mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-13 00:16:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

Don't copy path ID for invalid IDs

Browse Source
This commit is contained in:
apriestman 2020-12-30 10:08:04 -05:00
parent 04617be416
commit 38d86697bc
1 changed files with 9 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
Core/src/org/sleuthkit/autopsy/report/modules/portablecase/PortableCaseReportModule.java
View File

@ -897,7 +897,7 @@ public class PortableCaseReportModule implements ReportModule {
copyAttachments(newArtifact, tag.getArtifact(), portableSkCase.getAbstractFileById(newContentId));
// Copy any files associated with this artifact through the TSK_PATH_ID attribute
copyPathID(newArtifact, tag.getArtifact(), portableSkCase.getAbstractFileById(newContentId));
copyPathID(newArtifact, tag.getArtifact());
// Tag the artfiact
if (!oldTagNameToNewTagName.containsKey(tag.getName())) {
@ -1163,20 +1163,21 @@ public class PortableCaseReportModule implements ReportModule {
*
* @param newArtifact The new artifact in the portable case. Should not have a TSK_PATH_ID attribute.
* @param oldArtifact The old artifact.
* @param newFile The new file in the portable case associated with the artifact.
*
* @throws TskCoreException
*/
private void copyPathID(BlackboardArtifact newArtifact, BlackboardArtifact oldArtifact, AbstractFile newFile) throws TskCoreException {
private void copyPathID(BlackboardArtifact newArtifact, BlackboardArtifact oldArtifact) throws TskCoreException {
// Get the path ID attribute
BlackboardAttribute oldPathIdAttr = oldArtifact.getAttribute(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH_ID));
if (oldPathIdAttr != null) {
// Copy the file and remake the attribute
// Copy the file and remake the attribute if the path ID is valid
long oldContentId = oldPathIdAttr.getValueLong();
Content oldContent = currentCase.getSleuthkitCase().getContentById(oldContentId);
long newContentId = copyContent(oldContent);
newArtifact.addAttribute(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH_ID,
String.join(",", oldPathIdAttr.getSources()), newContentId));
if (oldContentId > 0) {
Content oldContent = currentCase.getSleuthkitCase().getContentById(oldContentId);
long newContentId = copyContent(oldContent);
newArtifact.addAttribute(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH_ID,
String.join(",", oldPathIdAttr.getSources()), newContentId));
}
}
}