{"record":{"id":"eae8dcd8cbfba1a8","repo":"moonD4rk/HackBrowserData","slug":"seek-to-start-w","errorCode":null,"errorMessage":"seek to start: %w","messagePattern":"seek to start: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"filemanager/copy_windows.go","lineNumber":131,"sourceCode":"\tif err != nil {\n\t\treturn nil, err\n\t}\n\tif fileSize == 0 {\n\t\treturn nil, fmt.Errorf(\"file is empty\")\n\t}\n\n\tsize := int(fileSize)\n\n\t// Try FileMapping first — reads from kernel file cache, includes WAL data\n\tif data, err := winapi.MapFile(handle, size); err == nil {\n\t\treturn data, nil\n\t}\n\n\t// FileMapping failed, fall back to ReadFile.\n\t// Seek to beginning first — the handle's file pointer may be at an\n\t// arbitrary position.\n\tif _, err := windows.Seek(handle, 0, 0); err != nil {\n\t\treturn nil, fmt.Errorf(\"seek to start: %w\", err)\n\t}\n\tdata := make([]byte, size)\n\tvar bytesRead uint32\n\tif err := windows.ReadFile(handle, data, &bytesRead, nil); err != nil {\n\t\treturn nil, fmt.Errorf(\"ReadFile: %w\", err)\n\t}\n\treturn data[:bytesRead], nil\n}\n\n// extractStableSuffix extracts a path suffix that is stable across short/long\n// path name variations. It finds \"AppData\" in the path and returns everything\n// after \"AppData\\Local\\\" or \"AppData\\Roaming\\\" in lowercase.\n//\n// Example:\n//\n//\tC:\\Users\\RUNNER~1\\AppData\\Local\\Google\\Chrome\\...\\Cookies\n//\t→ google\\chrome\\...\\cookies\n//","sourceCodeStart":113,"sourceCodeEnd":149,"githubUrl":"https://github.com/moonD4rk/HackBrowserData/blob/0503d04d7a8d0379d060268a74f1b149e5a0aad5/filemanager/copy_windows.go#L113-L149","documentation":"readFileContent wraps a failure of windows.Seek(handle, 0, 0) with the message \"seek to start: %w\". This happens in the fallback path of copyLocked: after FileMapping failed, the tool seeks the duplicated Chrome file handle back to offset 0 before using ReadFile. The seek itself failing means the duplicated handle does not support pointer repositioning (e.g. it was opened without appropriate access, or the handle state changed between duplication and read), so the file cannot be read via this handle.","triggerScenarios":"Windows-only. Occurs in Session.Acquire(src, dst, false) when the normal copyFile fails because Chrome holds an exclusive lock, the code falls back to copyLocked, a matching handle is duplicated via findFileHandle, but winapi.MapFile fails and the subsequent windows.Seek on the duplicated handle returns an error (invalid handle state, insufficient access rights on the duplicated handle, or the handle refers to something not seekable).","commonSituations":"Chrome/Edge holds the Cookies DB open with PRAGMA locking_mode=EXCLUSIVE; the handle was duplicated with DUPLICATE_SAME_ACCESS but the owning process's access mask doesn't permit file-pointer operations; handle-table races where Chrome closes the handle between DuplicateHandle and Seek; security software interfering with duplicated handles.","solutions":["Re-run the extraction after checking that the target browser process is still alive and stable; a race with browser exit often breaks the duplicated handle.","Verify the tool runs as the same user as the browser process; duplicated handles with restricted access masks can reject seeks.","Retry the whole extraction — the normal copyFile path may succeed if Chrome releases the lock after a checkpoint or restart.","Update the library; if seeks consistently fail on this handle type the fallback path itself needs to open a fresh handle (FILE_READ_DATA) instead of reusing the duplicated one."],"exampleFix":"// before\nif _, err := windows.Seek(handle, 0, 0); err != nil {\n    return nil, fmt.Errorf(\"seek to start: %w\", err)\n}\n// after\nif _, err := windows.Seek(handle, 0, io.SeekStart); err != nil {\n    return nil, fmt.Errorf(\"seek to start: %w\", err)\n} // caller should also consider reopening src with os.Open when seek fails","handlingStrategy":"retry","validationCode":"// before extraction\nif runtime.GOOS != \"windows\" {\n    return errors.New(\"copyLocked fallback only exists on windows\")\n}\nif _, err := os.Stat(src); err != nil {\n    return fmt.Errorf(\"source unavailable: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"// Go: inspect the wrapped error and retry once\nif err := s.Acquire(src, dst, false); err != nil {\n    if strings.Contains(err.Error(), \"seek to start\") {\n        time.Sleep(500 * time.Millisecond)\n        err = s.Acquire(src, dst, false)\n    }\n    return err\n}","preventionTips":["Run as the same user that launched the browser so duplicated handles retain usable access rights","Avoid touching the browser (updates, restarts) during extraction","Retry transient locked-copy failures before giving up"],"tags":["windows","file-io","locked-file","handle-duplication","seek"],"backgroundTag":"file-read-failed","analyzedSha":"0503d04d7a8d0379d060268a74f1b149e5a0aad5","analyzedAt":"2026-09-06T13:38:28.707Z","contentChangedAt":"2026-09-06T13:38:28.707Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}