fix USNParser if metaAddr or USN sequence are negative values

sepinf-inc · Mar 26, 2021 · 247e605 · 247e605
1 parent caae5de
commit 247e605
Showing 1 changed file with 11 additions and 5 deletions.
diff --git a/iped-parsers/iped-parsers-impl/src/main/java/dpf/inc/sepinf/UsnJrnl/UsnJrnlParser.java b/iped-parsers/iped-parsers-impl/src/main/java/dpf/inc/sepinf/UsnJrnl/UsnJrnlParser.java
@@ -268,11 +268,15 @@ private void rebuildFullPaths(List<UsnJrnlEntry> entries, IItemSearcher searcher
             parentRefs.add(entry.getParentMftRefAsLong());
         }
         for (Long parentRef : parentRefs) {
-            query.append("(");
-            query.append(BasicProps.META_ADDRESS + ":" + (parentRef.longValue() & 0xFFFFFFFFFFFFl));
-            query.append(" && ");
-            query.append(BasicProps.MFT_SEQUENCE + ":" + (parentRef.longValue() >> 48));
-            query.append(") ");
+            long metaAddr = parentRef.longValue() & 0xFFFFFFFFFFFFl;
+            long metaSeq = parentRef.longValue() >> 48;
+            if (metaAddr >= 0 && metaSeq >= 0) {
+                query.append("(");
+                query.append(BasicProps.META_ADDRESS + ":" + metaAddr);
+                query.append(" && ");
+                query.append(BasicProps.MFT_SEQUENCE + ":" + metaSeq);
+                query.append(") ");
+            }
         }
         query.append(")");
         List<IItemBase> parents = searcher.search(query.toString());
@@ -289,6 +293,8 @@ private void rebuildFullPaths(List<UsnJrnlEntry> entries, IItemSearcher searcher
                 entry.setFullPath(parent.getPath() + "/" + entry.getFileName());
             }
         }
+
+        String a = "evidenceUUID:d78c007d-c88a-4660-96cd-15dc3e170dae && fileSystemId:null && ((metaAddress:190495 && MFTSequence:29) (metaAddress:190495 && MFTSequence:28) (metaAddress:143369 && MFTSequence:9) (metaAddress:190495 && MFTSequence:30) (metaAddress:75782 && MFTSequence:3) (metaAddress:190495 && MFTSequence:27) (metaAddress:77320 && MFTSequence:2) (metaAddress:207916 && MFTSequence:36) (metaAddress:118839 && MFTSequence:61) (metaAddress:141380 && MFTSequence:74) (metaAddress:104582 && MFTSequence:139) (metaAddress:113718 && MFTSequence:57) (metaAddress:78519 && MFTSequence:185) (metaAddress:75803 && MFTSequence:8) (metaAddress:104582 && MFTSequence:148) (metaAddress:51222 && MFTSequence:1) (metaAddress:51429 && MFTSequence:-14094) (metaAddress:216602 && MFTSequence:1) (metaAddress:207915 && MFTSequence:48) (metaAddress:51289 && MFTSequence:64) (metaAddress:323125 && MFTSequence:43) (metaAddress:141374 && MFTSequence:30) (metaAddress:44073 && MFTSequence:5) (metaAddress:161325 && MFTSequence:1) (metaAddress:169994 && MFTSequence:56) (metaAddress:141366 && MFTSequence:13) (metaAddress:56 && MFTSequence:5) (metaAddress:212049 && MFTSequence:18) (metaAddress:207440 && MFTSequence:18) (metaAddress:207440 && MFTSequence:17) (metaAddress:161351 && MFTSequence:6) (metaAddress:54856 && MFTSequence:14) (metaAddress:169963 && MFTSequence:430) (metaAddress:141382 && MFTSequence:16) (metaAddress:209477 && MFTSequence:19) (metaAddress:201832 && MFTSequence:48) (metaAddress:199276 && MFTSequence:9) (metaAddress:110204 && MFTSequence:26) (metaAddress:207478 && MFTSequence:25) (metaAddress:207476 && MFTSequence:26) (metaAddress:126044 && MFTSequence:51) (metaAddress:151630 && MFTSequence:35) (metaAddress:207478 && MFTSequence:26) (metaAddress:146969 && MFTSequence:619) (metaAddress:334458 && MFTSequence:6) (metaAddress:207972 && MFTSequence:30) (metaAddress:207476 && MFTSequence:13) (metaAddress:207972 && MFTSequence:29) (metaAddress:353912 && MFTSequence:6) (metaAddress:194653 && MFTSequence:33) (metaAddress:3203 && MFTSequence:1) (metaAddress:3202 && MFTSequence:1) (metaAddress:153802 && MFTSequence:76) (metaAddress:353922 && MFTSequence:2) (metaAddress:90243 && MFTSequence:5) (metaAddress:64735 && MFTSequence:83) (metaAddress:336015 && MFTSequence:4) (metaAddress:335503 && MFTSequence:5) (metaAddress:109200 && MFTSequence:1) (metaAddress:18578 && MFTSequence:3) (metaAddress:87701 && MFTSequence:6) (metaAddress:87699 && MFTSequence:6) (metaAddress:87708 && MFTSequence:6) (metaAddress:207489 && MFTSequence:39) (metaAddress:212128 && MFTSequence:11) (metaAddress:207489 && MFTSequence:43) (metaAddress:110212 && MFTSequence:42) (metaAddress:212128 && MFTSequence:12) (metaAddress:207489 && MFTSequence:45) (metaAddress:64181 && MFTSequence:6) (metaAddress:335541 && MFTSequence:9) (metaAddress:78010 && MFTSequence:1) (metaAddress:115386 && MFTSequence:1) (metaAddress:78011 && MFTSequence:1) (metaAddress:207529 && MFTSequence:22) (metaAddress:207529 && MFTSequence:23) (metaAddress:76989 && MFTSequence:3) (metaAddress:207529 && MFTSequence:21) (metaAddress:99015 && MFTSequence:5) (metaAddress:87744 && MFTSequence:9) (metaAddress:78025 && MFTSequence:1) (metaAddress:78026 && MFTSequence:1) (metaAddress:213229 && MFTSequence:32) (metaAddress:213235 && MFTSequence:35) (metaAddress:213210 && MFTSequence:10) (metaAddress:213210 && MFTSequence:13) (metaAddress:213235 && MFTSequence:38) (metaAddress:213235 && MFTSequence:40) (metaAddress:213235 && MFTSequence:41) (metaAddress:213230 && MFTSequence:13) (metaAddress:213226 && MFTSequence:9) (metaAddress:213231 && MFTSequence:12) (metaAddress:213234 && MFTSequence:16) (metaAddress:213231 && MFTSequence:13) (metaAddress:213230 && MFTSequence:15) (metaAddress:213231 && MFTSequence:14) (metaAddress:213230 && MFTSequence:14) (metaAddress:213226 && MFTSequence:10) (metaAddress:213232 && MFTSequence:16) (metaAddress:213228 && MFTSequence:11) (metaAddress:213229 && MFTSequence:11) (metaAddress:213226 && MFTSequence:12) (metaAddress:75502 && MFTSequence:9) (metaAddress:213231 && MFTSequence:11) (metaAddress:76011 && MFTSequence:3) (metaAddress:213223 && MFTSequence:8) (metaAddress:213229 && MFTSequence:30) (metaAddress:213240 && MFTSequence:11) (metaAddress:199878 && MFTSequence:52) (metaAddress:213240 && MFTSequence:10) (metaAddress:213241 && MFTSequence:11) (metaAddress:213239 && MFTSequence:6) (metaAddress:213241 && MFTSequence:8) (metaAddress:213240 && MFTSequence:9) (metaAddress:213242 && MFTSequence:11) (metaAddress:213239 && MFTSequence:7) (metaAddress:213229 && MFTSequence:29) (metaAddress:213240 && MFTSequence:8) (metaAddress:213242 && MFTSequence:10) (metaAddress:213243 && MFTSequence:11) (metaAddress:213245 && MFTSequence:10) (metaAddress:213246 && MFTSequence:9) (metaAddress:213233 && MFTSequence:7) (metaAddress:213225 && MFTSequence:28) (metaAddress:213240 && MFTSequence:13) (metaAddress:213245 && MFTSequence:9) (metaAddress:213246 && MFTSequence:10) (metaAddress:213247 && MFTSequence:11) (metaAddress:153812 && MFTSequence:46) (metaAddress:213227 && MFTSequence:16) (metaAddress:213245 && MFTSequence:6) (metaAddress:207938 && MFTSequence:185) (metaAddress:213244 && MFTSequence:7) (metaAddress:213232 && MFTSequence:10) (metaAddress:213245 && MFTSequence:7) (metaAddress:207938 && MFTSequence:184) (metaAddress:213238 && MFTSequence:12) (metaAddress:213234 && MFTSequence:11) (metaAddress:213227 && MFTSequence:18) (metaAddress:213234 && MFTSequence:10) (metaAddress:213245 && MFTSequence:5) (metaAddress:213246 && MFTSequence:6) (metaAddress:213233 && MFTSequence:9) (metaAddress:213238 && MFTSequence:14) (metaAddress:213237 && MFTSequence:13) (metaAddress:213236 && MFTSequence:12) (metaAddress:213238 && MFTSequence:9) (metaAddress:213242 && MFTSequence:5) (metaAddress:213234 && MFTSequence:13) (metaAddress:213227 && MFTSequence:20) (metaAddress:213237 && MFTSequence:10) (metaAddress:213236 && MFTSequence:11) (metaAddress:213240 && MFTSequence:6) (metaAddress:213232 && MFTSequence:14) (metaAddress:213237 && MFTSequence:11) (metaAddress:213243 && MFTSequence:6) (metaAddress:213237 && MFTSequence:8) (metaAddress:213234 && MFTSequence:15) (metaAddress:213242 && MFTSequence:6) (metaAddress:213234 && MFTSequence:14) (metaAddress:213239 && MFTSequence:11) (metaAddress:105216 && MFTSequence:1) (metaAddress:105217 && MFTSequence:1) (metaAddress:213252 && MFTSequence:6) (metaAddress:213252 && MFTSequence:5) (metaAddress:213252 && MFTSequence:4) (metaAddress:213255 && MFTSequence:7) (metaAddress:91396 && MFTSequence:3) (metaAddress:213249 && MFTSequence:4) (metaAddress:213250 && MFTSequence:7) (metaAddress:213249 && MFTSequence:5) (metaAddress:359180 && MFTSequence:1) (metaAddress:213261 && MFTSequence:6) (metaAddress:213262 && MFTSequence:5) (metaAddress:213260 && MFTSequence:5) (metaAddress:213253 && MFTSequence:10) (metaAddress:213291 && MFTSequence:36) (metaAddress:213259 && MFTSequence:6) (metaAddress:213256 && MFTSequence:5) (metaAddress:213253 && MFTSequence:9) (metaAddress:213278 && MFTSequence:13) (metaAddress:213274 && MFTSequence:8) (metaAddress:213270 && MFTSequence:7) (metaAddress:213273 && MFTSequence:9) (metaAddress:213265 && MFTSequence:6) (metaAddress:213266 && MFTSequence:5) (metaAddress:213279 && MFTSequence:8) (metaAddress:213263 && MFTSequence:20) (metaAddress:213277 && MFTSequence:6) (metaAddress:213271 && MFTSequence:9) (metaAddress:209197 && MFTSequence:15) (metaAddress:101716 && MFTSequence:112) (metaAddress:213280 && MFTSequence:6) (metaAddress:213301 && MFTSequence:30) (metaAddress:213306 && MFTSequence:16) (metaAddress:213282 && MFTSequence:8) (metaAddress:213301 && MFTSequence:28) (metaAddress:213281 && MFTSequence:8) (metaAddress:210744 && MFTSequence:17) (metaAddress:213286 && MFTSequence:9) (metaAddress:213296 && MFTSequence:31) (metaAddress:213307 && MFTSequence:21) (metaAddress:213296 && MFTSequence:29) (metaAddress:213307 && MFTSequence:22) (metaAddress:213285 && MFTSequence:9) (metaAddress:213311 && MFTSequence:12) (metaAddress:213309 && MFTSequence:12) (metaAddress:173848 && MFTSequence:41) (metaAddress:213305 && MFTSequence:14) (metaAddress:210744 && MFTSequence:15) (metaAddress:213309 && MFTSequence:11) (metaAddress:213311 && MFTSequence:10) (metaAddress:213310 && MFTSequence:11) (metaAddress:213310 && MFTSequence:10) (metaAddress:13348 && MFTSequence:798) (metaAddress:207655 && MFTSequence:30) (metaAddress:13348 && MFTSequence:799) (metaAddress:213299 && MFTSequence:12) (metaAddress:213302 && MFTSequence:9) (metaAddress:207183 && MFTSequence:12) (metaAddress:212836 && MFTSequence:37) (metaAddress:75759 && MFTSequence:1197) (metaAddress:213322 && MFTSequence:10) (metaAddress:21017 && MFTSequence:346) (metaAddress:2885 && MFTSequence:1) (metaAddress:213320 && MFTSequence:15) (metaAddress:213325 && MFTSequence:10) (metaAddress:213327 && MFTSequence:8) (metaAddress:213320 && MFTSequence:14) (metaAddress:202578 && MFTSequence:22) (metaAddress:213324 && MFTSequence:8) (metaAddress:208740 && MFTSequence:32) (metaAddress:213314 && MFTSequence:9) (metaAddress:213324 && MFTSequence:7) (metaAddress:213312 && MFTSequence:10) (metaAddress:331 && MFTSequence:1) (metaAddress:213314 && MFTSequence:10) (metaAddress:333 && MFTSequence:1) (metaAddress:332 && MFTSequence:1) (metaAddress:213319 && MFTSequence:11) (metaAddress:213323 && MFTSequence:7) (metaAddress:64058 && MFTSequence:362) (metaAddress:64058 && MFTSequence:360) (metaAddress:64058 && MFTSequence:361) (metaAddress:213317 && MFTSequence:18) (metaAddress:13603 && MFTSequence:116) (metaAddress:213317 && MFTSequence:17) (metaAddress:335705 && MFTSequence:4) (metaAddress:212840 && MFTSequence:51) (metaAddress:212840 && MFTSequence:50) (metaAddress:357215 && MFTSequence:1) (metaAddress:213321 && MFTSequence:22) (metaAddress:213321 && MFTSequence:23) (metaAddress:212846 && MFTSequence:12) (metaAddress:212847 && MFTSequence:13) (metaAddress:13152 && MFTSequence:2) (metaAddress:212843 && MFTSequence:12) (metaAddress:212844 && MFTSequence:10) (metaAddress:212843 && MFTSequence:13) (metaAddress:212848 && MFTSequence:21) (metaAddress:357217 && MFTSequence:3) (metaAddress:357219 && MFTSequence:1) (metaAddress:212847 && MFTSequence:11) (metaAddress:212839 && MFTSequence:12) (metaAddress:212835 && MFTSequence:12) (metaAddress:357225 && MFTSequence:1) (metaAddress:213300 && MFTSequence:90) (metaAddress:212835 && MFTSequence:13) (metaAddress:213344 && MFTSequence:12) (metaAddress:75632 && MFTSequence:1) (metaAddress:75634 && MFTSequence:1) (metaAddress:19325 && MFTSequence:5) (metaAddress:208740 && MFTSequence:31) (metaAddress:210287 && MFTSequence:21) (metaAddress:197446 && MFTSequence:63) (metaAddress:212842 && MFTSequence:19) (metaAddress:210287 && MFTSequence:23) (metaAddress:212842 && MFTSequence:18) (metaAddress:189286 && MFTSequence:24) (metaAddress:210259 && MFTSequence:44) (metaAddress:212841 && MFTSequence:23) (metaAddress:189286 && MFTSequence:25) (metaAddress:51069 && MFTSequence:3) (metaAddress:189286 && MFTSequence:26) (metaAddress:189286 && MFTSequence:27) (metaAddress:13189 && MFTSequence:2) (metaAddress:104896 && MFTSequence:73) (metaAddress:76170 && MFTSequence:2) (metaAddress:18235 && MFTSequence:181) (metaAddress:178579 && MFTSequence:30) (metaAddress:173959 && MFTSequence:36) (metaAddress:139183 && MFTSequence:14) (metaAddress:178565 && MFTSequence:35) (metaAddress:114623 && MFTSequence:27) (metaAddress:91404 && MFTSequence:170) (metaAddress:104344 && MFTSequence:49) (metaAddress:347055 && MFTSequence:2) (metaAddress:104344 && MFTSequence:48) (metaAddress:210874 && MFTSequence:16) (metaAddress:104344 && MFTSequence:50) (metaAddress:213316 && MFTSequence:236) (metaAddress:428 && MFTSequence:2) (metaAddress:357303 && MFTSequence:1) (metaAddress:358332 && MFTSequence:1) (metaAddress:441 && MFTSequence:2) (metaAddress:210356 && MFTSequence:12) (metaAddress:357305 && MFTSequence:1) (metaAddress:210865 && MFTSequence:15) (metaAddress:444 && MFTSequence:2) (metaAddress:449 && MFTSequence:2) (metaAddress:357313 && MFTSequence:1) (metaAddress:357315 && MFTSequence:1) (metaAddress:161245 && MFTSequence:3) (metaAddress:75741 && MFTSequence:52) (metaAddress:213297 && MFTSequence:219) (metaAddress:64288 && MFTSequence:206) (metaAddress:64288 && MFTSequence:207) (metaAddress:213297 && MFTSequence:221) (metaAddress:64288 && MFTSequence:208) (metaAddress:64288 && MFTSequence:209) (metaAddress:64288 && MFTSequence:210) (metaAddress:75726 && MFTSequence:60) (metaAddress:3071 && MFTSequence:1) (metaAddress:126326 && MFTSequence:137) )";
     }
 
 }