Log InvalidAddressException instances

volatility3/framework/symbols/windows/extensions/mft.py

@@ -2,10 +2,13 @@
 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
 #
 
+import logging
 from typing import Dict, Iterator, List, Optional, Tuple
 
 from volatility3.framework import constants, exceptions, interfaces, objects
 
+vollog = logging.getLogger(__name__)
+
 
 class MFTEntry(objects.StructType):
     """This represents the base MFT Record"""
@@ -88,7 +91,10 @@ class MFTEntry(objects.StructType):
                     offset=self.vol.offset + attr_base_offset,
                     layer_name=self.vol.layer_name,
                 )
-        except exceptions.InvalidAddressException:
+        except exceptions.InvalidAddressException as e:
+            vollog.debug(
+                f"Failed to read attribute at {attr.vol.offset:#x}: {e.__class__.__name__}"
+            )
             return
 
     def standard_information_attributes(self) -> Iterator[objects.StructType]:
@@ -110,7 +116,10 @@ class MFTEntry(objects.StructType):
 
                 fn_object = self.symbol_table_name + constants.BANG + "FILE_NAME_ENTRY"
                 attr_data = attr.Attr_Data.cast(fn_object)
-            except exceptions.InvalidAddressException:
+            except exceptions.InvalidAddressException as e:
+                vollog.debug(
+                    f"Failed to read attr at {attr.vol.offset:#x}: {e.__class__.__name__}"
+                )
                 continue
             yield attr_data
 
@@ -168,7 +177,10 @@ class MFTAttribute(objects.StructType):
                 encoding="utf16",
             )
             return name
-        except exceptions.InvalidAddressException:
+        except exceptions.InvalidAddressException as e:
+            vollog.debug(
+                f"Failed to get resident file content due to {e.__class__.__name__}"
+            )
             return None
 
     def get_resident_filecontent(self) -> Optional[objects.Bytes]:
@@ -190,5 +202,8 @@ class MFTAttribute(objects.StructType):
                 length=self.Attr_Header.ContentLength,
             )
             return bytesobj
-        except exceptions.InvalidAddressException:
+        except exceptions.InvalidAddressException as e:
+            vollog.debug(
+                f"Failed to get resident file content due to {e.__class__.__name__}"
+            )
             return None