From 9ceec51b76711419d89ccf5ff1ae0b25a5b36f68 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Mon, 14 Apr 2025 09:11:24 -0500 Subject: [PATCH] Pagecache: Add comments explaining cast Adds a couple of comments explaining why we're doing a lossy conversion to Python `int` (saving memory). --- volatility3/framework/plugins/linux/pagecache.py | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/volatility3/framework/plugins/linux/pagecache.py b/volatility3/framework/plugins/linux/pagecache.py index 7da42255d..87bd20b68 100644 --- a/volatility3/framework/plugins/linux/pagecache.py +++ b/volatility3/framework/plugins/linux/pagecache.py @@ -283,6 +283,10 @@ class Files(plugins.PluginInterface, timeliner.TimeLinerInterface): continue # Inode already processed? + # Store a primitive int (instead of the pointer value) to track + # addresses we've already seen. Storing the full `objects.Pointer` + # uses too much memory, and we don't need all of the information + # that it contains. if int(root_inode_ptr) in seen_inodes: continue @@ -319,6 +323,10 @@ class Files(plugins.PluginInterface, timeliner.TimeLinerInterface): continue # Inode already processed? + # Store a primitive int (instead of the pointer value) to track + # addresses we've already seen. Storing the full `objects.Pointer` + # uses too much memory, and we don't need all of the information + # that it contains. if int(file_inode_ptr) in seen_inodes: continue seen_inodes.add(int(file_inode_ptr))