From 04d295f65a19c1919cc39811f8ae224c09c140fd Mon Sep 17 00:00:00 2001
From: apriestman <apriestman@basistech.com>
Date: Tue, 25 May 2021 10:43:35 -0400
Subject: [PATCH] Use allocated versions of cache files when available

---
 .../recentactivity/ChromeCacheExtractor.java  | 50 ++++++++++++++++---
 1 file changed, 43 insertions(+), 7 deletions(-)

diff --git a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ChromeCacheExtractor.java b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ChromeCacheExtractor.java
index 5dfb81431b..9435161a23 100644
--- a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ChromeCacheExtractor.java
+++ b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ChromeCacheExtractor.java
@@ -33,6 +33,8 @@ import java.nio.file.Paths;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Collection;
+import java.util.Collections;
+import java.util.Comparator;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
@@ -565,8 +567,13 @@ final class ChromeCacheExtractor {
         
         List<AbstractFile> effFiles = fileManager.findFiles(dataSource, "f_%", cachePath); //NON-NLS 
         for (AbstractFile abstractFile : effFiles ) {
+            String cacheKey = cachePath + abstractFile.getName();
             if (cachePath.equals(abstractFile.getParentPath()) && abstractFile.isFile()) {
-                this.externalFilesTable.put(cachePath + abstractFile.getName(), abstractFile);
+                // Don't overwrite an allocated version with an unallocated version
+                if (abstractFile.isMetaFlagSet(TskData.TSK_FS_META_FLAG_ENUM.ALLOC)
+                        || !externalFilesTable.containsKey(cacheKey)) {
+                    this.externalFilesTable.put(cacheKey, abstractFile);
+                }
             }
         }
     }
@@ -590,20 +597,49 @@ final class ChromeCacheExtractor {
             return Optional.of(fileCopyCache.get(fileTableKey).getAbstractFile());
         }
         
-        
         List<AbstractFile> cacheFiles = fileManager.findFiles(dataSource, cacheFileName, cacheFolderName); //NON-NLS
         if (!cacheFiles.isEmpty()) {
-            for (AbstractFile abstractFile: cacheFiles ) {
-                if (abstractFile.getUniquePath().trim().endsWith(DEFAULT_CACHE_PATH_STR)) {
-                    return Optional.of(abstractFile);
+            // Sort the list for consistency. Preference is:
+            // - In correct subfolder and allocated
+            // - In correct subfolder and unallocated
+            // - In incorrect subfolder and allocated
+            Collections.sort(cacheFiles, new Comparator<AbstractFile>() {
+                @Override
+                public int compare(AbstractFile file1, AbstractFile file2) {
+                    try {
+                        if (file1.getUniquePath().trim().endsWith(DEFAULT_CACHE_PATH_STR)
+                                && ! file2.getUniquePath().trim().endsWith(DEFAULT_CACHE_PATH_STR)) {
+                            return -1;
+                        }
+                        
+                        if (file2.getUniquePath().trim().endsWith(DEFAULT_CACHE_PATH_STR)
+                                && ! file1.getUniquePath().trim().endsWith(DEFAULT_CACHE_PATH_STR)) {
+                            return 1;
+                        }
+                    } catch (TskCoreException ex) {
+                        logger.log(Level.WARNING, "Error getting unique path for file with ID " + file1.getId() + " or " + file2.getId(), ex);
+                    }
+                        
+                    if (file1.isMetaFlagSet(TskData.TSK_FS_META_FLAG_ENUM.ALLOC)
+                            && ! file2.isMetaFlagSet(TskData.TSK_FS_META_FLAG_ENUM.ALLOC)) {
+                        return -1;
+                    }
+                    if (file2.isMetaFlagSet(TskData.TSK_FS_META_FLAG_ENUM.ALLOC)
+                            && ! file1.isMetaFlagSet(TskData.TSK_FS_META_FLAG_ENUM.ALLOC)) {
+                        return 1;
+                    }
+
+                    return Long.compare(file1.getId(), file2.getId());
                 }
-            }
+            });
+            
+            // The best match will be the first element
             return Optional.of(cacheFiles.get(0));
         }
         
         return Optional.empty(); 
     }
-    
+   
      /**
      * Finds the "index" file that exists in each user's cache.  This is used to 
      * enumerate all of the caches on the system.