Keep case-variant evidence files when the report volume folds case - #140
Open
forest-savage1234 wants to merge 1 commit into
Open
Keep case-variant evidence files when the report volume folds case#140forest-savage1234 wants to merge 1 commit into
forest-savage1234 wants to merge 1 commit into
Conversation
Seeker dest-guard only (volume probe + ~caseN). Not an artifact. Closes abrignoni#131. Signed-off-by: Forest Savage <forestsavage03@gmail.com>
This was referenced Aug 23, 2026
Author
|
Thank you for the time on this review. This only keeps case-variant evidence files when the report volume folds case. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Keep case-variant evidence files when the report volume folds case
Same dest-guard as the sibling LEAPP seekers. Seeker only. Not an artifact. Please land this with the other three so the seekers stay level.
Closes #131.
Summary
self.copiedis keyed by the source path. The report destination is built from that path. On a case-insensitive report volume,com.apple.MobileSMS.plistandcom.apple.mobileSMS.plistare two sources and one destination. The second write silently destroys the first.This PR does only the seeker dest-guard named on the issue:
Aa/aA; do not trustos.path.normcase).name~caseN.extinstead of overwriting.file_infosand the artifact's source path stay truthful.Validation
Earlier local check on a case-sensitive ext4 volume (dest names folded to stand in for Windows / stock macOS): two sources plus one folded dest left one file. The dest-guard kept both; the second dest is
*~case2.plist. The volume probe left no leftover probe names. This is not an artifact change, so the artifact report checkers were not run.Files
scripts/search_files.py(seeker dest-guard only)Touched write sites: FileSeekerDir, FileSeekerTar, FileSeekerZip, FileSeekerFile.
Out of scope
os.path.normcasematching of search patternsHow to review
On a case-insensitive report volume, search a zip that holds both
com.apple.MobileSMS.plistandcom.apple.mobileSMS.plist.data/should keep two files (the second named*~case2.plist). Case-sensitive volumes should be unchanged: the probe sees two files and never mints~caseN.I am a volunteer. Thank you for the time. I am trying to become more useful on this work, so I welcome a critical look. If this is the wrong cut, or you want me to stand down, say so and I will recut from notes.