Hi guys,
I’m not really a coder but sometimes I have to edit already existing code and I have a very basic understanding in Ruby and Python. I’m struggling with a loop right now which I can’t explain to myself why. Probably one of you guys can help.
Background: There are always two files with the same name the only difference is one file has $I in front of the actual file name and the other $R. $I contains some information I want to write as custom metadata on the file with $R.
Using the code below it’s going trough every file but only the first on the list gets the custom metadata. There is no error message. I tried to figure it out but I don’t get it. Anyone a clue how I can handle that?
Here’s the the part of the code who should doing that:
items = $current_case.search("path-name:Recycle.Bin AND name:I*").select {|t| t.name[/^\$I/]!=nil }
puts "#{items.size} $I items found..."
puts "Temporary Directory: #{tmpDIR}"
items.each do |item|
parentGuid = item.getParent.getGuid
rootID = item.name[2..-1]
puts "Processing Root id: $I#{rootID}"
if $current_case.search("name:R#{rootID}").count > 0
#export only if corresponding items are available
if item.getBinary.isAvailable
begin
file = File.join(tmpDIR,"nuixtmp")
binExporter.exportItem(item,file)
data = File.new(file,"r").read()
#Carving bit
size = data[8..15].unpack('V').first
str = data[16..23].unpack('H*').first.split("")
timestr = ""
while str.size > 1 do
timestr << str.pop(2).join("").to_s
end
wintime = timestr.to_i(16)
time = wintime/10000000-11644473600
deltime= Time.at(time)
loc = data[24..-1].unpack('v*').pack('C*').rstrip
flename = loc.split('\\').last
ritems=$current_case.search("name:R#{rootID}").select {|t| t.name=="$R#{rootID}"}
#Only apply to exact matches
ritems.each { |ritem|
ritem.getCustomMetadata().putInteger("Original Item Size",size)
ritem.getCustomMetadata().putText("Original File Name",flename)
ritem.getCustomMetadata().putText("Original File Location",loc)
ritem.getCustomMetadata().putText("File Deletion Time",deltime)
}
puts "just added metadata"
FileUtils.rm(file) #removing file at the end of the process
rescue
next
end
else
puts "This item has no binary: #{item.getGuid}"
end
else
puts "Corresponding $R#{rootID} not found."
end
end
I thank you already in advance for any help! Please let me know if you need further information.