mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-06 21:00:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #6064 from markmckinnon/6578-RecentActivity-errors-File-has-a-null-value

Browse Source 
6578-RecentActivity-errors-File-has-a-null-value
This commit is contained in:
Ann Priestman 2020-07-15 18:12:57 -04:00 committed by GitHub
commit 97c13dedff
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 15 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractPrefetch.java
View File

@ -66,7 +66,7 @@ final class ExtractPrefetch extends Extract {
private static final String MODULE_NAME = "extractPREFETCH"; //NON-NLS
private static final String PREFETCH_TSK_COMMENT = "Prefetch File";
private static final String PREFETCH_FILE_LOCATION = "/Windows/Prefetch";
private static final String PREFETCH_FILE_LOCATION = "/windows/prefetch";
private static final String PREFETCH_TOOL_FOLDER = "markmckinnon"; //NON-NLS
private static final String PREFETCH_TOOL_NAME_WINDOWS_64 = "parse_prefetch_x64.exe"; //NON-NLS
private static final String PREFETCH_TOOL_NAME_WINDOWS_32 = "parse_prefetch_x32.exe"; //NON-NLS
@ -112,9 +112,9 @@ final class ExtractPrefetch extends Extract {
return;
}
String modOutFile = modOutPath + File.separator + PREFETCH_PARSER_DB_FILE;
String modOutFile = modOutPath + File.separator + dataSource.getName() + "-" + PREFETCH_PARSER_DB_FILE;
try {
String tempDirPath = RAImageIngestModule.getRATempPath(Case.getCurrentCase(), PREFETCH_DIR_NAME );
String tempDirPath = RAImageIngestModule.getRATempPath(Case.getCurrentCase(), dataSource.getName() + "-" + PREFETCH_DIR_NAME );
parsePrefetchFiles(prefetchDumper, tempDirPath, modOutFile, modOutPath);
createAppExecArtifacts(modOutFile, dataSource);
} catch (IOException ex) {
@ -148,8 +148,8 @@ final class ExtractPrefetch extends Extract {
return;
}
String prefetchFile = RAImageIngestModule.getRATempPath(Case.getCurrentCase(), PREFETCH_DIR_NAME) + File.separator + pFile.getName();
if (pFile.getParentPath().contains(PREFETCH_FILE_LOCATION)) {
String prefetchFile = RAImageIngestModule.getRATempPath(Case.getCurrentCase(), dataSource.getName() + "-" + PREFETCH_DIR_NAME) + File.separator + pFile.getName();
if (pFile.getParentPath().toLowerCase().contains(PREFETCH_FILE_LOCATION.toLowerCase())) {
try {
ContentUtils.writeToFile(pFile, new File(prefetchFile));
} catch (IOException ex) {
@ -293,7 +293,7 @@ final class ExtractPrefetch extends Extract {
}
}
} else {
logger.log(Level.SEVERE, "File has a null value " + prefetchFileName);//NON-NLS
logger.log(Level.WARNING, "File has a null value " + prefetchFileName);//NON-NLS
}
}
@ -371,17 +371,21 @@ final class ExtractPrefetch extends Extract {
FileManager fileManager = Case.getCurrentCase().getServices().getFileManager();
try {
files = fileManager.findFiles(dataSource, fileName, filePath); //NON-NLS
files = fileManager.findFiles(dataSource, fileName); //NON-NLS
} catch (TskCoreException ex) {
logger.log(Level.WARNING, "Unable to find prefetch files.", ex); //NON-NLS
return null; // No need to continue
}
if (!files.isEmpty()) {
return files.get(0);
} else {
return null;
for (AbstractFile pFile : files) {
if (pFile.getParentPath().toLowerCase().contains(filePath.toLowerCase())) {
return pFile;
}
}
return null;
}