diff --git a/bindings/java/jni/auto_db_java.cpp b/bindings/java/jni/auto_db_java.cpp
index 033f28e07fa6b1f42f49a3ba2735ed53d5f631b6..e0e9afb5c461628fb1215d11a3bb40305b611cd6 100644
--- a/bindings/java/jni/auto_db_java.cpp
+++ b/bindings/java/jni/auto_db_java.cpp
@@ -482,7 +482,9 @@ TSK_RETVAL_ENUM TskAutoDbJava::createJString(const char * input, jstring & newJS
if (tsk_UTF8toUTF16((const UTF8 **)&source, (const UTF8 *)&source[input_len], &target, &target[input_len], TSKlenientConversion) != TSKconversionOK) {
free(utf16_input);
- return TSK_ERR;
+ // use default JNI method as fallback, fixes https://github.com/sleuthkit/sleuthkit/issues/2723
+ newJString = m_jniEnv->NewStringUTF(input);
+ return TSK_OK;
}
/*
diff --git a/bindings/java/src/org/sleuthkit/datamodel/Pool.java b/bindings/java/src/org/sleuthkit/datamodel/Pool.java
index 4d3e231631ca6b99791814b01c8640aabe32de0c..9059f95bbcc88a87c20dca7fe166e74bf5197d16 100644
--- a/bindings/java/src/org/sleuthkit/datamodel/Pool.java
+++ b/bindings/java/src/org/sleuthkit/datamodel/Pool.java
@@ -114,7 +114,13 @@ private long getPoolOffset(Image image) throws TskCoreException {
} else if (this.getParent() instanceof Volume) {
// If the parent is a volume, then the pool starts at the volume offset
Volume parent = (Volume)this.getParent();
- return parent.getStart() * image.getSsize(); // Offset needs to be in bytes
+ if (parent.getParent() instanceof VolumeSystem) {
+ // uses block size from parent volume system
+ return parent.getStart() * ((VolumeSystem) parent.getParent()).getBlockSize(); // Offset needs to be in bytes
+ } else {
+ // uses sector size from parent image (old behavior fallback)
+ return parent.getStart() * image.getSsize(); // Offset needs to be in bytes
+ }
}
throw new TskCoreException("Pool with object ID " + this.getId() + " does not have Image or Volume parent");
}
diff --git a/bindings/java/src/org/sleuthkit/datamodel/TskCaseDbBridge.java b/bindings/java/src/org/sleuthkit/datamodel/TskCaseDbBridge.java
index a161ecc40a0ee244f9de92528f82b7e5bec37a7a..0da8c2a846cca449749b58250e49aa0482d6315d 100644
--- a/bindings/java/src/org/sleuthkit/datamodel/TskCaseDbBridge.java
+++ b/bindings/java/src/org/sleuthkit/datamodel/TskCaseDbBridge.java
@@ -396,6 +396,10 @@ private long addBatchedFilesToDb() {
} catch (NotUserSIDException ex) {
// if the owner SID is not a user SID, set the owner account to null
ownerIdToAccountMap.put(ownerUid, null);
+ } catch (Exception ex) {
+ // catch other exceptions to avoid skiping add batched files loop below
+ logger.log(Level.WARNING, "Error mapping ownerId " + ownerUid + " to account", ex);
+ ownerIdToAccountMap.put(ownerUid, null);
}
}
}
@@ -484,7 +488,7 @@ private long addBatchedFilesToDb() {
// Exception firewall to prevent unexpected return to the native code
logger.log(Level.SEVERE, "Unexpected error from files added callback", ex);
}
- } catch (TskCoreException ex) {
+ } catch (Throwable ex) {
logger.log(Level.SEVERE, "Error adding batched files to database", ex);
revertTransaction();
return -1;
diff --git a/bindings/java/src/org/sleuthkit/datamodel/WindowsAccountUtils.java b/bindings/java/src/org/sleuthkit/datamodel/WindowsAccountUtils.java
index ee4e8ff9e2dc4c4c4205a591c649952237ef481f..28a92ca920e1754e4cf89281ac607c6a79d30e55 100644
--- a/bindings/java/src/org/sleuthkit/datamodel/WindowsAccountUtils.java
+++ b/bindings/java/src/org/sleuthkit/datamodel/WindowsAccountUtils.java
@@ -170,6 +170,7 @@ public String getDescription() {
// - We can assume and fill in SID from given account name, and vice versa.
// - We map account names in foreign languages (some known set) to english names, for these well known accounts.
private static final Map<String, WellKnownSidInfo> SPECIAL_SIDS_MAP = ImmutableMap.<String, WellKnownSidInfo>builder()
+ .put("S-1-5-17", new WellKnownSidInfo(true, "S-1-5", NTAUTHORITY_REALM_NAME, "IUSR", "IIS Default Account"))
.put("S-1-5-18", new WellKnownSidInfo(true, "S-1-5", NTAUTHORITY_REALM_NAME, "SYSTEM", "Local System Account"))
.put("S-1-5-19", new WellKnownSidInfo(true, "S-1-5", NTAUTHORITY_REALM_NAME, "LOCAL SERVICE", "Local Service Account"))
.put("S-1-5-20", new WellKnownSidInfo(true, "S-1-5", NTAUTHORITY_REALM_NAME, "NETWORK SERVICE", "Network Service Account"))
diff --git a/db_diff/tskdbdiff.py b/db_diff/tskdbdiff.py
index 01ff0b9f3b35db13e2b6ef518c11f71df78846ff..ea649cd85a52ed8ffa6b07a4c6a8f8410adb665a 100644
--- a/db_diff/tskdbdiff.py
+++ b/db_diff/tskdbdiff.py
@@ -999,18 +999,27 @@ def normalize_tsk_objects_path(guid_util: TskGuidUtils, objid: int,
path_parts = path_parts[:-1]
if path_parts and len(path_parts) >= 2:
- for idx in range(0, len(path_parts) - 1):
- if path_parts[idx].lower() == "reports" and \
- path_parts[idx + 1].lower().startswith("autopsytestcase html report"):
- path_parts = ["Reports", "AutopsyTestCase HTML Report"]
- break
- if path_parts[idx].lower() == "reports" and \
- "html report" in path_parts[idx + 1].lower() and \
- len(path_parts) > idx + 2 and \
- path_parts[idx + 2].lower().endswith("report.html"):
- path_parts = ["Reports", "html-report.html"]
+ is_leapp = False
+ for leapp_module in ['aleapp', 'ileapp']:
+ if len(path_parts) > 0 and path_parts[1].lower() == leapp_module and \
+ path_parts[-1].lower() == 'index.html':
+ path_parts = ['ModuleOutput', leapp_module, 'index.html']
+ is_leapp = True
break
+ if not is_leapp:
+ for idx in range(0, len(path_parts) - 1):
+ if path_parts[idx].lower() == "reports" and \
+ path_parts[idx + 1].lower().startswith("autopsytestcase html report"):
+ path_parts = ["Reports", "AutopsyTestCase HTML Report"]
+ break
+ if path_parts[idx].lower() == "reports" and \
+ "html report" in path_parts[idx + 1].lower() and \
+ len(path_parts) > idx + 2 and \
+ path_parts[idx + 2].lower().endswith("report.html"):
+ path_parts = ["Reports", "html-report.html"]
+ break
+
path = os.path.join(*path_parts) if len(path_parts) > 0 else '/'
return path
diff --git a/tsk/auto/auto.cpp b/tsk/auto/auto.cpp
index b2438376b99f2588cf2566a9f71f4a00f20a725b..89243df85f7cc293b9947b907d65de4016b3c9ae 100755
--- a/tsk/auto/auto.cpp
+++ b/tsk/auto/auto.cpp
@@ -507,10 +507,6 @@ TskAuto::findFilesInPool(TSK_OFF_T start, TSK_POOL_TYPE_ENUM ptype)
"findFilesInPool: Error opening APFS file system");
registerError();
}
-
- tsk_img_close(pool_img);
- tsk_pool_close(pool);
- return TSK_ERR;
}
tsk_img_close(pool_img);