Preserve supported UTC timestamp parsing in recovery history

This commit is contained in:
Shirofune-Security committed 2026-09-21 18:15:45 +09:00
1 parent 3ee0d7b6bd
commit 6c6edc7a68
1 file changed
+1 -1
+1 -1
View File
@@ -52,7 +52,7 @@ function Get-WelaEventRecoveryDefinition {
Assert-WelaEventRecoveryText $fresh @('Phase')
if($initial.PSObject.Properties['Phase'] -or $fresh.Phase -cne 'ImmediatePreWrite' -or $row.Status -cne 'Applied' -or $row.Kind -cne 'EventLog' -or $row.Id -cne $id){throw 'Only completed Applied profile writes with ordered immediate-prewrite evidence are supported.'}
foreach($entry in $matching){
Assert-WelaEventRecoveryText $entry @('ComputerName','Kind','Id','RecordedUtc')
Assert-WelaEventRecoveryText $entry @('ComputerName','Kind','Id')
if(($entry.Version -isnot [int] -and $entry.Version -isnot [long]) -or $entry.Version -ne 1 -or $entry.ComputerName -ine $context.Host.Computer -or $entry.Kind -cne 'EventLog' -or $entry.Id -cne $id){throw 'Unknown or wrong-host event-log journal.'}
$time=ConvertTo-WelaArrivalUtc $entry.RecordedUtc;if($time -gt [DateTimeOffset]::UtcNow.AddMinutes(1)){throw 'Future journal timestamp.'}
}