Artifact unpacking issue

[DT540821]

Hello

Writing a module, some files have been failing to be unpacked from the extractions with this error.
"Could not write file to filesystem, path was *** data cannot access local variable 'creation_time' where it is not associated with a value.

The files that have failed indeed do not have timestamps within the extractions.
Unsure if this is by design or a bug. Any work around to be able to parse these with __artifacts__v2?
No exceptions are raised, so no line or file showing. I assume it will be from the unzipping trying to preserve original timestamps.

[stark4n6]

@DT540821 can you send a screenshot of the error from the process log so we can know the line and file it's erroring from?

[Johann-PLW]

Hello @DT540821,

Thank you for spotting this issue.

But to be able to try to fix it, I need some more details.
What did you try exactly to do and from which type of extraction (folder, iTunes backup, zip or tar file)?

With elements you provided, I suspect something related to the extraction of timestamps from search_files.py module..

[DT540821]

@stark4n6 @Johann-PLW

Hi guys, thanks for pointing me in the right direction.
Essentially, I was just distracted by the error messages, and the files were actually being unzipped into the data folder. So, not a major issue.
The error messages were triggered due to returning unassigned variable names inside the FileSeekerZip.decode_extended_timestamp() function.

Essentially all we need to do is assign some empty variables ahead of time to this function. Probably needs to get fixed or you lose the modification time as well.

[Johann-PLW]

Thank you very much @DT540821 .

You're right. There was an issue in the decode_extended_timestamp function. If extra_data has the correct header_id but there is no bit flag for modification_time, creation_time or both, local variable(s) used with no associated value.

This was fixed.

[JamesHabben]

@DT540821 have you been able to confirm this is resolved?