search

sepinf-inc / IPED

IPED Digital Forensic Tool. It is an open source software that can be used to process and analyze digital evidence, often seized at crime scenes by law enforcement or in a corporate investigation by private examiners.
Other
924 stars 217 forks source link

Sometimes items are not included in their bookmarks, when generating a report from a multicase #1940

Closed wladimirleite closed 10 months ago

wladimirleite commented 10 months ago

This was reported to me by a user from another location, so I didn't have the cases used here. It is a tricky issue, and took me quite a while to reproduce and find out the root cause.

Steps to reproduce the issue:

  1. Open a multicase, with 3 cases.
  2. Create 3 bookmarks, each with items from one case.

image

  1. Generate a report including all bookmarks.
  2. Check the report. All items were included, but sometimes some of them are not associated with their bookmarks. Increasing the existing sleep time inside SaveStateThread.run() made the issue easier to reproduce.

image

Cause:

When generating a report from a multicase, the method IPEDReader.copyBookmarksToReport() is called multiple times. At the end of this method, there is a call to reportState.saveState(), that will save the state of the report case bookmarks file asynchronously, using a SaveStateThread. The issue happens when saving is slower than the next reportState.saveState(). The bookmarks to be saved are inserted into a HashMap (named stateMap), then they can be processed in a different order than they were originally added to the map.

EDIT: As there are calls to loadState() when copying bookmarks to report, it seems that synchronous saveState() should be used here.

lfcnassif commented 10 months ago

Thank you @tc-wleite for your time spent investigating this!

wladimirleite commented 10 months ago

Just to avoid confusion, I used the #1866 branch to test (and take these screenshots), but this is not related to it. The user that reported the issue was using 4.1.4, and I was able to reproduce it using the master branch.