search

sepinf-inc / IPED

IPED Digital Forensic Tool. It is an open source software that can be used to process and analyze digital evidence, often seized at crime scenes by law enforcement or in a corporate investigation by private examiners.
Other
884 stars 209 forks source link

Non VMDK file being detected as VMDK causing processing to abort #2099

Closed lfcnassif closed 4 months ago

lfcnassif commented 4 months ago

Reported by @fsicoli. The file has the following name and size, found inside an Apple FS: Sec542-0929-cl2-s002.vmdk:com.apple.quarantine (67bytes)

Processing aborts with:

Caused by: java.io.IOException: A sintaxe do nome do arquivo, do nome do diretório ou do rótulo do volume está incorreta
    at java.io.WinNTFileSystem.canonicalize0(Native Method) ~[?:?]
    at java.io.WinNTFileSystem.canonicalize(Unknown Source) ~[?:?]
    at java.io.File.getCanonicalPath(Unknown Source) ~[?:?]
    at java.io.File.getCanonicalFile(Unknown Source) ~[?:?]
    at iped.engine.task.EmbeddedDiskProcessTask.exportItem(EmbeddedDiskProcessTask.java:240) ~[iped-engine-4.1.5.jar:?]
    at iped.engine.task.EmbeddedDiskProcessTask.process(EmbeddedDiskProcessTask.java:192) ~[iped-engine-4.1.5.jar:?]
    at iped.engine.task.EmbeddedDiskProcessTask.process(EmbeddedDiskProcessTask.java:128) ~[iped-engine-4.1.5.jar:?]

Because it's trying to export the false VMDK using its original name with : which is forbidden by NTFS.