diff --git a/Core/src/org/sleuthkit/autopsy/casemodule/services/FileManager.java b/Core/src/org/sleuthkit/autopsy/casemodule/services/FileManager.java index 36d88b8413..ece1c00736 100644 --- a/Core/src/org/sleuthkit/autopsy/casemodule/services/FileManager.java +++ b/Core/src/org/sleuthkit/autopsy/casemodule/services/FileManager.java @@ -126,6 +126,24 @@ public class FileManager implements Closeable { } return caseDb.findAllFilesWhere("data_source_obj_id = " + dataSource.getId() + " AND " + createFileTypeInCondition(mimeTypes)); } + + /** + * Find all files with the exact given name and parentId. + * + * @param parentId Id of the parent folder to search. + * @param name Exact file name to match. + * + * @return A list of matching files. + * + * @throws TskCoreException + */ + public synchronized List findFilesExactName(long parentId, String name) throws TskCoreException{ + if (null == caseDb) { + throw new TskCoreException("File manager has been closed"); + } + String whereClause = "name = '%s'"; + return caseDb.findAllFilesInFolderWhere(parentId, String.format(whereClause, name)); + } /** * Converts a list of MIME types into an SQL "mime_type IN" condition. diff --git a/Core/src/org/sleuthkit/autopsy/coreutils/AppSQLiteDB.java b/Core/src/org/sleuthkit/autopsy/coreutils/AppSQLiteDB.java index f75618b59b..28f9516350 100644 --- a/Core/src/org/sleuthkit/autopsy/coreutils/AppSQLiteDB.java +++ b/Core/src/org/sleuthkit/autopsy/coreutils/AppSQLiteDB.java @@ -1,7 +1,7 @@ /* * Autopsy Forensic Browser * - * Copyright 2019 Basis Technology Corp. + * Copyright 2019-2020 Basis Technology Corp. * Contact: carrier sleuthkit org * * Licensed under the Apache License, Version 2.0 (the "License"); @@ -390,14 +390,17 @@ public final class AppSQLiteDB { private static void findAndCopySQLiteMetaFile(AbstractFile sqliteFile, String metaFileName) throws NoCurrentCaseException, TskCoreException, IOException { + // Do not look for metaFile if this is a carved directory + if(sqliteFile.getParentPath().equalsIgnoreCase("/$carvedfiles/")) { + return; + } + Case openCase = Case.getCurrentCaseThrows(); SleuthkitCase sleuthkitCase = openCase.getSleuthkitCase(); Services services = new Services(sleuthkitCase); FileManager fileManager = services.getFileManager(); - - List metaFiles = fileManager.findFiles( - sqliteFile.getDataSource(), metaFileName, - sqliteFile.getParent().getName()); + + List metaFiles = fileManager.findFilesExactName(sqliteFile.getParent().getId(), metaFileName); if (metaFiles != null) { for (AbstractFile metaFile : metaFiles) { diff --git a/Core/src/org/sleuthkit/autopsy/coreutils/SQLiteTableReader.java b/Core/src/org/sleuthkit/autopsy/coreutils/SQLiteTableReader.java index 59940d9e4c..0c3b0c65c5 100755 --- a/Core/src/org/sleuthkit/autopsy/coreutils/SQLiteTableReader.java +++ b/Core/src/org/sleuthkit/autopsy/coreutils/SQLiteTableReader.java @@ -425,15 +425,18 @@ public class SQLiteTableReader implements AutoCloseable { */ private void findAndCopySQLiteMetaFile(AbstractFile sqliteFile, String metaFileName) throws NoCurrentCaseException, TskCoreException, IOException { + + // Do not look for metaFile if this is a carved directory + if(sqliteFile.getParentPath().equalsIgnoreCase("/$carvedfiles/")) { + return; + } Case openCase = Case.getCurrentCaseThrows(); SleuthkitCase sleuthkitCase = openCase.getSleuthkitCase(); Services services = new Services(sleuthkitCase); FileManager fileManager = services.getFileManager(); - List metaFiles = fileManager.findFiles( - sqliteFile.getDataSource(), metaFileName, - sqliteFile.getParent().getName()); + List metaFiles = fileManager.findFilesExactName(sqliteFile.getParent().getId(), metaFileName); if (metaFiles != null) { for (AbstractFile metaFile : metaFiles) {