[parser] crashlogs: extract timezone from image

[cvandeplas]

The case (metadata) needs to know the timezone of the phone.
Some filenames contain a timestamp, in the case of crashlogs it's local time. So to parse the date properly we need to know the phone timezone.

[cvandeplas]

Annoyingly, if we find a place where the current timezone is configured at sysdiagnose creation time, it might still be different than for example the crashlog timestamp.
Why? The owner of the phone might have been travelling at a certain point in time, and be in a different timezone.

However extracting the latest known timezone would definitely help to better estimate reality

[cvandeplas]

powerlogs contain(some) info about timezone

[adulau]

Launch Time: of the crash the TZ is not set ?

[cvandeplas]

The summaries/crashes_and_spins.log file contains a list of crashlog files that were present on the phone, but may not be included in the sysdiagnose tar.gz because they are too old.
The timestamp of the crashlog filename seems to be based on local time.

However, the crashlog itself (ips file) contain a timestamp with timezone.
So we're currently able to capture the exact time for all these IPS files, but need to do lookup-magic if we want to discover the timezone of the older crashes from which we do not have the IPS files in the sysdiagnose archive.

[dario-br]

What about the filename of the sysdiagnose file itself? It contains the the timestamp in iso format, where you can see the time deviation from UTC. Would that work?

[cvandeplas]

For now we extract the time and timezone from the sysdiagnose.log file, this is captured in the this.sysdiagnose_creation_datetime variable. However, as explained, this is the timezone at time of sysdiagnose creation, which is not necessarily the same as the timezone when the crash occurred.