diff --git a/bindings/java/jni/auto_db_java.cpp b/bindings/java/jni/auto_db_java.cpp index 033f28e07fa6b1f42f49a3ba2735ed53d5f631b6..e0e9afb5c461628fb1215d11a3bb40305b611cd6 100644 --- a/bindings/java/jni/auto_db_java.cpp +++ b/bindings/java/jni/auto_db_java.cpp @@ -482,7 +482,9 @@ TSK_RETVAL_ENUM TskAutoDbJava::createJString(const char * input, jstring & newJS if (tsk_UTF8toUTF16((const UTF8 **)&source, (const UTF8 *)&source[input_len], &target, &target[input_len], TSKlenientConversion) != TSKconversionOK) { free(utf16_input); - return TSK_ERR; + // use default JNI method as fallback, fixes https://github.com/sleuthkit/sleuthkit/issues/2723 + newJString = m_jniEnv->NewStringUTF(input); + return TSK_OK; } /* diff --git a/bindings/java/src/org/sleuthkit/datamodel/Pool.java b/bindings/java/src/org/sleuthkit/datamodel/Pool.java index 417bf0c7f1ed6647eec15caa6b26cd9f78f2f1f2..98681759fd86791e7152ca2de1a0247113d7b737 100644 --- a/bindings/java/src/org/sleuthkit/datamodel/Pool.java +++ b/bindings/java/src/org/sleuthkit/datamodel/Pool.java @@ -114,7 +114,13 @@ private long getPoolOffset(Image image) throws TskCoreException { } else if (this.getParent() instanceof Volume) { // If the parent is a volume, then the pool starts at the volume offset Volume parent = (Volume)this.getParent(); - return parent.getStart() * image.getSsize(); // Offset needs to be in bytes + if (parent.getParent() instanceof VolumeSystem) { + // uses block size from parent volume system + return parent.getStart() * ((VolumeSystem) parent.getParent()).getBlockSize(); // Offset needs to be in bytes + } else { + // uses sector size from parent image (old behavior fallback) + return parent.getStart() * image.getSsize(); // Offset needs to be in bytes + } } throw new TskCoreException("Pool with object ID " + this.getId() + " does not have Image or Volume parent"); } diff --git a/bindings/java/src/org/sleuthkit/datamodel/TskCaseDbBridge.java b/bindings/java/src/org/sleuthkit/datamodel/TskCaseDbBridge.java index a161ecc40a0ee244f9de92528f82b7e5bec37a7a..0da8c2a846cca449749b58250e49aa0482d6315d 100644 --- a/bindings/java/src/org/sleuthkit/datamodel/TskCaseDbBridge.java +++ b/bindings/java/src/org/sleuthkit/datamodel/TskCaseDbBridge.java @@ -396,6 +396,10 @@ private long addBatchedFilesToDb() { } catch (NotUserSIDException ex) { // if the owner SID is not a user SID, set the owner account to null ownerIdToAccountMap.put(ownerUid, null); + } catch (Exception ex) { + // catch other exceptions to avoid skiping add batched files loop below + logger.log(Level.WARNING, "Error mapping ownerId " + ownerUid + " to account", ex); + ownerIdToAccountMap.put(ownerUid, null); } } } @@ -484,7 +488,7 @@ private long addBatchedFilesToDb() { // Exception firewall to prevent unexpected return to the native code logger.log(Level.SEVERE, "Unexpected error from files added callback", ex); } - } catch (TskCoreException ex) { + } catch (Throwable ex) { logger.log(Level.SEVERE, "Error adding batched files to database", ex); revertTransaction(); return -1; diff --git a/bindings/java/src/org/sleuthkit/datamodel/WindowsAccountUtils.java b/bindings/java/src/org/sleuthkit/datamodel/WindowsAccountUtils.java index ee4e8ff9e2dc4c4c4205a591c649952237ef481f..28a92ca920e1754e4cf89281ac607c6a79d30e55 100644 --- a/bindings/java/src/org/sleuthkit/datamodel/WindowsAccountUtils.java +++ b/bindings/java/src/org/sleuthkit/datamodel/WindowsAccountUtils.java @@ -170,6 +170,7 @@ public String getDescription() { // - We can assume and fill in SID from given account name, and vice versa. // - We map account names in foreign languages (some known set) to english names, for these well known accounts. private static final Map<String, WellKnownSidInfo> SPECIAL_SIDS_MAP = ImmutableMap.<String, WellKnownSidInfo>builder() + .put("S-1-5-17", new WellKnownSidInfo(true, "S-1-5", NTAUTHORITY_REALM_NAME, "IUSR", "IIS Default Account")) .put("S-1-5-18", new WellKnownSidInfo(true, "S-1-5", NTAUTHORITY_REALM_NAME, "SYSTEM", "Local System Account")) .put("S-1-5-19", new WellKnownSidInfo(true, "S-1-5", NTAUTHORITY_REALM_NAME, "LOCAL SERVICE", "Local Service Account")) .put("S-1-5-20", new WellKnownSidInfo(true, "S-1-5", NTAUTHORITY_REALM_NAME, "NETWORK SERVICE", "Network Service Account")) diff --git a/tsk/auto/auto.cpp b/tsk/auto/auto.cpp index b2438376b99f2588cf2566a9f71f4a00f20a725b..89243df85f7cc293b9947b907d65de4016b3c9ae 100755 --- a/tsk/auto/auto.cpp +++ b/tsk/auto/auto.cpp @@ -507,10 +507,6 @@ TskAuto::findFilesInPool(TSK_OFF_T start, TSK_POOL_TYPE_ENUM ptype) "findFilesInPool: Error opening APFS file system"); registerError(); } - - tsk_img_close(pool_img); - tsk_pool_close(pool); - return TSK_ERR; } tsk_img_close(pool_img);