Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix: cache path for python of Microsoft Store version. #805

Merged

Conversation

digitalisx
Copy link
Contributor

@digitalisx digitalisx commented Aug 4, 2022

Description

Hello, everyone in the community! 🙂
I found something interesting while working on the symbol cache path in a Windows environment.
We are using cache so that volatility3 can quickly find information about Symbol.
And it is usually stored according to the path stored in the constants.

We can see through the log that we use the cache file. (using -vvvv)

DEBUG    volatility3.framework.layers.resources: Using already cached file at: C:\Users\dhyun\AppData\Roaming\volatility3\data_a6f12d9c7c10398e8291aa0f048fc263e301c9d1c7eb3090bd65778d6130915c0e5a3beeaaf5f3be2a57866a49b6343d9eb4aee2b1dc7663dd39138736f3f7c0.cache

However, I could not find the data_*.cache file that the log points to in the local storage.
As a result of this investigation, the folder where the data_*.cache was stored was located elsewhere.
Nevertheless, there was no problem with the operation of volatility3.

Solution

A detailed study of this phenomenon confirmed that the Microsoft Store version of Python treats Windows internal folders differently for their access and use. (like symbolic link)

Therefore, there was no problem with using it, but the log informed me of other folders and files.
I have patched this so that other contributors and users do not experience confusion in their work.

This was also present in Python's official documents, and I borrowed a solution.

Result

DEBUG    volatility3.framework.layers.resources: Using already cached file at: C:\Users\dhyun\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.10_qbz5n2kfra8p0\LocalCache\Roaming\volatility3\data_a6f12d9c7c10398e8291aa0f048fc263e301c9d1c7eb3090bd65778d6130915c0e5a3beeaaf5f3be2a57866a49b6343d9eb4aee2b1dc7663dd39138736f3f7c0.cache

@digitalisx digitalisx changed the title Fix: cache path for python of Windows Store version Fix: cache path for python of Microsoft Store version Aug 4, 2022
@digitalisx digitalisx changed the title Fix: cache path for python of Microsoft Store version Fix: cache path for python of Microsoft Store version. Aug 7, 2022
Copy link
Member

@ikelos ikelos left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good, thanks! 5:)

@ikelos ikelos merged commit eca239d into volatilityfoundation:develop Aug 24, 2022
@digitalisx digitalisx deleted the fix/cache-windows-store branch August 24, 2022 16:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants