pjrinaldi / wombatforensics

linux c++, fox-toolkit, multi-threaded forensic gui tool
GNU General Public License v2.0
46 stars 12 forks source link

inmemory vs file #449

Closed pjrinaldi closed 1 year ago

pjrinaldi commented 1 year ago

When it's larger than the set memory limit, it's a file. i write the content to a tmp file and then i read the tmp file into memory.

The issue with this, is i don't process or partially read the file, so i would read the whole thing into memory and exceed the set memorylimit.

I need to ponder this and figure out a simple way to ensure i'm not pulling the huge file back into memory. Options are ensure the reader only reads a little bit at a time when parsing accordingly and then the hex would either load some of it dynamically, or I just would only load part of it... and notify the user.

the hex viewer as only loading memlimit part is easiest and notifying the user. to launch externally would be simplest.

pjrinaldi commented 1 year ago

need to resolve this one ASAP, otherwise i am just wasting my time. should also decide if i should switch the fileitem vector to a map, as of right now I don't think that matters right now since the code works fine.

pjrinaldi commented 1 year ago

need to modify the tmp file to be similar to the content tree storage, which could be simply the gid.tmp, rather than the filename and the gid since i don't need to recognize it and it causes issue with loading externally when the proper variables aren't escaped.

pjrinaldi commented 1 year ago

fixed issue with $MBR and other files with $ in the name. The external hexviewer works now. still need to continue to fix the inmemory true/false and take care of switching to write to a file by default and inmemory if i am parsing internally, otherwise just let external programs handle the files large or small better.

pjrinaldi commented 1 year ago

updated getfilecontent() to default to write to a tmp file and then if it's something i custom parse, read it in memory and go from there. I think i will add a plaintext preview window to the main screen, and have it only do part of a file, i.e. a certain size buffer for quick preview plain text loading...

pjrinaldi commented 1 year ago

implemented and working. if other issues arise, i'll open a new ticket.