From 26345aea8c0967930595061f15c0a475ea91eadc Mon Sep 17 00:00:00 2001 From: "U-BASIS\\zhaohui" Date: Thu, 7 Dec 2017 13:18:59 -0500 Subject: [PATCH] 3246: Calc file type of some slack files --- .../sleuthkit/autopsy/modules/filetypeid/FileTypeDetector.java | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/Core/src/org/sleuthkit/autopsy/modules/filetypeid/FileTypeDetector.java b/Core/src/org/sleuthkit/autopsy/modules/filetypeid/FileTypeDetector.java index b1aff14a8f..5851b9887c 100755 --- a/Core/src/org/sleuthkit/autopsy/modules/filetypeid/FileTypeDetector.java +++ b/Core/src/org/sleuthkit/autopsy/modules/filetypeid/FileTypeDetector.java @@ -54,6 +54,7 @@ public class FileTypeDetector { private static final Logger logger = Logger.getLogger(FileTypeDetector.class.getName()); private static final Tika tika = new Tika(); + private static final int SLACK_FILE_THRESHOLD = 4096; private final List userDefinedFileTypes; private final List autopsyDefinedFileTypes; private static SortedSet tikaDetectedTypes; @@ -247,7 +248,7 @@ public class FileTypeDetector { || (file.getType() == TskData.TSK_DB_FILES_TYPE_ENUM.UNALLOC_BLOCKS) || (file.getType() == TskData.TSK_DB_FILES_TYPE_ENUM.UNUSED_BLOCKS) || (file.getType() == TskData.TSK_DB_FILES_TYPE_ENUM.VIRTUAL_DIR) - || (file.getType() == TskData.TSK_DB_FILES_TYPE_ENUM.SLACK)) { + || ((file.getType() == TskData.TSK_DB_FILES_TYPE_ENUM.SLACK) && file.getSize() < SLACK_FILE_THRESHOLD)) { mimeType = MimeTypes.OCTET_STREAM; }