sepinf-inc / IPED

IPED Digital Forensic Tool. It is an open source software that can be used to process and analyze digital evidence, often seized at crime scenes by law enforcement or in a corporate investigation by private examiners.
Other
940 stars 218 forks source link

Inconsistent view of Viewers #2290

Open aberenguel opened 3 weeks ago

aberenguel commented 3 weeks ago

Using master branch, in Linux.

The scenario is the following:

  1. open the case, with Preview tab visible

image

  1. select some item that triggers Metadata tab as best viewer (for example an InstantMessage)

image

As result, the metadata is not loaded. It not always happens, but happens the most of times. After some debug I've seen that ViewerController.updateViewer() checks if viewer.getPanel().isShowing() before load the content in the viewer. However this check not always return true. The documentation says:

boolean java.awt.Component.isShowing()

Determines whether this component is showing on screen. This means that the component must be visible, and it must be in a container that is visible and showing.

I think the container is not showing at this point.

Changing the code to viewer.getPanel().isVisible() solved the problem.

wladimirleite commented 3 weeks ago

Changing the code to viewer.getPanel().isVisible() solved the problem.

The reason isShowing() was used instead of isVisible() is that isVisible() returns true even if the viewer is not in an active tab. Considering the default layout, all 4 viewers (hex, text, metadata and preview) would be called if isVisible() is used, even if just one of them should actually be loaded. This can be a major overhead if the access to the item content is slow. If you add a log message after the isShowing() / isVisible(), like below...

        if (viewer.getPanel().isShowing() || (viewer.equals(textViewer) && hasHits())) {
            System.out.println("    Update " + viewer);

...the result should be:

Using isVisible():

2024-08-15 18:04:05 [INFO]  [app.ui.FileProcessor]  Opening 1.jpg
    Update iped.viewers.HexViewerPlus@14a621ee
    Update iped.app.ui.viewers.TextViewer@34dd747f
    Update iped.app.ui.ViewerController$1@17dcc00f
    Update iped.viewers.MultiViewer@7c5e9640

Using isShowing() (with metadata tab locked):

2024-08-15 18:06:51 [INFO]  [app.ui.FileProcessor]  Opening 1.jpg
    Update iped.app.ui.ViewerController$1@2b8bcc40

I think it would be better to keep the current behavior, finding another way to solve the issue you described. Making a quick test with a case I am working on, I couldn't reproduce the issue. I will try again later with larger cases.

aberenguel commented 3 weeks ago

Thanks, @wladimirleite! I reproduced the logging you set. The commit https://github.com/aberenguel/IPED/commit/8663e217724f402483dac441358d6ec07d4fdf5e solves the problem without updating all viewers.