mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-13 08:26:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

Don't copy path ID for invalid IDs

Browse Source
This commit is contained in:
apriestman 2020-12-30 10:08:04 -05:00
parent 04617be416
commit 38d86697bc
1 changed files with 9 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
Core/src/org/sleuthkit/autopsy/report/modules/portablecase/PortableCaseReportModule.java
View File

@ -897,7 +897,7 @@ public class PortableCaseReportModule implements ReportModule {
copyAttachments(newArtifact, tag.getArtifact(), portableSkCase.getAbstractFileById(newContentId)); copyAttachments(newArtifact, tag.getArtifact(), portableSkCase.getAbstractFileById(newContentId));
// Copy any files associated with this artifact through the TSK_PATH_ID attribute // Copy any files associated with this artifact through the TSK_PATH_ID attribute
copyPathID(newArtifact, tag.getArtifact(), portableSkCase.getAbstractFileById(newContentId)); copyPathID(newArtifact, tag.getArtifact());
// Tag the artfiact // Tag the artfiact
if (!oldTagNameToNewTagName.containsKey(tag.getName())) { if (!oldTagNameToNewTagName.containsKey(tag.getName())) {
@ -1163,20 +1163,21 @@ public class PortableCaseReportModule implements ReportModule {
* *
* @param newArtifact The new artifact in the portable case. Should not have a TSK_PATH_ID attribute. * @param newArtifact The new artifact in the portable case. Should not have a TSK_PATH_ID attribute.
* @param oldArtifact The old artifact. * @param oldArtifact The old artifact.
* @param newFile The new file in the portable case associated with the artifact.
* *
* @throws TskCoreException * @throws TskCoreException
*/ */
private void copyPathID(BlackboardArtifact newArtifact, BlackboardArtifact oldArtifact, AbstractFile newFile) throws TskCoreException { private void copyPathID(BlackboardArtifact newArtifact, BlackboardArtifact oldArtifact) throws TskCoreException {
// Get the path ID attribute // Get the path ID attribute
BlackboardAttribute oldPathIdAttr = oldArtifact.getAttribute(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH_ID)); BlackboardAttribute oldPathIdAttr = oldArtifact.getAttribute(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH_ID));
if (oldPathIdAttr != null) { if (oldPathIdAttr != null) {
// Copy the file and remake the attribute // Copy the file and remake the attribute if the path ID is valid
long oldContentId = oldPathIdAttr.getValueLong(); long oldContentId = oldPathIdAttr.getValueLong();
Content oldContent = currentCase.getSleuthkitCase().getContentById(oldContentId); if (oldContentId > 0) {
long newContentId = copyContent(oldContent); Content oldContent = currentCase.getSleuthkitCase().getContentById(oldContentId);
newArtifact.addAttribute(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH_ID, long newContentId = copyContent(oldContent);
String.join(",", oldPathIdAttr.getSources()), newContentId)); newArtifact.addAttribute(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH_ID,
String.join(",", oldPathIdAttr.getSources()), newContentId));
}
} }
} }