From e38474ab1a86afee3c45be2ac4731e88fc4948c5 Mon Sep 17 00:00:00 2001 From: Eamonn Saunders Date: Mon, 18 May 2015 10:51:52 -0400 Subject: [PATCH] Return immediately after indexing unallocated space, otherwise it gets processed twice. --- .../autopsy/keywordsearch/KeywordSearchIngestModule.java | 1 + 1 file changed, 1 insertion(+) diff --git a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchIngestModule.java b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchIngestModule.java index 12fb92e5c0..66fb3cd6ad 100644 --- a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchIngestModule.java +++ b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchIngestModule.java @@ -454,6 +454,7 @@ public final class KeywordSearchIngestModule implements FileIngestModule { // unallocated and unused blocks can only have strings extracted from them. if ((aType.equals(TskData.TSK_DB_FILES_TYPE_ENUM.UNALLOC_BLOCKS) || aType.equals(TskData.TSK_DB_FILES_TYPE_ENUM.UNUSED_BLOCKS))) { extractStringsAndIndex(aFile); + return; } final long size = aFile.getSize();