Add native Berla iVe .iVa input - #173
Merged
Merged
Conversation
-t iva takes an iVe export directly. A .iVa is a ZIP holding another ZIP, and the seekers do not descend into nested archives, so before this the export had to be unwrapped by hand and a direct run produced an empty report. FileSeekerIva reaches through the nesting itself. When the export carries a raw disk image, that image is read with the vendored qnxprobe, which is the more complete route: on the tested export it reaches a fourth QNX6 volume the vendor's own extracted file set does not include. When no raw image is present the extracted file set is used as it stands. Either way Vehicle.json is staged at the root, so the export's acquisition record is reported beside the vehicle data. Everything intermediate lands in a temporary directory and cleanup() removes it; the unwrap script remains the way to keep the intermediate zip for cheap re-runs on a large export. The qnxprobe runner moves out of FileSeekerRaw into a module helper both seekers share. The GUI needs only a file picker entry: it derives the input type from the suffix, and .iVa lowercases to the new type on its own. Measured against the evidence .iVa: all nine vehicle artifacts return the same row counts as the raw image run, plus the export record's four rows, with no database errors, and -t zip and -t raw runs are unchanged after the refactor. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
input_type_for learns .iva, which is unambiguous, and honours an entry-level input_type field, which wins outright. A raw disk image is never guessed from its extension: the registry holds .bin files that are readable images and .bin files that are chip-level LUN dumps no walker opens, so raw is opt-in per entry, and an unknown declared type maps to nothing rather than something. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The unwrap script's docstring and both artifacts' notes described unwrapping as the only way to reach a .iVa's vehicle data, which -t iva makes untrue. The script remains the way to keep the intermediate zip for cheap re-runs, and the notes now say so instead. The Bluetooth artifacts' sample_data moves from the derived corpus entry to the evidence .iVa itself, re-measured through -t iva at the same 507, 126 and 2 rows, so the derived copy of the export's inner zip no longer needs to exist in the corpus. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
-t iva, so a Berla iVe.iVaexport runs directly. Before this the export had to be unwrapped by hand and a direct run produced an empty report.FileSeekerIvareaches through the nested zips. When the export carries a raw disk image it reads that with the vendored qnxprobe, the more complete route: on the tested export it reaches a fourth QNX6 volume the vendor's extracted file set does not include.Vehicle.jsonis staged at the root so the acquisition record reports beside the vehicle data.The validator maps
.iVaby extension and takesrawonly from an entry-levelinput_typefield, never guessed from.bin.Measured against the evidence export: ten artifacts, same row counts as the raw image run, no database errors;
-t zipand-t rawunchanged.