Merge pull request #6193 from kellykelly3/6722-make-search-for-wal-more-efficient

6722- wal file search performance improvement

Core/src/org/sleuthkit/autopsy/casemodule/services/FileManager.java

@@ -126,6 +126,24 @@ public class FileManager implements Closeable {
         }
         return caseDb.findAllFilesWhere("data_source_obj_id = " + dataSource.getId() + " AND " + createFileTypeInCondition(mimeTypes));
     }
+    
+    /**
+     * Find all files with the exact given name and parentId.
+     * 
+     * @param parentId Id of the parent folder to search.
+     * @param name Exact file name to match.
+     * 
+     * @return A list of matching files.
+     * 
+     * @throws TskCoreException 
+     */
+    public synchronized List<AbstractFile> findFilesExactName(long parentId, String name) throws TskCoreException{
+        if (null == caseDb) {
+            throw new TskCoreException("File manager has been closed");
+        }
+        String whereClause = "name = '%s'";
+        return caseDb.findAllFilesInFolderWhere(parentId, String.format(whereClause, name));
+    }
 
     /**
      * Converts a list of MIME types into an SQL "mime_type IN" condition.

Core/src/org/sleuthkit/autopsy/coreutils/AppSQLiteDB.java

@@ -1,7 +1,7 @@
 /*
  * Autopsy Forensic Browser
  *
- * Copyright 2019 Basis Technology Corp.
+ * Copyright 2019-2020 Basis Technology Corp.
  * Contact: carrier <at> sleuthkit <dot> org
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
@@ -390,14 +390,17 @@ public final class AppSQLiteDB {
     private static void findAndCopySQLiteMetaFile(AbstractFile sqliteFile,
             String metaFileName) throws NoCurrentCaseException, TskCoreException, IOException {
 
+        // Do not look for metaFile if this is a carved directory
+        if(sqliteFile.getParentPath().equalsIgnoreCase("/$carvedfiles/")) {
+            return;
+        }
+        
         Case openCase = Case.getCurrentCaseThrows();
         SleuthkitCase sleuthkitCase = openCase.getSleuthkitCase();
         Services services = new Services(sleuthkitCase);
         FileManager fileManager = services.getFileManager();
-
+        
-        List<AbstractFile> metaFiles = fileManager.findFiles(
+        List<AbstractFile> metaFiles = fileManager.findFilesExactName(sqliteFile.getParent().getId(), metaFileName);
-                sqliteFile.getDataSource(), metaFileName,
-                sqliteFile.getParent().getName());
 
         if (metaFiles != null) {
             for (AbstractFile metaFile : metaFiles) {

Core/src/org/sleuthkit/autopsy/coreutils/SQLiteTableReader.java

@@ -425,15 +425,18 @@ public class SQLiteTableReader implements AutoCloseable {
      */
     private void findAndCopySQLiteMetaFile(AbstractFile sqliteFile,
             String metaFileName) throws NoCurrentCaseException, TskCoreException, IOException {
+        
+        // Do not look for metaFile if this is a carved directory
+        if(sqliteFile.getParentPath().equalsIgnoreCase("/$carvedfiles/")) {
+            return;
+        }
 
         Case openCase = Case.getCurrentCaseThrows();
         SleuthkitCase sleuthkitCase = openCase.getSleuthkitCase();
         Services services = new Services(sleuthkitCase);
         FileManager fileManager = services.getFileManager();
 
-        List<AbstractFile> metaFiles = fileManager.findFiles(
+       List<AbstractFile> metaFiles = fileManager.findFilesExactName(sqliteFile.getParent().getId(), metaFileName);
-                sqliteFile.getDataSource(), metaFileName,
-                sqliteFile.getParent().getName());
 
         if (metaFiles != null) {
             for (AbstractFile metaFile : metaFiles) {