search

ydkhatri / OneDrive

OneDrive log .ODL reader
https://swiftforensics.com
MIT License
109 stars 24 forks source link

Update odl.py to handle empty log files #9

Closed stephenkreusch closed 7 months ago

stephenkreusch commented 7 months ago

This PR checks the globbed log file paths and skips log file processing if the file size is 0 bytes, to avoid an error like:

Traceback (most recent call last):
  File "/mnt/c/temp/odl.py", line 500, in <module>
    main()
  File "/mnt/c/temp/odl.py", line 484, in main
    odl_rows = process_odl(path, map, args.all_data)
  File "/mnt/c/temp/odl.py", line 304, in process_odl
    odl_header = Odl_header.parse(file_header)
  File "/home/stephen/miniconda3/lib/python3.10/site-packages/construct/core.py", line 404, in parse
    return self.parse_stream(io.BytesIO(data), **contextkw)
  File "/home/stephen/miniconda3/lib/python3.10/site-packages/construct/core.py", line 416, in parse_stream
    return self._parsereport(stream, context, "(parsing)")
  File "/home/stephen/miniconda3/lib/python3.10/site-packages/construct/core.py", line 428, in _parsereport
    obj = self._parse(stream, context, path)
  File "/home/stephen/miniconda3/lib/python3.10/site-packages/construct/core.py", line 2236, in _parse
    subobj = sc._parsereport(stream, context, path)
  File "/home/stephen/miniconda3/lib/python3.10/site-packages/construct/core.py", line 428, in _parsereport
    obj = self._parse(stream, context, path)
  File "/home/stephen/miniconda3/lib/python3.10/site-packages/construct/core.py", line 2770, in _parse
    return self.subcon._parsereport(stream, context, path)
  File "/home/stephen/miniconda3/lib/python3.10/site-packages/construct/core.py", line 428, in _parsereport
    obj = self._parse(stream, context, path)
  File "/home/stephen/miniconda3/lib/python3.10/site-packages/construct/core.py", line 964, in _parse
    return stream_read(stream, length, path)
  File "/home/stephen/miniconda3/lib/python3.10/site-packages/construct/core.py", line 178, in stream_read
    raise StreamError("stream read less than specified amount, expected %d, found %d" % (length, len(data)), path=path)
construct.core.StreamError: Error in path (parsing) -> signature
stream read less than specified amount, expected 8, found 0
ydkhatri commented 7 months ago

Thanks, will merge this shortly.

On Mon, 8 Jan 2024, 07:56 Stephen Kreusch, @.***> wrote:

This PR checks the globbed log file paths and skips log file processing if the file size is 0 bytes, to avoid an error like:

Traceback (most recent call last): File "/mnt/c/temp/odl.py", line 500, in main() File "/mnt/c/temp/odl.py", line 484, in main odl_rows = process_odl(path, map, args.all_data) File "/mnt/c/temp/odl.py", line 304, in process_odl odl_header = Odl_header.parse(file_header) File "/home/stephen/miniconda3/lib/python3.10/site-packages/construct/core.py", line 404, in parse return self.parse_stream(io.BytesIO(data), **contextkw) File "/home/stephen/miniconda3/lib/python3.10/site-packages/construct/core.py", line 416, in parse_stream return self._parsereport(stream, context, "(parsing)") File "/home/stephen/miniconda3/lib/python3.10/site-packages/construct/core.py", line 428, in _parsereport obj = self._parse(stream, context, path) File "/home/stephen/miniconda3/lib/python3.10/site-packages/construct/core.py", line 2236, in _parse subobj = sc._parsereport(stream, context, path) File "/home/stephen/miniconda3/lib/python3.10/site-packages/construct/core.py", line 428, in _parsereport obj = self._parse(stream, context, path) File "/home/stephen/miniconda3/lib/python3.10/site-packages/construct/core.py", line 2770, in _parse return self.subcon._parsereport(stream, context, path) File "/home/stephen/miniconda3/lib/python3.10/site-packages/construct/core.py", line 428, in _parsereport obj = self._parse(stream, context, path) File "/home/stephen/miniconda3/lib/python3.10/site-packages/construct/core.py", line 964, in _parse return stream_read(stream, length, path) File "/home/stephen/miniconda3/lib/python3.10/site-packages/construct/core.py", line 178, in stream_read raise StreamError("stream read less than specified amount, expected %d, found %d" % (length, len(data)), path=path) construct.core.StreamError: Error in path (parsing) -> signature stream read less than specified amount, expected 8, found 0

You can view, comment on, or merge this pull request online at:

https://github.com/ydkhatri/OneDrive/pull/9 Commit Summary

File Changes

(1 file https://github.com/ydkhatri/OneDrive/pull/9/files)

Patch Links:

— Reply to this email directly, view it on GitHub https://github.com/ydkhatri/OneDrive/pull/9, or unsubscribe https://github.com/notifications/unsubscribe-auth/ADFCHUFHBC4QZSVPRVZAKKTYNMDZRAVCNFSM6AAAAABBQSPTHOVHI2DSMVQWIX3LMV43ASLTON2WKOZSGA3DSMRYGQ2DGOI . You are receiving this because you are subscribed to this thread.Message ID: @.***>