diff --git a/volatility3/framework/automagic/symbol_cache.py b/volatility3/framework/automagic/symbol_cache.py index 22f1c94f34..5541d552eb 100644 --- a/volatility3/framework/automagic/symbol_cache.py +++ b/volatility3/framework/automagic/symbol_cache.py @@ -312,11 +312,18 @@ def update(self, progress_callback=None): # Missing entries if missing_locations: - self._database.cursor().execute( - f"DELETE FROM cache WHERE location IN ({','.join(['?'] * len(missing_locations))})", - [x for x in missing_locations], - ) - self._database.commit() + for missing_location in missing_locations: + parsed_url = urllib.parse(missing_location) + if ( + parsed_url.scheme == "file" + and parsed_url.host == "" + and not os.path.exists(parsed_url.path) + ): + self._database.cursor().execute( + f"DELETE FROM cache WHERE location IN ({','.join(['?'] * len(missing_locations))})", + [x for x in missing_locations], + ) + self._database.commit() cache_update = set() files_to_timestamp = on_disk_locations.intersection(cached_locations)