Relative paths on bookmark saved file

[patrickdalla]

I use IPED in my workflow in different environments. The evidence first processing is done on a container prepared based on https://github.com/iped-docker/iped in a linux server (with --portable cmd arg). The generated case is analyzed in my linux workstation, but eventually I open it in a Windows machine. I would like to create bookmarks on the Linux or Windows machine, or both.
After the analysis is finished I want to generate the report with the selected files in every bookmark. So I save the bookmark in the original case same folder, and my docker container image should recognize it an prepare it for deployment (process with IPED, generate hashes, cryptograph and compact it in ZIP pieces, etc...).

But the save bookmark keeps some paths based on the machine used to create it and IPED final processing crashes not being able to find some files.

Maybe I am doing something wrong? If not, it would be a desirable behaviour to keep paths somehow relative.

[patrickdalla]

java.lang.Exception: Error decoding datasource /full/path/to/my/case/MAT_1892_2024/WD-WXT1CC1W1590/midia.iped
at iped.engine.datasource.ItemProducer.run(ItemProducer.java:153) ~[iped-engine-4.1.6.jar:?]
Caused by: java.lang.RuntimeException: java.nio.file.NoSuchFileException: /full/path/where/I/analyzed/my/case/MAT_1892_2024/WD-WXT1CC1W1590/Relatorio_IPED/iped/data/prevTempDir.txt
at iped.engine.data.IPEDSource.(IPEDSource.java:174) ~[iped-engine-4.1.6.jar:?]
at iped.engine.data.IPEDSource.(IPEDSource.java:155) ~[iped-engine-4.1.6.jar:?]
at iped.engine.datasource.IPEDReader.processBookmark(IPEDReader.java:192) ~[iped-engine-4.1.6.jar:?]
at iped.engine.datasource.IPEDReader.read(IPEDReader.java:147) ~[iped-engine-4.1.6.jar:?]
at iped.engine.datasource.ItemProducer.run(ItemProducer.java:123) ~[iped-engine-4.1.6.jar:?]
Caused by: java.nio.file.NoSuchFileException: /full/path/where/I/analyzed/my/case/MAT_1892_2024/WD-WXT1CC1W1590/Relatorio_IPED/iped/data/prevTempDir.txt
at sun.nio.fs.UnixException.translateToIOException(UnixException.java:92) ~[?:?]
at sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:111) ~[?:?]
at sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:116) ~[?:?]
at sun.nio.fs.UnixFileSystemProvider.newByteChannel(UnixFileSystemProvider.java:219) ~[?:?]
at java.nio.file.Files.newByteChannel(Files.java:371) ~[?:?]
at java.nio.file.Files.newByteChannel(Files.java:422) ~[?:?]
at java.nio.file.Files.readAllBytes(Files.java:3206) ~[?:?]
at iped.engine.data.IPEDSource.getTempIndexDir(IPEDSource.java:150) ~[iped-engine-4.1.6.jar:?]
at iped.engine.data.IPEDSource.(IPEDSource.java:172) ~[iped-engine-4.1.6.jar:?]
at iped.engine.data.IPEDSource.(IPEDSource.java:155) ~[iped-engine-4.1.6.jar:?]
at iped.engine.datasource.IPEDReader.processBookmark(IPEDReader.java:192) ~[iped-engine-4.1.6.jar:?]
at iped.engine.datasource.IPEDReader.read(IPEDReader.java:147) ~[iped-engine-4.1.6.jar:?]
at iped.engine.datasource.ItemProducer.run(ItemProducer.java:123) ~[iped-engine-4.1.6.jar:?]

This is the exception IPED gives (I replaced the real full real processing time path with "/full/path/to/my/case" and full real analysis env path with "/full/path/where/I/analyzed/my/case".

[patrickdalla]

I can produce the report with the IPED GUI. But it would be preferable to only save the bookmark, let the server produce the report and free my workstation to next works.

[lfcnassif]

Hi @patrickdalla!

Maybe I am doing something wrong? If not, it would be a desirable behaviour to keep paths somehow relative.

You are not. Those internal absolute paths were intentional a long ago, because the user is able to save bookmarks from UI in arbitrary folders, unrelated to the case. And when creating reports, just the bookmarks file is passed as parameter, the case path itself is not passed explicitly, it should be read from the bookmarks file somehow because it could be in a different folder.

I agree using relative paths would be interesting and useful, for example, to generate reports from a different machine like you are trying to do. If we can accomplish that, without breaking any past behavior, I would be +1.

PS: if you open the copied case in the new machine and update bookmarks, or check and unchecked one item, or simply do some term search, the internal bookmarks file paths are updated. But that needs an UI interaction that would not be possible to automate or to do in a server without a display device.