From 54cca5f1f89170ad2118f33ea37cb078109f65c3 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Mon, 9 Sep 2024 09:53:58 +0100 Subject: [PATCH 1/2] Core: Remove files from cache only if they don't exist --- volatility3/framework/automagic/symbol_cache.py | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/volatility3/framework/automagic/symbol_cache.py b/volatility3/framework/automagic/symbol_cache.py index 22f1c94f34..1b8cc74229 100644 --- a/volatility3/framework/automagic/symbol_cache.py +++ b/volatility3/framework/automagic/symbol_cache.py @@ -312,11 +312,13 @@ def update(self, progress_callback=None): # Missing entries if missing_locations: - self._database.cursor().execute( - f"DELETE FROM cache WHERE location IN ({','.join(['?'] * len(missing_locations))})", - [x for x in missing_locations], - ) - self._database.commit() + for missing_location in missing_locations: + if not os.path.exists(missing_location): + self._database.cursor().execute( + f"DELETE FROM cache WHERE location IN ({','.join(['?'] * len(missing_locations))})", + [x for x in missing_locations], + ) + self._database.commit() cache_update = set() files_to_timestamp = on_disk_locations.intersection(cached_locations) From 8785899080e4fe28e61fece148e170697a3542c4 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Thu, 21 Nov 2024 22:51:59 +0000 Subject: [PATCH 2/2] Only remove a file URL with no host and a non-existant path --- volatility3/framework/automagic/symbol_cache.py | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/automagic/symbol_cache.py b/volatility3/framework/automagic/symbol_cache.py index 1b8cc74229..5541d552eb 100644 --- a/volatility3/framework/automagic/symbol_cache.py +++ b/volatility3/framework/automagic/symbol_cache.py @@ -313,7 +313,12 @@ def update(self, progress_callback=None): # Missing entries if missing_locations: for missing_location in missing_locations: - if not os.path.exists(missing_location): + parsed_url = urllib.parse(missing_location) + if ( + parsed_url.scheme == "file" + and parsed_url.host == "" + and not os.path.exists(parsed_url.path) + ): self._database.cursor().execute( f"DELETE FROM cache WHERE location IN ({','.join(['?'] * len(missing_locations))})", [x for x in missing_locations],