Skip to content

Commit

Permalink
Fixed a bug where deleted files which could not be opened were skipped.
Browse files Browse the repository at this point in the history
Ignore-this: 4580f604946918dc6dc4493960364c90

darcs-hash:20090616135637-f1522-8a7bb7e6a7c762526f8aedfa9d0cb2b76ff8b75f.gz
  • Loading branch information
scudette committed Jun 16, 2009
1 parent 5009a44 commit 3031395
Show file tree
Hide file tree
Showing 4 changed files with 34 additions and 23 deletions.
47 changes: 29 additions & 18 deletions src/plugins/DiskForensics/FileSystems/Sleuthkit.py
Original file line number Diff line number Diff line change
Expand Up @@ -204,20 +204,31 @@ def insert_inode(inode):
else:
status = 'deleted'

args = dict(inode = inodestr,
status = status,
_fast = True)

try:
print "%r" % inode
if inode.__str__()=="22-0-0":
print "found it"
raise IOError("foo")


## If this fails we return the default deleted Inode
## because we dont know anything about this inode (we
## dont know its run list or attributes).
f = fs.open(inode=str(inode))
s = fs.fstat(f)

args = dict(inode = inodestr,
status = status,
uid = s.st_uid,
gid = s.st_gid,
mode = s.st_mode,
links = s.st_nlink,
link = "",
size = s.st_size,
_fast = True
)
args.update(dict(
uid = s.st_uid,
gid = s.st_gid,
mode = s.st_mode,
links = s.st_nlink,
link = "",
size = s.st_size,
))

if s.st_mtime:
args['_mtime'] = "from_unixtime(%d)" % s.st_mtime
Expand All @@ -228,9 +239,6 @@ def insert_inode(inode):
if s.st_ctime:
args['_ctime'] = "from_unixtime(%d)" % s.st_ctime

dbh_inode.insert( "inode", **args)
inode_id = dbh_inode.autoincrement()

#insert block runs
index = 0
for (index, start, count) in runs(f.blocks()):
Expand All @@ -242,9 +250,12 @@ def insert_inode(inode):
)
#f.close()

except IOError:
pass
except IOError,e:
pyflaglog.log(pyflaglog.WARNING, "Error creating inode: %s", e)

dbh_inode.insert( "inode", **args)
inode_id = dbh_inode.autoincrement()

## If needed schedule inode for scanning:
if scanners:
pdbh.mass_insert(
Expand Down Expand Up @@ -402,7 +413,7 @@ def reset(self, dbh, case):

## Unit Tests:
import unittest
from hashlib import md5
import hashlib
import pyflag.pyflagsh as pyflagsh
import pyflag.tests as tests

Expand Down Expand Up @@ -444,15 +455,15 @@ def test02ReadNTFSFile(self):
## This file is Images/250px-Holmes_by_Paget.jpg
fd = self.fsfd.open(inode='Itest|K33-128-4')
data = fd.read()
m = md5.new()
m = hashlib.md5()
m.update(data)
self.assertEqual(m.hexdigest(),'f9c4ea83dfcdcf5eb441e130359f4a0d')

def test03ReadNTFSCompressed(self):
""" Test reading a compressed NTFS file """
self.fsfd = DBFS(self.test_case)
fd = self.fsfd.open("/Books/80day11.txt")
m = md5.new()
m = hashlib.md5()
m.update(fd.read())
self.assertEqual(m.hexdigest(),'f5b394b5d0ca8c9ce206353e71d1d1f2')

Expand Down
2 changes: 1 addition & 1 deletion src/plugins/FileHandlers.py
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,7 @@ def open(self):
fd=gzip.open(file,'rb')

## gzip doesnt really verify the file until you read something:
magic = fd.read(10)
magic=fd.read(10)
if len(magic)!=10:
fd = open(file,'rb')
else:
Expand Down
6 changes: 3 additions & 3 deletions src/plugins/LoadData.py
Original file line number Diff line number Diff line change
Expand Up @@ -636,7 +636,7 @@ def reset(self,query):

## Unit Tests:
import unittest
from hashlib import md5
import hashlib
import pyflag.pyflagsh as pyflagsh
from pyflag.FileSystem import DBFS

Expand Down Expand Up @@ -698,13 +698,13 @@ def test03MultipleSources(self):
## Try to read a file from the first source:
fsfd = DBFS(self.test_case)
fd = fsfd.open("/stdimage/dscf1081.jpg")
m = md5.new()
m = hashlib.md5()
m.update(fd.read())
self.assertEqual(m.hexdigest(),'11bec410aebe0c22c14f3eaaae306f46')

## Try to read a file from the second source:
fd = fsfd.open("/ntfsimage/Books/80day11.txt")
m = md5.new()
m = hashlib.md5()
m.update(fd.read())
self.assertEqual(m.hexdigest(),'f5b394b5d0ca8c9ce206353e71d1d1f2')

2 changes: 1 addition & 1 deletion src/pyflag/HTMLUI.py
Original file line number Diff line number Diff line change
Expand Up @@ -340,7 +340,7 @@ def _calculate_js_for_pane(self, target=None, pane="main", **opts):

if pane=='new':
id=self.get_unique_id()
return "window.open('f?%s&__pyflag_parent='+window.__pyflag_name+'&__pyflag_name=child_%s','child_%s', 'fullscreen=yes,scrollbars=yes'); return false;" % (target, id,id)
return "window.open('f?%s&__pyflag_parent='+window.__pyflag_name+'&__pyflag_name=child_%s','child_%s', 'width=1024, height=800, scrollbars=yes'); return false;" % (target, id,id)

if target:
## Try to remove the callback which we are generated from:
Expand Down

0 comments on commit 3031395

Please sign in to comment.