diff --git a/volatility3/framework/plugins/linux/pagecache.py b/volatility3/framework/plugins/linux/pagecache.py index 29883cb9e..6d9b0c69b 100644 --- a/volatility3/framework/plugins/linux/pagecache.py +++ b/volatility3/framework/plugins/linux/pagecache.py @@ -790,13 +790,34 @@ class RecoverFs(plugins.PluginInterface): visited_paths = seen_prefixes = set() for inode_in in inodes_iter: + + # Code is slightly duplicated here with the if-block below. + # However this prevents unneeded tar manipulation if fifo + # or sock inodes comes through for example. + if not ( + inode_in.inode.is_reg or inode_in.inode.is_dir or inode_in.inode.is_link + ): + continue + + if not inode_in.path.startswith("/"): + vollog.debug( + f'Skipping processing of potentially smeared "{inode_in.path}" inode name as it does not starts with a "/".' + ) + continue + + # Construct the output path if uuid_as_prefix: prefix = f"/{inode_in.superblock.uuid}" else: prefix = f"/{inode_in.superblock.major}:{inode_in.superblock.minor}" prefixed_path = prefix + inode_in.path + # Sanity check for already processed paths if prefixed_path in visited_paths: + vollog.log( + constants.LOGLEVEL_VV, + f'Already processed prefixed inode path: "{prefixed_path}".', + ) continue elif prefix not in seen_prefixes: self._tar_add_dir(tar, prefix, mtime)