Re: [sleuthkit-users] Autopsy 3.07 keywords search issue

SourceForge Headquarters 225 Broadway Suite 1600 San Diego, CA 92101 +1 (858) 454-5900

Ughh, we definitely need a new release ASAP. The work around for this is to edit "C:\Program Files\Autopsy-3.0.7\etc\autopsy.conf" to have:

	jdkhome="jre"

at the bottom.  I needed to change the permissions on my system to allow write access to that file before I did it.

On Oct 11, 2013, at 7:50 PM, Alex <ix...@gm...> wrote:

> This results in "cannot locate java installation in specified jdkhome: jre7
> Do you want to try to use default version?"
> 
> Clicking YES we get "error: cannot find java 1.6 or higher" 
> 
> Cheers
> Alex 
> 
> Brian Carrier <ca...@sl...> wrote:
> Thanks for the painful phone typing!
> 
> I think I found it.  
> 
> Can you rename this folder (remove the 7):
> 
> C:\Program Files\Autopsy-3.0.7\autopsy\jre7 
> to 
> C:\Program Files\Autopsy-3.0.7\autopsy\jre 
> 
> And see if that works.  I think this was introduced because we now do 32-bit and 64-bit and missed that we call it something different. Not everyone is seeing the error because they may already have java on their path.
> 
> thanks,
> brian
> 
> 
> 
> On Oct 11, 2013, at 12:14 PM, Alex <ix...@gm...> wrote:
> 
> The error message is preceded by:
> INFO: Starting Solr using: java -Xmx512m -DSTOP.PORT=34343 -Djetty.port=23232 -DSTOP.KEY=jjk#09s -Djava.util.logging.config.file=C:\Program Files\Autopsy-3.0.7\autopsy\solr\solr\conf\logging-release.properties -jar
> start.jar 
> 
> 
> Not sending more logs as I have to type this on the phone, if you need more logs will send on Monday. 
> 
> Hope this helps,
> 
> Alex 
> 
> Brian Carrier <ca...@sl...> wrote:
> Strange.  In that log, there should be a message about what command it was going to run, something like "Starting Solr using:".  What did that say? 
> 
> thanks,
> brian
> 
> 
> On Oct 10, 2013, at 5:56 PM, Alex <ix...@gm...> wrote:
> 
> I take back my postscript: Fresh install on Win7 x64 has same issue. Logs show: 
> 
> WARNING: Could not start Solr server process!Exception: java.io.IOException: Cannot run program "java" (in directory "C:\Program Files\Autopsy-3.0.7\autopsy\solr"): CreateProcess error=2, The system cannot find the file specified. 
> 
> So it looks like a path issue, but how to fix?
> 
> Thanks
> 
> Alex 
> 
> Alex <ix4svs@gmail.c
>  om>
> wrote:
> 
> I think I'm experiencing the same bug with Autopsy 3.x on a Windows 8 x64 VMware
> host,
> running 64-bit Autopsy. 
> 
> 
> Autopsy 3.01 message on application launch: "Error initializing Keyword Search module. File indexing and search will not be functional. Please try to restart your computer and the application."
> Autopsy 3.07 message has slightly different wording but log still shows:
> 
> SEVERE: Starting server failed. Exception: org.sleuthkit.autopsy.keywordsearch.KeywordSearchModuleException: Error checking if Solr server is running. 
> 
> Rebooting doesn't appear to help. How could I troubleshoot this?
> 
> Thanks
> Alex
> 
> PS: All fine on Windows 7 x64. 
> 
> Brian Carrier <ca...@sl...> wrote:
> For everyone's update, seems that the SOLR (keyword search) service was not happy.  A reboot fixed the problem, but we will look into make sure that we give better errors in this case.
> 
>  
> 
> thanks,
> brian
> 
> On Oct 3, 2013, at 10:04 AM, Nanni Bassetti <dig...@gm...> wrote:
> 64bit and yes I see all the file system hierarchy, I don't get any error, all the rest works fine!
> thanks bye
> 
> 
> 2013/10/3 Brian Carrier <ca...@sl...>
> 32-bit version or 64-bit version?
> 
> If you open up the "Data Sources" node in the tree, does it show you the file system hierarchy or is it one big unallocated chunk?
> 
> You don't get any other errors?
> 
> 
> On Oct 3, 2013, at 2:46 AM, Nanni Bassetti <dig...@gm...> wrote:
> 
> Hi all,
> I ran Autopsy 3.07, in a Win 7 OS against, a 500Gb NTFS disk image file in EWF format made by Guymager 7.1.
> When I tried to do a keywords search I got this msg:
> 
> "No files were indexed - Re-Ingest the image with keyword search module enabled"
> 
> The keyword module is enabled, I re-ingest all, it finished and I re-tried the
> keyword search, but nothing...the same previous error message.
> 
> In the directory
> "\ModuleOutput\keywordsearch\data\index", I have only two files 1Kb size:
> 
> segments.gen and segments_1
> 
> With the past release I did not get this problem...what I'm wrong?
> Thanks
> 
> --
> Dr. Nanni Bassetti
> http://www.nannibassetti.com
> CAINE project manager - http://www.caine-live.net
> 
> October Webina
> rs:
> Code for Performance
> 
> Free Intel webinars can help you accelerate application performance.
> Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from
> the latest Intel processors and coprocessors. See abstracts and register >
> http://pubads.g.doubleclick.net/gampad/clk?id=60134791&iu=/4140/ostg.clktrk
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
> 
> 
> 
> 
> -- 
> Dr. Nanni Bassetti
> http://www.nannibassetti.com
> CAINE project manager - http://www.caine-live.net
> 
> October Webinars: Code for Performance
> Fre
> e Intel
> webinars can help you accelerate application performance.
> 
> Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from 
> the latest Intel processors and coprocessors. See abstracts and register >
> http://pubads.g.doubleclick.net/gampad/clk?id=60134791&iu=/4140/ostg.clktrk
> 
> sleuthkit-users mailin
>  g
> list
> 
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
> 
> 
> 
> October Webinars: Code for Performance
> Free Intel webinars can help you accelerate application performance.
> Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from 
> the latest Intel processors and coprocessors. See abstracts and register >
> http://pubads.g.doubleclick.net/gampad/clk?id=60134791&iu=/4140/ostg.clktrk
> 
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
> 
> October Webinars: Code for
> Performance<
> 
> br
> />Free Intel webinars can help you accelerate application performance.
> 
> Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from 
> the latest Intel processors and coprocessors. See abstracts and register >
> http://pubads.g.doubleclick.net/gampad/clk?id=60134071&iu=/4140/ostg.clktrk
> 
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
> 
> 
> October Webinars: Code for Performance
> Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from 
> the latest Intel processors and coprocessors. See abstracts and register >
> http://pubads.g.doubleclick.net/gampad/clk?id=60134071&iu=/4140/ostg.clktrk
> 
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
> 
> )
> 8 OK Success
> * 50 FETCH (UID 51 BODY[] {14588}
> Return-Path: <ix4svs
> ------------------------------------------------------------------------------
> October Webinars: Code for Performance
> Free Intel webinars can help you accelerate application performance.
> Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from 
> the latest Intel processors and coprocessors. See abstracts and register >
> http://pubads.g.doubleclick.net/gampad/clk?id=60134071&iu=/4140/ostg.clktrk_______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org