ydkhatri / mac_apt

macOS (& ios) Artifact Parsing Tool

Home Page:https://swiftforensics.com

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

mac_info.IsValidFolderPath() always returns False?

mnrkbys opened this issue · comments

Has the behavior of mac_info.IsValidFolderPath() changed?
IsValidFolderPath() always returns False whether I give it the correct path that exists in the disk image or the wrong path.
As a result, the CFURLCACHE and CHROME plugins will not work properly.

I have modified CFURLCACHE plugin to test it like below:
test code

The result:

MAIN.CFURLCACHE-INFO-/Users/macforensics/Library/Caches/ is NOT valid.
MAIN.CFURLCACHE-INFO-/Users/macforensics/Library/Caches/ZZZZ is NOT valid.
MAIN.CFURLCACHE-INFO-/Users/Guest/Library/Caches/ is NOT valid.
MAIN.CFURLCACHE-INFO-/Users/Guest/Library/Caches/ZZZZ is NOT valid.

I confirmed that cache folders are existed.
APFS_Volumes

That is certainly weird, I would think a lot of things would break if that didn't work. Can you try without the trailing /
So test for existence of /Users/macforensics/Library/Caches instead of /Users/macforensics/Library/Caches/

If that works, that is a silly bug which I can fix easily.

I've checked with the code below:
changed test code

The result is correct!!

MAIN.CFURLCACHE-INFO-/Users/macforensics/Library/Caches/ is valid.
MAIN.CFURLCACHE-INFO-/Users/Guest/Library/Caches/ is valid.