Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Duplicate evidence processing running gcp_turbinia_disk_copy_ts #782

Open
wajihyassine opened this issue Sep 25, 2023 · 1 comment
Open

Comments

@wajihyassine
Copy link
Contributor

When running the recipe gcp_turbinia_disk_copy_ts running into an issue where two Turbinia requests are created for the same evidence (one of the original evidence and one of the snapshot of the original evidence). This only seems to be happening when running the recipe with the same project id for source_project_name and analysis_project_name

Sample of dftw log output (happy to provide more output if needed for debugging)

 gcp_turbinia_disk_copy_ts
   Preflights:
     GCPTokenCheck-analysis: Completed
     GCPTokenCheck-source: Completed
   Modules:
     TimesketchExporter: Setting Up
     GCEDiskCopy: Pending
 gcp_turbinia_disk_copy_ts
   Preflights:
     GCPTokenCheck-analysis: Completed
     GCPTokenCheck-source: Completed
   Modules:
     GCEDiskCopy: Completed
     GCEForensicsVM: Completed
     TurbiniaGCPProcessor: Processing - 0 of 2 containers completed
       ThreadPoolExecutor-1_0: Running (pvc-eeb11398-c00d-4d86-a2c9-3cf21d947727)
       ThreadPoolExecutor-1_1: Running (evidence-pvc-eeb11398-c00d-4d86-a2c9-3cf21d947727-f688924a-copy)
     TimesketchExporter: Pending (TurbiniaGCPProcessor)

ThreadPoolExecutor-1_0: Running (pvc-eeb11398-c00d-4d86-a2c9-3cf21d947727) Turbinia processing fails due to already being attached to a different resource

ThreadPoolExecutor-1_1: Running (evidence-pvc-eeb11398-c00d-4d86-a2c9-3cf21d947727-f688924a-copy) runs as intended per it being a snapshot of the original evidence

@jleaniz
Copy link
Collaborator

jleaniz commented Feb 21, 2024

I think the problem here is that dfTimewolf sees these two disks as unique objects to process. Maybe It's an ordering issue in the recipe? GCEForensicsVM probably should not output a dfTimewolf container that is accepted by the Turbinia processing module.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants