mac_apt icon indicating copy to clipboard operation
mac_apt copied to clipboard

Published 20 hours ago • verified publisher icon ydkhatri

Spotlight failure

Open cmd-del opened this issue 1 year ago • 4 comments

I keep running to this issue when running the plugin for SPOTLIGHT. I'm running the following command:

mac_apt.exe -o "output destination" aff4 "filename".aff4 ALL

On a handful of the aff4 files I get stuck at the point shown in the attached picture. I've let this run for multiple days with no movement. If I run the proceeding plugins, SPOTLIGHTSHORTCUTS, SUDOLASTRUN,...,...,XPROTECT I have no issues.

Any insight would be greatly appreciated!

IMG_5643

cmd-del avatar Aug 29 '24 03:08 cmd-del

It would be something in those files that is causing a hang. Would it be possible for you to send me the spotlight exported files? They should be in the EXPORT folder. You can email them too.

ydkhatri avatar Aug 29 '24 22:08 ydkhatri

Yes, I've sent them via email, thank you!

cmd-del avatar Aug 30 '24 15:08 cmd-del

Thanks for sharing that sample. I optimised some very slow routines and fixed some other issues too. The main issue was reading of the dbStr files, which was just very slow. It should only take a few seconds now! Try the latest code for these fixes.

Only one store.db file is valid, that will process correctly and quickly now. The other files in the set look to be encrypted/corrupted, and that's why you get the exception on those.

ydkhatri avatar Aug 31 '24 07:08 ydkhatri

Did this fix your issue?

ydkhatri avatar Sep 16 '24 11:09 ydkhatri

Closing for lack of feedback.

ydkhatri avatar Oct 31 '24 23:10 ydkhatri