From 7a80c2fd655d20c7f886613e781828e918402548 Mon Sep 17 00:00:00 2001 From: Mark McKinnon Date: Fri, 16 Apr 2021 15:10:45 -0400 Subject: [PATCH 1/5] Update ChromeCacheExtractor.java Check if a zero byte file and do not process it, if it is. --- .../autopsy/recentactivity/ChromeCacheExtractor.java | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ChromeCacheExtractor.java b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ChromeCacheExtractor.java index 7d41888121..3baf9f7a13 100644 --- a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ChromeCacheExtractor.java +++ b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ChromeCacheExtractor.java @@ -283,7 +283,9 @@ final class ChromeCacheExtractor { return; } - processCacheFolder(indexFile); + if (indexFile.getSize() > 0) { + processCacheFolder(indexFile); + } } } catch (TskCoreException ex) { From 755cf804f5009f6f5d594ef492d49bbd69a1a3c8 Mon Sep 17 00:00:00 2001 From: Kelly Kelly Date: Fri, 16 Apr 2021 15:22:58 -0400 Subject: [PATCH 2/5] Fixed TL adding data source issue --- Core/src/org/sleuthkit/autopsy/timeline/EventsModel.java | 4 ++-- .../timeline/ui/filtering/datamodel/CompoundFilterState.java | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/timeline/EventsModel.java b/Core/src/org/sleuthkit/autopsy/timeline/EventsModel.java index f80eef206b..b85f43bab9 100755 --- a/Core/src/org/sleuthkit/autopsy/timeline/EventsModel.java +++ b/Core/src/org/sleuthkit/autopsy/timeline/EventsModel.java @@ -55,6 +55,7 @@ import org.sleuthkit.autopsy.timeline.events.TagsAddedEvent; import org.sleuthkit.autopsy.timeline.events.TagsDeletedEvent; import org.sleuthkit.autopsy.timeline.ui.filtering.datamodel.FilterState; import org.sleuthkit.autopsy.timeline.ui.filtering.datamodel.RootFilterState; +import org.sleuthkit.autopsy.timeline.ui.filtering.datamodel.SqlFilterState; import org.sleuthkit.autopsy.timeline.utils.CacheLoaderImpl; import org.sleuthkit.autopsy.timeline.utils.FilterUtils; import org.sleuthkit.autopsy.timeline.zooming.EventsModelParams; @@ -222,8 +223,7 @@ public final class EventsModel { * @param rootFilterState A root filter state object. */ synchronized void addDataSourceFilters(RootFilterState rootFilterState) { - DataSourcesFilter dataSourcesFilter = rootFilterState.getDataSourcesFilterState().getFilter(); - datasourceIDsToNamesMap.entrySet().forEach(entry -> dataSourcesFilter.addSubFilter(newDataSourceFilter(entry))); + datasourceIDsToNamesMap.entrySet().forEach(entry -> rootFilterState.getDataSourcesFilterState().addSubFilterState(new SqlFilterState<>(newDataSourceFilter(entry)))); } /** diff --git a/Core/src/org/sleuthkit/autopsy/timeline/ui/filtering/datamodel/CompoundFilterState.java b/Core/src/org/sleuthkit/autopsy/timeline/ui/filtering/datamodel/CompoundFilterState.java index 6884d275a8..f7e628f698 100755 --- a/Core/src/org/sleuthkit/autopsy/timeline/ui/filtering/datamodel/CompoundFilterState.java +++ b/Core/src/org/sleuthkit/autopsy/timeline/ui/filtering/datamodel/CompoundFilterState.java @@ -110,7 +110,7 @@ public class CompoundFilterState newSubFilterState) { + public void addSubFilterState(FilterState< ? extends SubFilterType> newSubFilterState) { SubFilterType filter = newSubFilterState.getFilter(); if (getSubFilterStates().stream().map(FilterState::getFilter).noneMatch(filter::equals)) { From 770e74fc88b99d8bba6e9238fe4698952dfba858 Mon Sep 17 00:00:00 2001 From: Kelly Kelly Date: Mon, 19 Apr 2021 14:19:39 -0400 Subject: [PATCH 3/5] Fixed TL empty start and end fields --- Core/src/org/sleuthkit/autopsy/timeline/ui/ViewFrame.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Core/src/org/sleuthkit/autopsy/timeline/ui/ViewFrame.java b/Core/src/org/sleuthkit/autopsy/timeline/ui/ViewFrame.java index 39506554ac..a834ccd0f6 100755 --- a/Core/src/org/sleuthkit/autopsy/timeline/ui/ViewFrame.java +++ b/Core/src/org/sleuthkit/autopsy/timeline/ui/ViewFrame.java @@ -588,7 +588,7 @@ final public class ViewFrame extends BorderPane { long startMillis = filteredEvents.getTimeRange().getStartMillis(); long endMillis = filteredEvents.getTimeRange().getEndMillis(); - if (minTime > 0 && maxTime > minTime) { + if ( maxTime > minTime) { Platform.runLater(() -> { startPicker.localDateTimeProperty().removeListener(startListener); endPicker.localDateTimeProperty().removeListener(endListener); From ff65739dbb2e885bda4b9a414739ab89b33338c6 Mon Sep 17 00:00:00 2001 From: Mark McKinnon Date: Mon, 19 Apr 2021 15:25:59 -0400 Subject: [PATCH 4/5] Update ChromeCacheExtractor.java Check for buffer capacity of zero (0) and return if it is, nothing to look at. --- .../sleuthkit/autopsy/recentactivity/ChromeCacheExtractor.java | 3 +++ 1 file changed, 3 insertions(+) diff --git a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ChromeCacheExtractor.java b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ChromeCacheExtractor.java index 7d41888121..122fd52a51 100644 --- a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ChromeCacheExtractor.java +++ b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ChromeCacheExtractor.java @@ -1039,6 +1039,9 @@ final class ChromeCacheExtractor { this.data = new byte [length]; ByteBuffer buf = cacheFileCopy.getByteBuffer(); int dataOffset = DATAFILE_HDR_SIZE + cacheAddress.getStartBlock() * cacheAddress.getBlockSize(); + if (buf.capacity() == 0) { + return; + } buf.position(dataOffset); buf.get(data, 0, length); From 11471f57aff1e697dc119e0bc82151f4bb068a6e Mon Sep 17 00:00:00 2001 From: Mark McKinnon Date: Tue, 20 Apr 2021 10:36:03 -0400 Subject: [PATCH 5/5] Update ChromeCacheExtractor.java Change check --- .../sleuthkit/autopsy/recentactivity/ChromeCacheExtractor.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ChromeCacheExtractor.java b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ChromeCacheExtractor.java index 122fd52a51..3a3813b60b 100644 --- a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ChromeCacheExtractor.java +++ b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ChromeCacheExtractor.java @@ -1039,7 +1039,7 @@ final class ChromeCacheExtractor { this.data = new byte [length]; ByteBuffer buf = cacheFileCopy.getByteBuffer(); int dataOffset = DATAFILE_HDR_SIZE + cacheAddress.getStartBlock() * cacheAddress.getBlockSize(); - if (buf.capacity() == 0) { + if (dataOffset > buf.capacity()) { return; } buf.position(dataOffset);