From 5fda7409eb4aabaeff611ea7a6b31eaff6cfd5a0 Mon Sep 17 00:00:00 2001
From: David McDonald <dgmcdona@uno.edu>
Date: Thu, 3 Apr 2025 17:09:02 -0500
Subject: [PATCH] Log `InvalidAddressException` instances

---
 .../symbols/windows/extensions/mft.py         | 23 +++++++++++++++----
 1 file changed, 19 insertions(+), 4 deletions(-)

diff --git a/volatility3/framework/symbols/windows/extensions/mft.py b/volatility3/framework/symbols/windows/extensions/mft.py
index 90ce6b6f2..4c5be81ee 100644
--- a/volatility3/framework/symbols/windows/extensions/mft.py
+++ b/volatility3/framework/symbols/windows/extensions/mft.py
@@ -2,10 +2,13 @@
 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
 #
 
+import logging
 from typing import Dict, Iterator, List, Optional, Tuple
 
 from volatility3.framework import constants, exceptions, interfaces, objects
 
+vollog = logging.getLogger(__name__)
+
 
 class MFTEntry(objects.StructType):
     """This represents the base MFT Record"""
@@ -88,7 +91,10 @@ class MFTEntry(objects.StructType):
                     offset=self.vol.offset + attr_base_offset,
                     layer_name=self.vol.layer_name,
                 )
-        except exceptions.InvalidAddressException:
+        except exceptions.InvalidAddressException as e:
+            vollog.debug(
+                f"Failed to read attribute at {attr.vol.offset:#x}: {e.__class__.__name__}"
+            )
             return
 
     def standard_information_attributes(self) -> Iterator[objects.StructType]:
@@ -110,7 +116,10 @@ class MFTEntry(objects.StructType):
 
                 fn_object = self.symbol_table_name + constants.BANG + "FILE_NAME_ENTRY"
                 attr_data = attr.Attr_Data.cast(fn_object)
-            except exceptions.InvalidAddressException:
+            except exceptions.InvalidAddressException as e:
+                vollog.debug(
+                    f"Failed to read attr at {attr.vol.offset:#x}: {e.__class__.__name__}"
+                )
                 continue
             yield attr_data
 
@@ -168,7 +177,10 @@ class MFTAttribute(objects.StructType):
                 encoding="utf16",
             )
             return name
-        except exceptions.InvalidAddressException:
+        except exceptions.InvalidAddressException as e:
+            vollog.debug(
+                f"Failed to get resident file content due to {e.__class__.__name__}"
+            )
             return None
 
     def get_resident_filecontent(self) -> Optional[objects.Bytes]:
@@ -190,5 +202,8 @@ class MFTAttribute(objects.StructType):
                 length=self.Attr_Header.ContentLength,
             )
             return bytesobj
-        except exceptions.InvalidAddressException:
+        except exceptions.InvalidAddressException as e:
+            vollog.debug(
+                f"Failed to get resident file content due to {e.__class__.__name__}"
+            )
             return None