From fc0f277dce18b3fc6d94e5ce5a3eab38594d009f Mon Sep 17 00:00:00 2001 From: Kelly Kelly Date: Wed, 19 Aug 2020 13:27:55 -0400 Subject: [PATCH 1/2] Inital changes improving performance of managing wal files --- .../casemodule/services/FileManager.java | 18 ++++++++++++++++++ .../autopsy/coreutils/AppSQLiteDB.java | 13 ++++++++----- .../autopsy/coreutils/SQLiteTableReader.java | 9 ++++++--- 3 files changed, 32 insertions(+), 8 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/casemodule/services/FileManager.java b/Core/src/org/sleuthkit/autopsy/casemodule/services/FileManager.java index 36d88b8413..ece1c00736 100644 --- a/Core/src/org/sleuthkit/autopsy/casemodule/services/FileManager.java +++ b/Core/src/org/sleuthkit/autopsy/casemodule/services/FileManager.java @@ -126,6 +126,24 @@ public class FileManager implements Closeable { } return caseDb.findAllFilesWhere("data_source_obj_id = " + dataSource.getId() + " AND " + createFileTypeInCondition(mimeTypes)); } + + /** + * Find all files with the exact given name and parentId. + * + * @param parentId Id of the parent folder to search. + * @param name Exact file name to match. + * + * @return A list of matching files. + * + * @throws TskCoreException + */ + public synchronized List findFilesExactName(long parentId, String name) throws TskCoreException{ + if (null == caseDb) { + throw new TskCoreException("File manager has been closed"); + } + String whereClause = "name = '%s'"; + return caseDb.findAllFilesInFolderWhere(parentId, String.format(whereClause, name)); + } /** * Converts a list of MIME types into an SQL "mime_type IN" condition. diff --git a/Core/src/org/sleuthkit/autopsy/coreutils/AppSQLiteDB.java b/Core/src/org/sleuthkit/autopsy/coreutils/AppSQLiteDB.java index f75618b59b..f91e35c959 100644 --- a/Core/src/org/sleuthkit/autopsy/coreutils/AppSQLiteDB.java +++ b/Core/src/org/sleuthkit/autopsy/coreutils/AppSQLiteDB.java @@ -1,7 +1,7 @@ /* * Autopsy Forensic Browser * - * Copyright 2019 Basis Technology Corp. + * Copyright 2019-2020 Basis Technology Corp. * Contact: carrier sleuthkit org * * Licensed under the Apache License, Version 2.0 (the "License"); @@ -390,14 +390,17 @@ public final class AppSQLiteDB { private static void findAndCopySQLiteMetaFile(AbstractFile sqliteFile, String metaFileName) throws NoCurrentCaseException, TskCoreException, IOException { + // Do not look for metaFile if this is a carved directory + if(sqliteFile.getParentPath().contains("carvedfiles")) { + return; + } + Case openCase = Case.getCurrentCaseThrows(); SleuthkitCase sleuthkitCase = openCase.getSleuthkitCase(); Services services = new Services(sleuthkitCase); FileManager fileManager = services.getFileManager(); - - List metaFiles = fileManager.findFiles( - sqliteFile.getDataSource(), metaFileName, - sqliteFile.getParent().getName()); + + List metaFiles = fileManager.findFilesExactName(sqliteFile.getParent().getId(), metaFileName); if (metaFiles != null) { for (AbstractFile metaFile : metaFiles) { diff --git a/Core/src/org/sleuthkit/autopsy/coreutils/SQLiteTableReader.java b/Core/src/org/sleuthkit/autopsy/coreutils/SQLiteTableReader.java index 59940d9e4c..6c823b9553 100755 --- a/Core/src/org/sleuthkit/autopsy/coreutils/SQLiteTableReader.java +++ b/Core/src/org/sleuthkit/autopsy/coreutils/SQLiteTableReader.java @@ -425,15 +425,18 @@ public class SQLiteTableReader implements AutoCloseable { */ private void findAndCopySQLiteMetaFile(AbstractFile sqliteFile, String metaFileName) throws NoCurrentCaseException, TskCoreException, IOException { + + // Do not look for metaFile if this is a carved directory + if(sqliteFile.getParentPath().contains("carvedfiles")) { + return; + } Case openCase = Case.getCurrentCaseThrows(); SleuthkitCase sleuthkitCase = openCase.getSleuthkitCase(); Services services = new Services(sleuthkitCase); FileManager fileManager = services.getFileManager(); - List metaFiles = fileManager.findFiles( - sqliteFile.getDataSource(), metaFileName, - sqliteFile.getParent().getName()); + List metaFiles = fileManager.findFilesExactName(sqliteFile.getParent().getId(), metaFileName); if (metaFiles != null) { for (AbstractFile metaFile : metaFiles) { From eb2c68616f296c7f02fb1af0daa84a1305427d9b Mon Sep 17 00:00:00 2001 From: Kelly Kelly Date: Thu, 20 Aug 2020 10:23:02 -0400 Subject: [PATCH 2/2] Changed path check per Brian's request --- Core/src/org/sleuthkit/autopsy/coreutils/AppSQLiteDB.java | 2 +- Core/src/org/sleuthkit/autopsy/coreutils/SQLiteTableReader.java | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/coreutils/AppSQLiteDB.java b/Core/src/org/sleuthkit/autopsy/coreutils/AppSQLiteDB.java index f91e35c959..28f9516350 100644 --- a/Core/src/org/sleuthkit/autopsy/coreutils/AppSQLiteDB.java +++ b/Core/src/org/sleuthkit/autopsy/coreutils/AppSQLiteDB.java @@ -391,7 +391,7 @@ public final class AppSQLiteDB { String metaFileName) throws NoCurrentCaseException, TskCoreException, IOException { // Do not look for metaFile if this is a carved directory - if(sqliteFile.getParentPath().contains("carvedfiles")) { + if(sqliteFile.getParentPath().equalsIgnoreCase("/$carvedfiles/")) { return; } diff --git a/Core/src/org/sleuthkit/autopsy/coreutils/SQLiteTableReader.java b/Core/src/org/sleuthkit/autopsy/coreutils/SQLiteTableReader.java index 6c823b9553..0c3b0c65c5 100755 --- a/Core/src/org/sleuthkit/autopsy/coreutils/SQLiteTableReader.java +++ b/Core/src/org/sleuthkit/autopsy/coreutils/SQLiteTableReader.java @@ -427,7 +427,7 @@ public class SQLiteTableReader implements AutoCloseable { String metaFileName) throws NoCurrentCaseException, TskCoreException, IOException { // Do not look for metaFile if this is a carved directory - if(sqliteFile.getParentPath().contains("carvedfiles")) { + if(sqliteFile.getParentPath().equalsIgnoreCase("/$carvedfiles/")) { return; }