search

maurermj08 / efetch

Evidence Fetcher (efetch) is a web-based file explorer, viewer, and analyzer.
Apache License 2.0
37 stars 7 forks source link

Expanding evidence items in ZIP files #10

Closed maurermj08 closed 8 years ago

maurermj08 commented 8 years ago

There is an issue with trying to expand any evidence item with in a ZIP file.

Trying to list the sub items in the following pathspec will result in getting a list containing only the same pathspec, resulting in a loop in efetch and a blank directory listing: '{"type_indicator": "ZIP", "type": "PathSpec", "location": "/EfetchTestCase.E01", "parent": {"type_indicator": "OS", "type": "PathSpec", "location": "/media/sf_J_DRIVE/EfetchTestCase.zip"}}'

The issue appears to be in the dfvfs_util.get_base_from_pathspec(), though it may stem from other issues with the ZIP pathspec.

maurermj08 commented 8 years ago

Updated pathspec_helper to use the path_spec_factory for ZIP. Also updated directory to better handle errors. Currently, there is an open bug for dfVFS for updating the ZIP pathspec, https://github.com/log2timeline/dfvfs/issues/168. Therefore, I am closing this issue and will created a more detailed issue once that ZIP pathspec is updated.