mozilla / mig

Distributed & real time digital forensics at the speed of the cloud

Home Page:http://mig.mozilla.org/

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

file matchlimit does not behave as expected

ameihm0912 opened this issue · comments

The matchlimit option to the file module does not appear to behave correctly.

The documentation states once the number of matched files reaches the match limit, the search will be deactivated.

In the code, looks as though it's only checked upon entering a directory. This means if a given directory contains files which will match beyond the matchlimit, the search will continue to scan until the directory is completed walked.

Actually this may not be limited to just a directory change.

In

if stats.Totalhits >= search.Options.MatchLimit {
the total number of hits is compared to the current match limit.

However, stats.Totalhits will always be zero until buildResults is called.

Fixing this may be a bit tricky as the Matchall option makes it difficult to determine if a file is truly considered a hit until all checks are complete.