Parsers should filter out events that appear to have occurred at relevant epoch(s)?

[ghost]

1.5 RC1 GIFT PPA Ubuntu 14.04 LTS 64 bit

Evidence image: http://www.lancemueller.com/blog/evidence/WinXP2.E01

log2timeline with default options && psort.py -w output.txt results.plaso

winreg/appcompatcache generates events on date 1601-01-01

winreg/windows_version and msiecf generate events on date 1970-01-01

These parsers appear to be misinterpreting missing/null timestamps and converting them to dates that match the relevant epochs. It is unlikely that the activity occurred on those dates - such results could be used to cast doubt on accuracy of parsing.

[joachimmetz]

This is a known issue. We are planning to address this by: #910.

Closing this issue.