Preserve metadata for multi timestamp records

flow/record/base.py

@@ -1124,6 +1124,11 @@ def iter_timestamped_records(record: Record) -> Iterator[Record]:
     record_name = record._desc.name
     for field in dt_fields:
         ts_record = TimestampRecord(getattr(record, field.name), field.name)
+        # Preserve metadata from the original record so it isn't shadowed by
+        # the freshly-created TimestampRecord's None defaults in ChainMap.
+        ts_record._source = record._source
+        ts_record._classification = record._classification
+        ts_record._generated = record._generated
         # we extend ``ts_record`` with original ``record`` so TSRecord info goes first.
-        record = extend_record(ts_record, [record], name=record_name)
-        yield record
+        result = extend_record(ts_record, [record], name=record_name)
+        yield result

tests/record/test_multi_timestamp.py

@@ -147,5 +147,32 @@ def test_multi_timestamp_descriptor_cache() -> None:
             assert record.ts == getattr(test_record, tsfield)
 
     cache_info = merge_record_descriptors.cache_info()
-    assert cache_info.misses == 2
-    assert cache_info.hits == 18
+    assert cache_info.misses == 1
+    assert cache_info.hits == 19
+
+
+def test_multi_timestamp_preserves_metadata() -> None:
+    TestRecord = RecordDescriptor(
+        "test/record",
+        [
+            ("datetime", "ctime"),
+            ("datetime", "atime"),
+            ("string", "data"),
+        ],
+    )
+
+    test_record = TestRecord(
+        ctime=datetime(2020, 1, 1, 1, 1, 1),  # noqa: DTZ001
+        atime=datetime(2022, 11, 22, 13, 37, 37),  # noqa: DTZ001
+        data="test",
+    )
+    test_record._source = "/evidence/disk.E01"
+    test_record._classification = "SECRET"
+
+    ts_records = list(iter_timestamped_records(test_record))
+    assert len(ts_records) == 2
+
+    for rec in ts_records:
+        assert rec._source == "/evidence/disk.E01"
+        assert rec._classification == "SECRET"
+        assert rec._generated == test_record._generated