autopsy icon indicating copy to clipboard operation
autopsy copied to clipboard

PlatformUtil.getPhysicalDrives - improper condition for Mac leading to infinite stalling

Open marian-o opened this issue 4 months ago • 0 comments

Code: https://github.com/sleuthkit/autopsy/blob/develop/Core/src/org/sleuthkit/autopsy/coreutils/PlatformUtil.java#L418 Line:

if ((name.contains("hd") || name.contains("sd") || name.contains("disk")) && f.canRead() && name.length() <= 5) { //NON-NLS

First, name.length() <= 5 is a bad test. It excludes disk12. Should be 7 or more;

On my Apple M3 machine with OSX 15.5 , there is /dev/ttysd, which is a tty device, which blocks if you try to read from it, which is exactly what canReadDrive is trying to do: https://github.com/sleuthkit/autopsy/blob/develop/Core/src/org/sleuthkit/autopsy/coreutils/PlatformUtil.java#L487-L504

To make it work, I changed it to if ((name.contains("disk")) && f.canRead() && name.length() <= 10) { //NON-NLS

Probably it's worth splitting that test into 3 branches: Windows (already done), Linux (probably preserve the current condition, except name.length() <= 5) and Mac, where I recommend filtering to "starts with disk or rdisk".

marian-o avatar Jun 14 '25 04:06 marian-o