ``record`` so TSRecord info goes first. - record = extend_record(ts_record, [record], name=record_name) - yield record + result = extend_record(ts_record, [record], name=record_name) + yield result diff --git a/tests/record/test_multi_timestamp.py b/tests/record/test_multi_timestamp.py index 3d010c4..1db0132 100644 --- a/tests/record/test_multi_timestamp.py +++ b/tests/record/test_multi_timestamp.py @@ -147,5 +147,32 @@ def test_multi_timestamp_descriptor_cache() -> None: assert record.ts == getattr(test_record, tsfield) cache_info = merge_record_descriptors.cache_info() - assert cache_info.misses == 2 - assert cache_info.hits == 18 + assert cache_info.misses == 1 + assert cache_info.hits == 19 + + +def test_multi_timestamp_preserves_metadata() -> None: + TestRecord = RecordDescriptor( + "test/record", + [ + ("datetime", "ctime"), + ("datetime", "atime"), + ("string", "data"), + ], + ) + + test_record = TestRecord( + ctime=datetime(2020, 1, 1, 1, 1, 1), # noqa: DTZ001 + atime=datetime(2022, 11, 22, 13, 37, 37), # noqa: DTZ001 + data="test", + ) + test_record._source = "/evidence/disk.E01" + test_record._classification = "SECRET" + + ts_records = list(iter_timestamped_records(test_record)) + assert len(ts_records) == 2 + + for rec in ts_records: + assert rec._source == "/evidence/disk.E01" + assert rec._classification == "SECRET" + assert rec._generated == test_record._generated