Skip to content

Stop warning that a healthy run may be useless - #321

Merged
RyanDFIR merged 2 commits into
mainfrom
warn-only-when-no-profiles-found
Sep 7, 2026
Merged

Stop warning that a healthy run may be useless#321
RyanDFIR merged 2 commits into
mainfrom
warn-only-when-no-profiles-found

Conversation

@RyanDFIR

@RyanDFIR RyanDFIR commented Sep 7, 2026

Copy link
Copy Markdown
Owner

find_browser_profiles warned that the input directory held no recognized history
file before it recursed, so pointing Hindsight at a User Data root always logged
"Analysis may not be very useful", twice, then parsed the profiles underneath it
anyway. The warning only means something once the search has finished and found
nothing, so it moves below the recursion and merges with the "No Profile paths
found" warning that was already there. The doubling was separate: hindsight.py
searches once for the early profile count and run() searches again, so the early
call now passes warn=False.

Second commit: when the search finds nothing it falls back to the input path, and
the console counted that as "Profiles found 1" right above the warning saying
otherwise. It now reads "0 (parsing the input path as a profile)".

The genuine no-profile case is as loud as before. Checked against
magnet.ctf_2018, 4 profiles, 13,899 items: no warnings, previously two. Full
suite 239 passed.

find_browser_profiles warned that the input directory held no recognized
history file before it recursed, so aiming Hindsight at a User Data root
always logged it, twice, even when profiles were then found and parsed.

The warning only means something once the search has finished and found
nothing, so move it below the recursion and merge it with the "No Profile
paths found" warning that already sat there. is_profile() loses its warn
parameter; find_browser_profiles() gains one, and the early profile count
in hindsight.py passes warn=False so the message is logged once.

Covered by tests/test_profile_discovery_warning.py.
The search returns the input path itself when it finds no profile, so the
console read "Profiles found  1" on a run that found none, directly above
the warning saying otherwise. Track the fallback on the session as
used_input_path_as_profile and label the row instead of counting it.
@RyanDFIR
RyanDFIR merged commit feb9424 into main Sep 7, 2026
18 checks passed
@RyanDFIR
RyanDFIR deleted the warn-only-when-no-profiles-found branch September 7, 2026 00:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant