From 6c6edc7a6894a19273a70d6b76933676efc565ee Mon Sep 17 00:00:00 2001
From: Shirofune-Security
 <43838376+Shirofune-Security@users.noreply.github.com>
Date: Mon, 21 Sep 2026 18:15:45 +0900
Subject: [PATCH] Preserve supported UTC timestamp parsing in recovery history

---
 scripts/EventLogRecovery.ps1 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/EventLogRecovery.ps1 b/scripts/EventLogRecovery.ps1
index e42424e1..36e8bd5a 100644
--- a/scripts/EventLogRecovery.ps1
+++ b/scripts/EventLogRecovery.ps1
@@ -52,7 +52,7 @@ function Get-WelaEventRecoveryDefinition {
     Assert-WelaEventRecoveryText $fresh @('Phase')
     if($initial.PSObject.Properties['Phase'] -or $fresh.Phase -cne 'ImmediatePreWrite' -or $row.Status -cne 'Applied' -or $row.Kind -cne 'EventLog' -or $row.Id -cne $id){throw 'Only completed Applied profile writes with ordered immediate-prewrite evidence are supported.'}
     foreach($entry in $matching){
-        Assert-WelaEventRecoveryText $entry @('ComputerName','Kind','Id','RecordedUtc')
+        Assert-WelaEventRecoveryText $entry @('ComputerName','Kind','Id')
         if(($entry.Version -isnot [int] -and $entry.Version -isnot [long]) -or $entry.Version -ne 1 -or $entry.ComputerName -ine $context.Host.Computer -or $entry.Kind -cne 'EventLog' -or $entry.Id -cne $id){throw 'Unknown or wrong-host event-log journal.'}
         $time=ConvertTo-WelaArrivalUtc $entry.RecordedUtc;if($time -gt [DateTimeOffset]::UtcNow.AddMinutes(1)){throw 'Future journal timestamp.'}
     }