diff --git a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ChromeCacheExtractor.java b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ChromeCacheExtractor.java index d4b731259d..042ea7f1d2 100644 --- a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ChromeCacheExtractor.java +++ b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ChromeCacheExtractor.java @@ -377,40 +377,40 @@ final class ChromeCacheExtractor { // Get the cache entry and its data segments CacheEntry cacheEntry = new CacheEntry(cacheEntryAddress, cacheEntryFile.get() ); + List dataEntries = cacheEntry.getData(); - - BlackboardAttribute urlAttr = new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL, - moduleName, - ((cacheEntry.getKey() != null) ? cacheEntry.getKey() : "")); - - BlackboardAttribute createTimeAttr = new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_CREATED, - moduleName, - cacheEntry.getCreationTime()); - - BlackboardAttribute hhtpHeaderAttr = new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_HEADERS, - moduleName, - cacheEntry.getHTTPHeaders()); - - // Only process the first payload data segment in each entry // first data segement has the HTTP headers, 2nd is the payload + if (dataEntries.size() < 2) { + return derivedFiles; + } CacheData dataSegment = dataEntries.get(1); - + + // name of the file that was downloaded and cached (or data_X if it was saved into there) String cachedFileName = dataSegment.getAddress().getFilename(); Optional cachedFileAbstractFile = this.findCacheFile(cachedFileName, cachePath); if (!cachedFileAbstractFile.isPresent()) { logger.log(Level.SEVERE, "Error finding file: " + cachePath + "/" + cachedFileName); //NON-NLS return derivedFiles; - } - - + } boolean isBrotliCompressed = false; if (dataSegment.getType() != CacheDataTypeEnum.HTTP_HEADER && cacheEntry.isBrotliCompressed() ) { isBrotliCompressed = true; } + // setup some attributes for later use + BlackboardAttribute urlAttr = new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL, + moduleName, + ((cacheEntry.getKey() != null) ? cacheEntry.getKey() : "")); + BlackboardAttribute createTimeAttr = new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_CREATED, + moduleName, + cacheEntry.getCreationTime()); + BlackboardAttribute httpHeaderAttr = new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_HEADERS, + moduleName, + cacheEntry.getHTTPHeaders()); + Collection sourceArtifactAttributes = new ArrayList<>(); sourceArtifactAttributes.add(urlAttr); sourceArtifactAttributes.add(createTimeAttr); @@ -418,10 +418,9 @@ final class ChromeCacheExtractor { Collection webCacheAttributes = new ArrayList<>(); webCacheAttributes.add(urlAttr); webCacheAttributes.add(createTimeAttr); - webCacheAttributes.add(hhtpHeaderAttr); + webCacheAttributes.add(httpHeaderAttr); - // add artifacts to the f_XXX file if (dataSegment.isInExternalFile() ) { try {