Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix AttributeError in syscache plugin #913

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

JazzCore
Copy link
Contributor

@JazzCore JazzCore commented Oct 18, 2024

dissect.ntfs changes probably caused regression in syscache plugin that now raises following AttributeError for me:

$ target-query -q -f syscache  DC1.tar
Traceback (most recent call last):
  File "/home/user/test-venv/bin/target-query", line 8, in <module>
    sys.exit(main())
  File "/home/user/test-venv/lib/python3.9/site-packages/dissect/target/tools/utils.py", line 276, in wrapper
    return func(*args, **kwargs)
  File "/home/user/test-venv/lib/python3.9/site-packages/dissect/target/tools/query.py", line 384, in main
    raise e
  File "/home/user/test-venv/lib/python3.9/site-packages/dissect/target/tools/query.py", line 373, in main
    for record_entries in entry:
  File "/home/user/test-venv/lib/python3.9/site-packages/dissect/target/plugins/os/windows/syscache.py", line 78, in syscache
    full_path = self.target.fs.path("\\".join(["sysvol", mft.mft(file_segment).fullpath()]))
AttributeError: 'Mft' object has no attribute 'mft'

Also when MFT record is missing plugin raises following TypeError, PR also fixes this:

Traceback (most recent call last):
  File "/home/user/test-venv/bin/target-query", line 8, in <module>
    sys.exit(main())
  File "/home/user/test-venv/lib/python3.9/site-packages/dissect/target/tools/utils.py", line 276, in wrapper
    return func(*args, **kwargs)
  File "/home/user/test-venv/lib/python3.9/site-packages/dissect/target/tools/query.py", line 384, in main
    raise e
  File "/home/user/test-venv/lib/python3.9/site-packages/dissect/target/tools/query.py", line 373, in main
    for record_entries in entry:
  File "/home/user/test-venv/lib/python3.9/site-packages/dissect/target/plugins/os/windows/syscache.py", line 81, in syscache
    full_path = self.target.fs.path("\\".join(["sysvol", mft.ntfs.mft(file_segment).full_path()]))
TypeError: sequence item 1: expected str instance, NoneType found

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant