search

sepinf-inc / IPED

IPED Digital Forensic Tool. It is an open source software that can be used to process and analyze digital evidence, often seized at crime scenes by law enforcement or in a corporate investigation by private examiners.
Other
940 stars 218 forks source link

AccessDeniedException in read-only folder case #2298

Open aberenguel opened 3 weeks ago

aberenguel commented 3 weeks ago

I'm processing a case that is a folder with all folder and files read-only.

This exception occurs:

java.nio.file.AccessDeniedException: /xxxxx/mycase/data/Root/data/com.whatsapp/databases/wa.db-wal
    at java.base/sun.nio.fs.UnixException.translateToIOException(UnixException.java:90)
    at java.base/sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:111)
    at java.base/sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:116)
    at java.base/sun.nio.fs.UnixFileSystemProvider.implDelete(UnixFileSystemProvider.java:249)
    at java.base/sun.nio.fs.AbstractFileSystemProvider.deleteIfExists(AbstractFileSystemProvider.java:110)
    at java.base/java.nio.file.Files.deleteIfExists(Files.java:1181)
    at java.base/java.nio.file.Files.copy(Files.java:3055)
    at iped.parsers.sqlite.SQLite3DBParser.exportRelatedFile(SQLite3DBParser.java:157)
    at iped.parsers.sqlite.SQLite3DBParser.exportWalLog(SQLite3DBParser.java:126)
    at iped.parsers.whatsapp.WhatsAppParser.parseWhatsAppContacts(WhatsAppParser.java:1149)
    at iped.parsers.whatsapp.WhatsAppParser.parse(WhatsAppParser.java:260)
    at org.apache.tika.parser.CompositeParser.parse(CompositeParser.java:298)
    at iped.parsers.standard.StandardParser.parse(StandardParser.java:245)
    at iped.engine.io.ParsingReader$BackgroundParsing.run(ParsingReader.java:247)
    at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:515)
    at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
    at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
    at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
    at java.base/java.lang.Thread.run(Thread.java:829)
aberenguel commented 3 weeks ago

I wonder if there is need to invoke exportWalLog and exportRollbackJournal in WhatsAppParser, since these calls will be invoked in SQLite3DBParser.getConnection again.

lfcnassif commented 3 weeks ago

I don't remember who inserted those calls in WhatsAppParser, but I agree with you, at first, I think they aren't needed.

lfcnassif commented 2 weeks ago

@fmpfeifer, you refactored SQLite3DBParser WAL searching and exporting code a long ago, right? If you have available time, could you kindly help us and take a look at this?