Results from the run test...
I tested all user-accessible modules, even though the test image I'm using (Barry Grundy's ntfs_pract.E01) doesn't have all the test data I need. I'll switch to a different image when I have more time to test.
I started with the last successful clean build, then ran it. All went well with that and I brought the case into Autopsy without error. I ran each module in the below order individually and one at a time:
* E01 Verifier = completed successfully.
* Recent Activity = registry exam failed with 3 errors:
- Code: Select all
Thu Aug 25 12:01:18 CDT 2016 org.sleuthkit.autopsy.recentactivity.ExtractRegistry analyzeRegistryFiles
INFO: Registry- Now getting registry information from /home/hharness/dev/411test_20160825/411test_20160825/Temp/RecentActivity/reg/NTUSER.DAT
Thu Aug 25 12:01:18 CDT 2016 org.sleuthkit.autopsy.recentactivity.ExtractRegistry ripRegistryFile
INFO: Writing RegRipper results to: /home/hharness/dev/411test_20160825/411test_20160825/ModuleOutput/RecentActivity/reg/NTUSER.DAT-regripper-0-autopsy.txt
Thu Aug 25 12:01:18 CDT 2016 org.sleuthkit.autopsy.recentactivity.ExtractRegistry executeRegRipper
SEVERE: Unable to run RegRipper
Thu Aug 25 12:01:18 CDT 2016 org.sleuthkit.autopsy.recentactivity.ExtractRegistry ripRegistryFile
INFO: Writing Full RegRipper results to: /home/hharness/dev/411test_20160825/411test_20160825/ModuleOutput/RecentActivity/reg/NTUSER.DAT-regripper-0-full.txt
Thu Aug 25 12:01:18 CDT 2016 org.sleuthkit.autopsy.recentactivity.ExtractRegistry executeRegRipper
SEVERE: Unable to run RegRipper
Thu Aug 25 12:01:18 CDT 2016 org.sleuthkit.autopsy.recentactivity.RAImageIngestModule process
SEVERE: Exception occurred in Registry
Thu Aug 25 12:01:18 CDT 2016 org.sleuthkit.autopsy.recentactivity.SearchEngineURLQueryAnalyzer complete
INFO: Search Engine URL Query Analyzer has completed.
Thu Aug 25 12:01:18 CDT 2016 org.sleuthkit.autopsy.ingest.DataSourceIngestPipeline process
INFO: Recent Activity analysis of ntfs_pract.E01 (jobId=1) finished
Thu Aug 25 12:01:18 CDT 2016 org.sleuthkit.autopsy.ingest.DataSourceIngestJob finishFirstStage
INFO: Finished first stage analysis for ntfs_pract.E01 (jobId=2)
Thu Aug 25 12:01:18 CDT 2016 org.sleuthkit.autopsy.ingest.DataSourceIngestJob finish
INFO: Finished analysis for ntfs_pract.E01 (jobId=2)
Thu Aug 25 12:01:18 CDT 2016 org.sleuthkit.autopsy.ingest.IngestManager finishIngestJob
INFO: Ingest job 2 completed
* Embedded File Extractor = successful
* Hash Lookup = successful (hash set successfully created in Autopsy also)
* Keyword Search/Indexer & individual keyword search = successful (keyword list successfully created also)
* Extension Mismatch Detector = successful (no optional exceptions selected)
* Exif Parser = successful
* Email Parser = ran without error, but no test data to work against. errors still showing in NetBeans.
* Android Analyzer = ran without error, but no test data to work against
* File Type Identification = successful
*Virtual Machine Extractor = ran without error, but no test data to work against
* PhotoRec Carver = failed - Windows only (this was expected)
* Image Gallery = runs, but does not display graphics
* Timeline = failed with the following:
- Code: Select all
java.lang.RuntimeException: ControlsFX Error: ControlsFX 8.40.10 requires at least Java Version 8 Update 40
at impl.org.controlsfx.version.VersionChecker.doVersionCheck(VersionChecker.java:96)
at org.controlsfx.control.ControlsFXControl.<init>(ControlsFXControl.java:35)
at org.controlsfx.control.RangeSlider.<init>(RangeSlider.java:175)
at org.sleuthkit.autopsy.timeline.ui.ViewFrame.<init>(ViewFrame.java:161)
at org.sleuthkit.autopsy.timeline.TimeLineTopComponent.initFXComponents(TimeLineTopComponent.java:263)
at com.sun.javafx.application.PlatformImpl.lambda$null$173(PlatformImpl.java:295)
at java.security.AccessController.doPrivileged(Native Method)
at com.sun.javafx.application.PlatformImpl.lambda$runLater$174(PlatformImpl.java:294)
[catch] at com.sun.glass.ui.InvokeLaterDispatcher$Future.run(InvokeLaterDispatcher.java:95)
at com.sun.glass.ui.gtk.GtkApplication._runLoop(Native Method)
at com.sun.glass.ui.gtk.GtkApplication.lambda$null$49(GtkApplication.java:139)
at java.lang.Thread.run(Thread.java:745)
Additional notes:
* Bookmarks seem to work fine.
* No "Media" tab to display documents, pictures, etc.
* Thumbnail view and show in external viewer both work
* HTML report builds fine. I didn't test the other report types.
* The UI seems a bit wonky, but it's hard to explain why. A "Reset windows to default positions" option might be a good idea.
Some of the above errors have to do with the fact that there are 26 .exe files that Autopsy calls here and there, depending on what it's doing. Linux and Mac won't run those natively, which affects any operation where calls are made to RegRipper, PhotoRec, TestDisk, and others. The solution, at least in my mind, is to include UNIX executables, then write in tests so that the correct ones may be called when needed. It's not as simple as that, though. For example, Autopsy uses two versions of RegRipper - the normal set of plug-ins and a second set customized for Autopsy to produce XML structure that better lends itself to inclusion as Blackboard artifacts. This would require that the same thing be done for UNIX variants.
That's all for now...
Hoyt