From 1a92b342eadce932380f1872ea489242c7a18fa0 Mon Sep 17 00:00:00 2001
From: Mark McKinnon <mark.mckinnon@davenport.edu>
Date: Tue, 6 Mar 2018 06:19:00 -0800
Subject: [PATCH] Fix plugin ps*

Fix System file in ps* plugin output
---
 .../VolatilityProcessor.java                     | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/Core/src/org/sleuthkit/autopsy/datasourceprocessors/VolatilityProcessor.java b/Core/src/org/sleuthkit/autopsy/datasourceprocessors/VolatilityProcessor.java
index bde01b8183..3028491c26 100644
--- a/Core/src/org/sleuthkit/autopsy/datasourceprocessors/VolatilityProcessor.java
+++ b/Core/src/org/sleuthkit/autopsy/datasourceprocessors/VolatilityProcessor.java
@@ -512,7 +512,9 @@ class VolatilityProcessor implements Runnable{
              while ((line = br.readLine()) != null) {
                 String file_path;
                 file_path = line.substring(19, 37);
-                fileSet.add(file_path.toLowerCase());
+                if (!file_path.startsWith("System")) {
+                   fileSet.add(file_path.toLowerCase());
+                }
              }    
              br.close();
         } catch (IOException ex) { 
@@ -530,7 +532,9 @@ class VolatilityProcessor implements Runnable{
              while ((line = br.readLine()) != null) {
                 String file_path;
                 file_path = line.substring(19, 41);
-                fileSet.add(file_path.toLowerCase());
+                if (!file_path.startsWith("System")) {
+                   fileSet.add(file_path.toLowerCase());
+                }
              }    
              br.close();
         } catch (IOException ex) { 
@@ -548,7 +552,9 @@ class VolatilityProcessor implements Runnable{
              while ((line = br.readLine()) != null) {
                 String file_path;
                 file_path = line.substring(19, 41);
-                fileSet.add(file_path.toLowerCase());
+                if (!file_path.startsWith("System")) {
+                   fileSet.add(file_path.toLowerCase());
+                }
              }    
              br.close();
         } catch (IOException ex) { 
@@ -568,7 +574,9 @@ class VolatilityProcessor implements Runnable{
                 String TAG = ":";
                 if (line.contains(TAG)) {
                     file_path = line.substring(line.indexOf(":") + 1, 52);
-                    fileSet.add(file_path.toLowerCase());
+                    if (!file_path.startsWith("System")) {
+                       fileSet.add(file_path.toLowerCase());
+                    }
                 }
              }    
              br.close();