search

sepinf-inc / IPED

IPED Digital Forensic Tool. It is an open source software that can be used to process and analyze digital evidence, often seized at crime scenes by law enforcement or in a corporate investigation by private examiners.
Other
884 stars 209 forks source link

Fail to parse some iOS WhatsApp DBs #2190

Closed wladimirleite closed 2 months ago

wladimirleite commented 2 months ago

When selecting from group members table (ZWAGROUPMEMBER), some members (ZMEMBERJID column) are null, causing a NPE in WhatsAppParser. I had this exception processing a recently generated UFDR, using the master branch. I just checked, and it also affects 4.1.6.

org.apache.tika.exception.TikaException: WAExtractorException Exception
    at iped.parsers.whatsapp.WhatsAppParser.parseWhatsappMessages(WhatsAppParser.java:394)
    at iped.parsers.whatsapp.WhatsAppParser.parse(WhatsAppParser.java:265)
    at org.apache.tika.parser.CompositeParser.parse(CompositeParser.java:298)
    at iped.parsers.standard.StandardParser.parse(StandardParser.java:245)
    at iped.engine.io.ParsingReader$BackgroundParsing.run(ParsingReader.java:247)
    at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source)
    at java.base/java.util.concurrent.FutureTask.run(Unknown Source)
    at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
    at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
    at java.base/java.lang.Thread.run(Unknown Source)
Caused by: java.lang.NullPointerException
    at iped.parsers.whatsapp.Extractor.setGroupMembers(Extractor.java:65)
    at iped.parsers.whatsapp.ExtractorIOS.extractChatList(ExtractorIOS.java:257)
    at iped.parsers.whatsapp.Extractor.getChatList(Extractor.java:34)
    at iped.parsers.whatsapp.WhatsAppParser.parseWhatsappMessages(WhatsAppParser.java:386)
wladimirleite commented 2 months ago

By the way, I checked in the triggering DBs and confirmed that there are NULL values in a few rows.

lfcnassif commented 2 months ago

Thank you @wladimirleite for the fix! I will merge it soon.