Shorten per-row Source File paths to extraction-relative (follow-up to #931)#932
Merged
Conversation
Follow-up to #931 (which shortens the returned source_path centrally): these artifacts also place the absolute on-disk path inside a per-record Source File column, which the decorator cannot see. Wrap each row-inserted copy with Context.get_relative_path; the absolute path is still used for file/db access. Fixed: Life360 (4 artifacts), SimpleStorage_applaunch, battery_usage_v9 (both artifacts), gmailIMAPEmails (emails + accounts), googleChat (all 4 artifacts), knuddels (chats, contacts, account incl. the active_row sources join), thunderbird. Verified false positives left as-is: FacebookMessenger (already shortens via its _src helper), discreteNative (emits basename only), honorMediaLibrary (Source File Path/Name columns are device-side paths from the gallery.db evidence, not examiner paths).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Part 2 of the source-path fix. #931 shortens the returned
source_pathcentrally inartifact_processor, but as @JamesHabben pointed out, artifacts that drop the path into a per-record Source File column are a separate population the decorator can't reach. This fixes all of them.Audit method: for every artifact function, locate
data_headersentries matching Source File/Path/DB, resolve which appended expression feeds that column index, and classify. Result: 26 flagged → 17 already shortened → 19 true positives in 7 files, all fixed here by wrapping the row-inserted copy withContext.get_relative_path()(the absolute path is still used for file/db access):active_rowsources join)Verified false positives, deliberately untouched:
_src()helperPath(file).nameonlyTesting
get_relative_pathpassthrough semantics make every wrap safe when data_folder is unset