Skip to content

Shorten per-row Source File paths to extraction-relative (follow-up to #931)#932

Merged
abrignoni merged 1 commit into
mainfrom
row-level-relative-paths
Jul 6, 2026
Merged

Shorten per-row Source File paths to extraction-relative (follow-up to #931)#932
abrignoni merged 1 commit into
mainfrom
row-level-relative-paths

Conversation

@abrignoni

Copy link
Copy Markdown
Owner

Summary

Part 2 of the source-path fix. #931 shortens the returned source_path centrally in artifact_processor, but as @JamesHabben pointed out, artifacts that drop the path into a per-record Source File column are a separate population the decorator can't reach. This fixes all of them.

Audit method: for every artifact function, locate data_headers entries matching Source File/Path/DB, resolve which appended expression feeds that column index, and classify. Result: 26 flagged → 17 already shortened → 19 true positives in 7 files, all fixed here by wrapping the row-inserted copy with Context.get_relative_path() (the absolute path is still used for file/db access):

  • Life360 (chat messages, places, locations, device battery)
  • SimpleStorage_applaunch
  • battery_usage_v9 (both artifacts)
  • gmailIMAPEmails (emails + accounts)
  • googleChat (all 4 artifacts — this was the leak originally observed in test output)
  • knuddels (chats, contacts, account — including the active_row sources join)
  • thunderbird

Verified false positives, deliberately untouched:

  • FacebookMessenger — already shortens via its module-level _src() helper
  • discreteNative — emits Path(file).name only
  • honorMediaLibrary — its Source File Path/Name columns are device-side paths from gallery.db (evidence data, not examiner paths)

Testing

  • Re-ran the audit after the fix: zero unshortened row-level emitters remain (only the three false positives above)
  • pylint 10.00/10 on all 7 files; byte-compile; PluginLoader registers all 583 plugins
  • get_relative_path passthrough semantics make every wrap safe when data_folder is unset

Follow-up to #931 (which shortens the returned source_path centrally):
these artifacts also place the absolute on-disk path inside a per-record
Source File column, which the decorator cannot see. Wrap each row-inserted
copy with Context.get_relative_path; the absolute path is still used for
file/db access.

Fixed: Life360 (4 artifacts), SimpleStorage_applaunch, battery_usage_v9
(both artifacts), gmailIMAPEmails (emails + accounts), googleChat (all 4
artifacts), knuddels (chats, contacts, account incl. the active_row
sources join), thunderbird.

Verified false positives left as-is: FacebookMessenger (already shortens
via its _src helper), discreteNative (emits basename only),
honorMediaLibrary (Source File Path/Name columns are device-side paths
from the gallery.db evidence, not examiner paths).
@abrignoni abrignoni merged commit 787c262 into main Jul 6, 2026
2 checks passed
@abrignoni abrignoni deleted the row-level-relative-paths branch July 6, 2026 18:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant