From 2de8646ba7cb968e1ac52f7546a64723352f7d42 Mon Sep 17 00:00:00 2001 From: Greg DiCristofaro Date: Tue, 22 Aug 2023 11:45:11 -0400 Subject: [PATCH 1/3] updates for ignoring placeholder paths --- Core/src/org/sleuthkit/autopsy/casemodule/Case.java | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/Core/src/org/sleuthkit/autopsy/casemodule/Case.java b/Core/src/org/sleuthkit/autopsy/casemodule/Case.java index b1d2f28c31..57739bda76 100644 --- a/Core/src/org/sleuthkit/autopsy/casemodule/Case.java +++ b/Core/src/org/sleuthkit/autopsy/casemodule/Case.java @@ -194,6 +194,8 @@ public class Case { private final SleuthkitEventListener sleuthkitEventListener; private CollaborationMonitor collaborationMonitor; private Services caseServices; + // matches something like '\\.\PHYSICALDRIVE0' + private static final String PLACEHOLDER_DS_PATH_REGEX = "^\\s*\\\\\\\\\\.\\\\(PHYSICALDRIVE)\\d*\\s*$"; private volatile boolean hasDataSource = false; private volatile boolean hasData = false; @@ -1305,6 +1307,13 @@ public class Case { String path = entry.getValue(); boolean fileExists = (new File(path).isFile() || DriveUtils.driveExists(path)); if (!fileExists) { + // CT-7336: ignore relocating datasources if file provider is present and placeholder path is used. + if (newCurrentCase.getMetadata() != null + && !StringUtils.isBlank(newCurrentCase.getMetadata().getContentProviderName()) + && (path == null || path.matches(PLACEHOLDER_DS_PATH_REGEX))) { + continue; + } + try { // Using invokeAndWait means that the dialog will // open on the EDT but this thread will wait for an From 1c963d6480944acf4857d5b84c100bf393aca316 Mon Sep 17 00:00:00 2001 From: Greg DiCristofaro Date: Tue, 22 Aug 2023 12:39:47 -0400 Subject: [PATCH 2/3] fixes from testing --- Core/src/org/sleuthkit/autopsy/casemodule/Case.java | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/casemodule/Case.java b/Core/src/org/sleuthkit/autopsy/casemodule/Case.java index 57739bda76..f39b286f1c 100644 --- a/Core/src/org/sleuthkit/autopsy/casemodule/Case.java +++ b/Core/src/org/sleuthkit/autopsy/casemodule/Case.java @@ -195,7 +195,7 @@ public class Case { private CollaborationMonitor collaborationMonitor; private Services caseServices; // matches something like '\\.\PHYSICALDRIVE0' - private static final String PLACEHOLDER_DS_PATH_REGEX = "^\\s*\\\\\\\\\\.\\\\(PHYSICALDRIVE)\\d*\\s*$"; + private static final String PLACEHOLDER_DS_PATH_REGEX = "^\\s*\\\\\\\\\\.\\\\(PHYSICALDRIVE\\d*)\\s*$"; private volatile boolean hasDataSource = false; private volatile boolean hasData = false; @@ -1305,7 +1305,7 @@ public class Case { for (Map.Entry entry : imgPaths.entrySet()) { long obj_id = entry.getKey(); String path = entry.getValue(); - boolean fileExists = (new File(path).isFile() || DriveUtils.driveExists(path)); + boolean fileExists = (new File(path).exists()|| DriveUtils.driveExists(path)); if (!fileExists) { // CT-7336: ignore relocating datasources if file provider is present and placeholder path is used. if (newCurrentCase.getMetadata() != null From 6bc95d1253cf8436970c0dcb8fe47fc98cace7cb Mon Sep 17 00:00:00 2001 From: Greg DiCristofaro Date: Tue, 22 Aug 2023 14:26:42 -0400 Subject: [PATCH 3/3] updates for message --- .../org/sleuthkit/autopsy/casemodule/Bundle.properties | 4 ++-- .../sleuthkit/autopsy/casemodule/Bundle.properties-MERGED | 4 ++-- Core/src/org/sleuthkit/autopsy/casemodule/Case.java | 8 +++++--- 3 files changed, 9 insertions(+), 7 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/casemodule/Bundle.properties b/Core/src/org/sleuthkit/autopsy/casemodule/Bundle.properties index cae89e41ce..92b64b840b 100644 --- a/Core/src/org/sleuthkit/autopsy/casemodule/Bundle.properties +++ b/Core/src/org/sleuthkit/autopsy/casemodule/Bundle.properties @@ -66,8 +66,8 @@ Case.open.msgDlg.updated.msg=Updated case database schema.\nA backup copy of the Case.open.msgDlg.updated.title=Case Database Schema Update Case.checkImgExist.confDlg.doesntExist.msg=One of the images associated with \n\ this case are missing. Would you like to search for them now?\n\ -Previously, the image was located at:\n\ -{0}\n\ +Previously, the image with host, {0}, was located at:\n\ +{1}\n\ Please note that you will still be able to browse directories and generate reports\n\ if you choose No, but you will not be able to view file content or run the ingest process. Case.checkImgExist.confDlg.doesntExist.title=Missing Image diff --git a/Core/src/org/sleuthkit/autopsy/casemodule/Bundle.properties-MERGED b/Core/src/org/sleuthkit/autopsy/casemodule/Bundle.properties-MERGED index dc96292d9a..ce1fb9aa70 100755 --- a/Core/src/org/sleuthkit/autopsy/casemodule/Bundle.properties-MERGED +++ b/Core/src/org/sleuthkit/autopsy/casemodule/Bundle.properties-MERGED @@ -253,8 +253,8 @@ Case.open.msgDlg.updated.msg=Updated case database schema.\nA backup copy of the Case.open.msgDlg.updated.title=Case Database Schema Update Case.checkImgExist.confDlg.doesntExist.msg=One of the images associated with \n\ this case are missing. Would you like to search for them now?\n\ -Previously, the image was located at:\n\ -{0}\n\ +Previously, the image with host, {0}, was located at:\n\ +{1}\n\ Please note that you will still be able to browse directories and generate reports\n\ if you choose No, but you will not be able to view file content or run the ingest process. Case.checkImgExist.confDlg.doesntExist.title=Missing Image diff --git a/Core/src/org/sleuthkit/autopsy/casemodule/Case.java b/Core/src/org/sleuthkit/autopsy/casemodule/Case.java index f39b286f1c..eb279febe7 100644 --- a/Core/src/org/sleuthkit/autopsy/casemodule/Case.java +++ b/Core/src/org/sleuthkit/autopsy/casemodule/Case.java @@ -195,7 +195,7 @@ public class Case { private CollaborationMonitor collaborationMonitor; private Services caseServices; // matches something like '\\.\PHYSICALDRIVE0' - private static final String PLACEHOLDER_DS_PATH_REGEX = "^\\s*\\\\\\\\\\.\\\\(PHYSICALDRIVE\\d*)\\s*$"; + private static final String PLACEHOLDER_DS_PATH_REGEX = "^\\s*\\\\\\\\\\.\\\\PHYSICALDRIVE\\d*\\s*$"; private volatile boolean hasDataSource = false; private volatile boolean hasData = false; @@ -1315,6 +1315,8 @@ public class Case { } try { + DataSource ds = newCurrentCase.getSleuthkitCase().getDataSource(obj_id); + String hostName = StringUtils.defaultString(ds.getHost() == null ? "" : ds.getHost().getName()); // Using invokeAndWait means that the dialog will // open on the EDT but this thread will wait for an // answer. Using invokeLater would cause this loop to @@ -1324,7 +1326,7 @@ public class Case { public void run() { int response = JOptionPane.showConfirmDialog( mainFrame, - NbBundle.getMessage(Case.class, "Case.checkImgExist.confDlg.doesntExist.msg", path), + NbBundle.getMessage(Case.class, "Case.checkImgExist.confDlg.doesntExist.msg", hostName, path), NbBundle.getMessage(Case.class, "Case.checkImgExist.confDlg.doesntExist.title"), JOptionPane.YES_NO_OPTION); if (response == JOptionPane.YES_OPTION) { @@ -1336,7 +1338,7 @@ public class Case { } }); - } catch (InterruptedException | InvocationTargetException ex) { + } catch (InterruptedException | InvocationTargetException | TskCoreException | TskDataException ex) { logger.log(Level.SEVERE, "Failed to show missing image confirmation dialog", ex); //NON-NLS } }