[sleuthkit-users] Windows Registry modules fail in Autopsy 3.1.2
Brought to you by:
carrier
From: MBR <mb...@ar...> - 2015-03-23 10:21:42
|
I'm analyzing a dd image of an NTFS filesystem containing Windows XP. I just installed Autopsy (3.1.2) expecting that it would allow me to examine the Windows registry. After I discovered that it doesn't support that by default, I Googled "Autopsy Windows Registry" and found the Autopsy 3rd Party Modules page (http://wiki.sleuthkit.org/index.php?title=Autopsy_3rd_Party_Modules). I followed the links and downloaded the compiled versions of: 1. Windows Registry Ingest Module 2. Windows Registry Content Viewer Both modules specify Autopsy 3.0.7 as the minimum compatible version. Unfortunately, when I try to install those modules, Autopsy won't allow me to install the modules. Instead, it complains: "The plugin Autopsy-Core is requested in version >= 7.0.9 (release version 9) but only 10.2.13 (of release version different from 9) was found." Any suggestions? Is the API actually different between 3.0.7 and 3.1.2, or is it just that the version number comparison fails? Mark Rosenthal mb...@ar... <mailto:mb...@ar...> |