From fa25b0b99dc0dcbc41bf63ac68d260d328a3f4e5 Mon Sep 17 00:00:00 2001
From: Luis Nassif <lfcnassif@gmail.com>
Date: Tue, 12 Apr 2022 14:38:46 -0300
Subject: [PATCH] fix #2699: use block size from parent VolumeSystem when
computing offset
---
bindings/java/src/org/sleuthkit/datamodel/Pool.java | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/bindings/java/src/org/sleuthkit/datamodel/Pool.java b/bindings/java/src/org/sleuthkit/datamodel/Pool.java
index 2a6e712e7..261900c0f 100644
--- a/bindings/java/src/org/sleuthkit/datamodel/Pool.java
+++ b/bindings/java/src/org/sleuthkit/datamodel/Pool.java
@@ -114,7 +114,13 @@ private long getPoolOffset(Image image) throws TskCoreException {
} else if (this.getParent() instanceof Volume) {
// If the parent is a volume, then the pool starts at the volume offset
Volume parent = (Volume)this.getParent();
- return parent.getStart() * image.getSsize(); // Offset needs to be in bytes
+ if (parent.getParent() instanceof VolumeSystem) {
+ // uses block size from parent volume system
+ return parent.getStart() * ((VolumeSystem) parent.getParent()).getBlockSize(); // Offset needs to be in bytes
+ } else {
+ // uses sector size from from parent image (old behavior fallback)
+ return parent.getStart() * image.getSsize(); // Offset needs to be in bytes
+ }
}
throw new TskCoreException("Pool with object ID " + this.getId() + " does not have Image or Volume parent");
}
--
GitLab