sleuthkit-users — List to discuss Autopsy and The Sleuth Kit.

Re: [sleuthkit-users] Missing Image File

[Richard C. <rco...@ba...>]

There should be a log entry in the Autopsy log with a stack trace for the
exception that occurred and triggered the error message that you report.
The message part of the log entry will be "Error setting image paths", so
you can open the log file(s) in a text editor and search for that. You can
locate the log files by opening the case and selecting Help, Open Log
Folder. The stack trace, redacted to remove any information specific to the
case if necessary, should provide a clue. I will be happy to look it over.

On Wed, Dec 19, 2018 at 1:41 PM Ted Hiler <cyb...@gm...> wrote:

> Hello,
>
> I started getting errors when selecting evidence image file (after being
> moved to a different location).
> “Error setting image path. Please try again”
> Autopsy 4.9.1
>
> Any ideas?
>
> Thanks in advance.
>
> Ted Hiler
> cyb...@gm...
> (951) 444-5256
>
>
>
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>

[sleuthkit-users] Missing Image File

[Ted H. <cyb...@gm...>]

Hello,

I started getting errors when selecting evidence image file (after being moved to a different location). 
“Error setting image path. Please try again”
Autopsy 4.9.1

Any ideas?

Thanks in advance.

Ted Hiler
cyb...@gm...
(951) 444-5256

[sleuthkit-users] little updating for CAINE 10.0 (Autopsy 4.9.1 onboard)

[Nanni B. <dig...@gm...>]

Hi all,
I just released a little update of CAINE 10, putting ACPI=off in the boot
menu (for graphical compatibility) and Autopsy 4.9.1 onboard, I did not
change the release number only for these little updates.
Thank you

-- 
Dott. Nanni Bassetti
http://www.nannibassetti.com
CAINE project manager - http://www.caine-live.net

Re: [sleuthkit-users] Charset encoder error when processing mbox files

[Derrick K. <dk...@gm...>]

Hello.

I'm not sure what else can be done without seeing the data.  I don't
even think going into Autopsy's "Help -> About -> Activate verbose
logging" will help but you can give it a shot.

Autopsy uses Tika's CharsetDetector which is straight from ICU4J I
believe and this could be a upstream issue in Tika as it seems very
specific to your data.  I understand about not being able to share
your data though!  As a thought to isolate this, how about splitting
your mbox into a zillion individual mbox's and running Autopsy against
the split versions to see if a specific culprit message can found?
The procmail package has the 'formail' utility which can do the
splitting for you.  ie:

  dk@anubis:/tmp/bleck$ mkdir splitmbox
  dk@anubis:/tmp/bleck$ cat mbox | formail -ds sh -c 'cat >
splitmbox/msg.$FILENO'

Derrick

On Tue, Dec 11, 2018 at 11:18 AM <hyl...@is...> wrote:
>
> > Is it possible to share your data at all?
>
> Unfortunately no as it is proprietary client information.  I can share
> Autopsy log files, though, or anything of that nature (system log files,
> etc.)  What can I provide that would be helpful?
>
> > Derrick
> >
> >
> > On Tue, Dec 11, 2018, 00:21 Joseph Hylkema <hyl...@is... wrote:
> >
> >> Okay, here's what I did:
> >>
> >> I changed the contents of /etc/default/locale to remove the hard-coded
> >> Italian references in that file, changed the default locale to
> >> en_US.UTF-8, and got the same locale output as Derrick did.
> >>
> >> I then attempted to re-run the ingest... and got the same error.
> >>
> >> I then upgraded to Autopsy 4.9.1... and got the same error.
> >>
> >> I then installed Autopsy 4.9.1 in a Mint test VM, spun it up, ran it
> >> against the data... and got the same error.
> >>
> >> I am wondering if maybe I should just punt and install all of the
> >> locales?  After all, this data has God-only-knows what character
> >> encoding in it.
> >>
> >> So, it's probably not a CAINE issue.  It could be an issue with teh
> >> data itself.  Perhaps I could import it into Thunderbird (read-only and
> >> off-network) and see if there is any strange encoding in it.
> >>
> >> Thoughts?
> >>
> >> On Mon, 2018-12-10 at 18:57 -0700, Derrick Karpo wrote:
> >> > Hi Joseph.
> >> >
> >> > I've attached my locale output below:
> >> >
> >> > dk@anubis:~$ locale
> >> > LANG=en_CA.utf8
> >> > LANGUAGE=en_CA:en
> >> > LC_CTYPE="en_CA.utf8"
> >> > LC_NUMERIC="en_CA.utf8"
> >> > LC_TIME="en_CA.utf8"
> >> > LC_COLLATE="en_CA.utf8"
> >> > LC_MONETARY="en_CA.utf8"
> >> > LC_MESSAGES="en_CA.utf8"
> >> > LC_PAPER="en_CA.utf8"
> >> > LC_NAME="en_CA.utf8"
> >> > LC_ADDRESS="en_CA.utf8"
> >> > LC_TELEPHONE="en_CA.utf8"
> >> > LC_MEASUREMENT="en_CA.utf8"
> >> > LC_IDENTIFICATION="en_CA.utf8"
> >> > LC_ALL=
> >> > dk@anubis:~$ locale charmap
> >> > UTF-8
> >> >
> >> > I tested my system under Autopsy 4.9.0 and 4.9.1 and both ran fine.
> >> > While I'm not convinced we are on the right track with the locales
> >> > stuff we could try something:
> >> >
> >> >   $ sudo dpkg-reconfigure locales (generate "en_US.UTF-8" and set it
> >> > as the default locale)
> >> >   <log out of the Caine X session>
> >> >   $ locale (make sure it's all "en_US.utf8")
> >> >   <test Autopsy again>
> >> >
> >> > Derrick
> >> >
> >> > On Sun, Dec 9, 2018 at 10:18 PM <hyl...@is...> wrote:
> >> > >
> >> > > > Hi Joseph.
> >> > > >
> >> > > > This question might be better asked directly to Nanni as it
> >> > > > sounds
> >> > > > like it may be Caine specific!  I just tested mbox parsing under
> >> > > > Debian testing w/Autopsy 4.9.1 and didn't have any issues with
> >> > > > keyword
> >> > > > searches.
> >> > > >
> >> > > > While I don't have a copy of Caine to test with at the moment I
> >> > > > wonder
> >> > > > if it's a manifestation of your systems locale.  If you fire up a
> >> > > > terminal emulator, can you send the output from 'locale' and
> >> > > > 'locale
> >> > > > charmap'?  From MboxParser.java:111 in Autopsy it looks like if
> >> > > > it
> >> > > > can't detect the character encoder that it'll throw that message
> >> > > > but I
> >> > > > could be way off base here.
> >> > >
> >> > > Hi Derrick,
> >> > >
> >> > > Thank you very much for the quick reply.  Below is the output of
> >> > > 'locale':
> >> > >
> >> > > jhylkema@caine-vm:~$ locale
> >> > > LANG=en_US.UTF-8
> >> > > LANGUAGE=en_US
> >> > > LC_CTYPE="en_US.UTF-8"
> >> > > LC_NUMERIC=it_IT.UTF-8
> >> > > LC_TIME=it_IT.UTF-8
> >> > > LC_COLLATE="en_US.UTF-8"
> >> > > LC_MONETARY=it_IT.UTF-8
> >> > > LC_MESSAGES="en_US.UTF-8"
> >> > > LC_PAPER=it_IT.UTF-8
> >> > > LC_NAME=it_IT.UTF-8
> >> > > LC_ADDRESS=it_IT.UTF-8
> >> > > LC_TELEPHONE=it_IT.UTF-8
> >> > > LC_MEASUREMENT=it_IT.UTF-8
> >> > > LC_IDENTIFICATION=it_IT.UTF-8
> >> > > LC_ALL=
> >> > >
> >> > > And below is the output of 'locale charmap':
> >> > >
> >> > > jhylkema@caine-vm:~$ locale charmap
> >> > > UTF-8
> >> > >
> >> > > If I were a betting man, my money would be on the fact that LC_ALL
> >> > > isn't
> >> > > set.  Is that environment variable set in your Debian test distro?
> >> > >
> >> > > I will also email Nanni.
> >> > >
> >> > > Thank you.
> >> > >
> >> > > >
> >> > > > Derrick
> >> > > > On Sun, Dec 9, 2018 at 1:18 AM Joseph Hylkema <
> >> > > > hyl...@is...>
> >> > > > wrote:
> >> > > > >
> >> > > > > Hi all,
> >> > > > >
> >> > > > > First post to the list.
> >> > > > >
> >> > > > > I am trying to use Autopsy to run some keyword searches on mbox
> >> > > > > files
> >> > > > > downloaded from gmail.  Unfortunately, autopsy returns an
> >> > > > > error:
> >> > > > > "Error while processing:  Could not find appropriate charset
> >> > > > > encoder."
> >> > > > > I am running Autopsy on Caine 10 in a KVM VM with 8GB RAM on a
> >> > > > > Lenovo
> >> > > > > P51 with a Core I7 processor.
> >> > > > >
> >> > > > > Any help would be appreciated.
> >> > > > >
> >> > > > > --
> >> > > > > "Far better it is to dare mighty things, to win glorious
> >> > > > > triumphs, even
> >> > > > > though checkered by failure, than to take rank with those poor
> >> > > > > spirits
> >> > > > > who neither enjoy much nor suffer much, because they live in
> >> > > > > the gray
> >> > > > > twilight that knows neither victory nor defeat."
> >> > > > >
> >> > > > > -- Theodore Roosevelt, "The Strenuous Life."
> >> > > > >
> >> > > > >
> >> > > > >
> >> > > > > _______________________________________________
> >> > > > > sleuthkit-users mailing list
> >> > > > > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> >> > > > > http://www.sleuthkit.org
> >> > >
> >> > >
> >>
> >>
> >
>
>

Re: [sleuthkit-users] Charset encoder error when processing mbox files

[<hyl...@is...>]

> Is it possible to share your data at all?

Unfortunately no as it is proprietary client information.  I can share
Autopsy log files, though, or anything of that nature (system log files,
etc.)  What can I provide that would be helpful?

> Derrick
>
>
> On Tue, Dec 11, 2018, 00:21 Joseph Hylkema <hyl...@is... wrote:
>
>> Okay, here's what I did:
>>
>> I changed the contents of /etc/default/locale to remove the hard-coded
>> Italian references in that file, changed the default locale to
>> en_US.UTF-8, and got the same locale output as Derrick did.
>>
>> I then attempted to re-run the ingest... and got the same error.
>>
>> I then upgraded to Autopsy 4.9.1... and got the same error.
>>
>> I then installed Autopsy 4.9.1 in a Mint test VM, spun it up, ran it
>> against the data... and got the same error.
>>
>> I am wondering if maybe I should just punt and install all of the
>> locales?  After all, this data has God-only-knows what character
>> encoding in it.
>>
>> So, it's probably not a CAINE issue.  It could be an issue with teh
>> data itself.  Perhaps I could import it into Thunderbird (read-only and
>> off-network) and see if there is any strange encoding in it.
>>
>> Thoughts?
>>
>> On Mon, 2018-12-10 at 18:57 -0700, Derrick Karpo wrote:
>> > Hi Joseph.
>> >
>> > I've attached my locale output below:
>> >
>> > dk@anubis:~$ locale
>> > LANG=en_CA.utf8
>> > LANGUAGE=en_CA:en
>> > LC_CTYPE="en_CA.utf8"
>> > LC_NUMERIC="en_CA.utf8"
>> > LC_TIME="en_CA.utf8"
>> > LC_COLLATE="en_CA.utf8"
>> > LC_MONETARY="en_CA.utf8"
>> > LC_MESSAGES="en_CA.utf8"
>> > LC_PAPER="en_CA.utf8"
>> > LC_NAME="en_CA.utf8"
>> > LC_ADDRESS="en_CA.utf8"
>> > LC_TELEPHONE="en_CA.utf8"
>> > LC_MEASUREMENT="en_CA.utf8"
>> > LC_IDENTIFICATION="en_CA.utf8"
>> > LC_ALL=
>> > dk@anubis:~$ locale charmap
>> > UTF-8
>> >
>> > I tested my system under Autopsy 4.9.0 and 4.9.1 and both ran fine.
>> > While I'm not convinced we are on the right track with the locales
>> > stuff we could try something:
>> >
>> >   $ sudo dpkg-reconfigure locales (generate "en_US.UTF-8" and set it
>> > as the default locale)
>> >   <log out of the Caine X session>
>> >   $ locale (make sure it's all "en_US.utf8")
>> >   <test Autopsy again>
>> >
>> > Derrick
>> >
>> > On Sun, Dec 9, 2018 at 10:18 PM <hyl...@is...> wrote:
>> > >
>> > > > Hi Joseph.
>> > > >
>> > > > This question might be better asked directly to Nanni as it
>> > > > sounds
>> > > > like it may be Caine specific!  I just tested mbox parsing under
>> > > > Debian testing w/Autopsy 4.9.1 and didn't have any issues with
>> > > > keyword
>> > > > searches.
>> > > >
>> > > > While I don't have a copy of Caine to test with at the moment I
>> > > > wonder
>> > > > if it's a manifestation of your systems locale.  If you fire up a
>> > > > terminal emulator, can you send the output from 'locale' and
>> > > > 'locale
>> > > > charmap'?  From MboxParser.java:111 in Autopsy it looks like if
>> > > > it
>> > > > can't detect the character encoder that it'll throw that message
>> > > > but I
>> > > > could be way off base here.
>> > >
>> > > Hi Derrick,
>> > >
>> > > Thank you very much for the quick reply.  Below is the output of
>> > > 'locale':
>> > >
>> > > jhylkema@caine-vm:~$ locale
>> > > LANG=en_US.UTF-8
>> > > LANGUAGE=en_US
>> > > LC_CTYPE="en_US.UTF-8"
>> > > LC_NUMERIC=it_IT.UTF-8
>> > > LC_TIME=it_IT.UTF-8
>> > > LC_COLLATE="en_US.UTF-8"
>> > > LC_MONETARY=it_IT.UTF-8
>> > > LC_MESSAGES="en_US.UTF-8"
>> > > LC_PAPER=it_IT.UTF-8
>> > > LC_NAME=it_IT.UTF-8
>> > > LC_ADDRESS=it_IT.UTF-8
>> > > LC_TELEPHONE=it_IT.UTF-8
>> > > LC_MEASUREMENT=it_IT.UTF-8
>> > > LC_IDENTIFICATION=it_IT.UTF-8
>> > > LC_ALL=
>> > >
>> > > And below is the output of 'locale charmap':
>> > >
>> > > jhylkema@caine-vm:~$ locale charmap
>> > > UTF-8
>> > >
>> > > If I were a betting man, my money would be on the fact that LC_ALL
>> > > isn't
>> > > set.  Is that environment variable set in your Debian test distro?
>> > >
>> > > I will also email Nanni.
>> > >
>> > > Thank you.
>> > >
>> > > >
>> > > > Derrick
>> > > > On Sun, Dec 9, 2018 at 1:18 AM Joseph Hylkema <
>> > > > hyl...@is...>
>> > > > wrote:
>> > > > >
>> > > > > Hi all,
>> > > > >
>> > > > > First post to the list.
>> > > > >
>> > > > > I am trying to use Autopsy to run some keyword searches on mbox
>> > > > > files
>> > > > > downloaded from gmail.  Unfortunately, autopsy returns an
>> > > > > error:
>> > > > > "Error while processing:  Could not find appropriate charset
>> > > > > encoder."
>> > > > > I am running Autopsy on Caine 10 in a KVM VM with 8GB RAM on a
>> > > > > Lenovo
>> > > > > P51 with a Core I7 processor.
>> > > > >
>> > > > > Any help would be appreciated.
>> > > > >
>> > > > > --
>> > > > > "Far better it is to dare mighty things, to win glorious
>> > > > > triumphs, even
>> > > > > though checkered by failure, than to take rank with those poor
>> > > > > spirits
>> > > > > who neither enjoy much nor suffer much, because they live in
>> > > > > the gray
>> > > > > twilight that knows neither victory nor defeat."
>> > > > >
>> > > > > -- Theodore Roosevelt, "The Strenuous Life."
>> > > > >
>> > > > >
>> > > > >
>> > > > > _______________________________________________
>> > > > > sleuthkit-users mailing list
>> > > > > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>> > > > > http://www.sleuthkit.org
>> > >
>> > >
>>
>>
>

Re: [sleuthkit-users] Charset encoder error when processing mbox files

[Derrick K. <dk...@gm...>]

Is it possible to share your data at all?

Derrick


On Tue, Dec 11, 2018, 00:21 Joseph Hylkema <hyl...@is... wrote:

> Okay, here's what I did:
>
> I changed the contents of /etc/default/locale to remove the hard-coded
> Italian references in that file, changed the default locale to
> en_US.UTF-8, and got the same locale output as Derrick did.
>
> I then attempted to re-run the ingest... and got the same error.
>
> I then upgraded to Autopsy 4.9.1... and got the same error.
>
> I then installed Autopsy 4.9.1 in a Mint test VM, spun it up, ran it
> against the data... and got the same error.
>
> I am wondering if maybe I should just punt and install all of the
> locales?  After all, this data has God-only-knows what character
> encoding in it.
>
> So, it's probably not a CAINE issue.  It could be an issue with teh
> data itself.  Perhaps I could import it into Thunderbird (read-only and
> off-network) and see if there is any strange encoding in it.
>
> Thoughts?
>
> On Mon, 2018-12-10 at 18:57 -0700, Derrick Karpo wrote:
> > Hi Joseph.
> >
> > I've attached my locale output below:
> >
> > dk@anubis:~$ locale
> > LANG=en_CA.utf8
> > LANGUAGE=en_CA:en
> > LC_CTYPE="en_CA.utf8"
> > LC_NUMERIC="en_CA.utf8"
> > LC_TIME="en_CA.utf8"
> > LC_COLLATE="en_CA.utf8"
> > LC_MONETARY="en_CA.utf8"
> > LC_MESSAGES="en_CA.utf8"
> > LC_PAPER="en_CA.utf8"
> > LC_NAME="en_CA.utf8"
> > LC_ADDRESS="en_CA.utf8"
> > LC_TELEPHONE="en_CA.utf8"
> > LC_MEASUREMENT="en_CA.utf8"
> > LC_IDENTIFICATION="en_CA.utf8"
> > LC_ALL=
> > dk@anubis:~$ locale charmap
> > UTF-8
> >
> > I tested my system under Autopsy 4.9.0 and 4.9.1 and both ran fine.
> > While I'm not convinced we are on the right track with the locales
> > stuff we could try something:
> >
> >   $ sudo dpkg-reconfigure locales (generate "en_US.UTF-8" and set it
> > as the default locale)
> >   <log out of the Caine X session>
> >   $ locale (make sure it's all "en_US.utf8")
> >   <test Autopsy again>
> >
> > Derrick
> >
> > On Sun, Dec 9, 2018 at 10:18 PM <hyl...@is...> wrote:
> > >
> > > > Hi Joseph.
> > > >
> > > > This question might be better asked directly to Nanni as it
> > > > sounds
> > > > like it may be Caine specific!  I just tested mbox parsing under
> > > > Debian testing w/Autopsy 4.9.1 and didn't have any issues with
> > > > keyword
> > > > searches.
> > > >
> > > > While I don't have a copy of Caine to test with at the moment I
> > > > wonder
> > > > if it's a manifestation of your systems locale.  If you fire up a
> > > > terminal emulator, can you send the output from 'locale' and
> > > > 'locale
> > > > charmap'?  From MboxParser.java:111 in Autopsy it looks like if
> > > > it
> > > > can't detect the character encoder that it'll throw that message
> > > > but I
> > > > could be way off base here.
> > >
> > > Hi Derrick,
> > >
> > > Thank you very much for the quick reply.  Below is the output of
> > > 'locale':
> > >
> > > jhylkema@caine-vm:~$ locale
> > > LANG=en_US.UTF-8
> > > LANGUAGE=en_US
> > > LC_CTYPE="en_US.UTF-8"
> > > LC_NUMERIC=it_IT.UTF-8
> > > LC_TIME=it_IT.UTF-8
> > > LC_COLLATE="en_US.UTF-8"
> > > LC_MONETARY=it_IT.UTF-8
> > > LC_MESSAGES="en_US.UTF-8"
> > > LC_PAPER=it_IT.UTF-8
> > > LC_NAME=it_IT.UTF-8
> > > LC_ADDRESS=it_IT.UTF-8
> > > LC_TELEPHONE=it_IT.UTF-8
> > > LC_MEASUREMENT=it_IT.UTF-8
> > > LC_IDENTIFICATION=it_IT.UTF-8
> > > LC_ALL=
> > >
> > > And below is the output of 'locale charmap':
> > >
> > > jhylkema@caine-vm:~$ locale charmap
> > > UTF-8
> > >
> > > If I were a betting man, my money would be on the fact that LC_ALL
> > > isn't
> > > set.  Is that environment variable set in your Debian test distro?
> > >
> > > I will also email Nanni.
> > >
> > > Thank you.
> > >
> > > >
> > > > Derrick
> > > > On Sun, Dec 9, 2018 at 1:18 AM Joseph Hylkema <
> > > > hyl...@is...>
> > > > wrote:
> > > > >
> > > > > Hi all,
> > > > >
> > > > > First post to the list.
> > > > >
> > > > > I am trying to use Autopsy to run some keyword searches on mbox
> > > > > files
> > > > > downloaded from gmail.  Unfortunately, autopsy returns an
> > > > > error:
> > > > > "Error while processing:  Could not find appropriate charset
> > > > > encoder."
> > > > > I am running Autopsy on Caine 10 in a KVM VM with 8GB RAM on a
> > > > > Lenovo
> > > > > P51 with a Core I7 processor.
> > > > >
> > > > > Any help would be appreciated.
> > > > >
> > > > > --
> > > > > "Far better it is to dare mighty things, to win glorious
> > > > > triumphs, even
> > > > > though checkered by failure, than to take rank with those poor
> > > > > spirits
> > > > > who neither enjoy much nor suffer much, because they live in
> > > > > the gray
> > > > > twilight that knows neither victory nor defeat."
> > > > >
> > > > > -- Theodore Roosevelt, "The Strenuous Life."
> > > > >
> > > > >
> > > > >
> > > > > _______________________________________________
> > > > > sleuthkit-users mailing list
> > > > > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> > > > > http://www.sleuthkit.org
> > >
> > >
>
>

Re: [sleuthkit-users] Charset encoder error when processing mbox files

[Joseph H. <hyl...@is...>]

Okay, here's what I did:

I changed the contents of /etc/default/locale to remove the hard-coded
Italian references in that file, changed the default locale to
en_US.UTF-8, and got the same locale output as Derrick did.

I then attempted to re-run the ingest... and got the same error.  

I then upgraded to Autopsy 4.9.1... and got the same error.

I then installed Autopsy 4.9.1 in a Mint test VM, spun it up, ran it
against the data... and got the same error.

I am wondering if maybe I should just punt and install all of the
locales?  After all, this data has God-only-knows what character
encoding in it.

So, it's probably not a CAINE issue.  It could be an issue with teh
data itself.  Perhaps I could import it into Thunderbird (read-only and
off-network) and see if there is any strange encoding in it.

Thoughts?

On Mon, 2018-12-10 at 18:57 -0700, Derrick Karpo wrote:
> Hi Joseph.
> 
> I've attached my locale output below:
> 
> dk@anubis:~$ locale
> LANG=en_CA.utf8
> LANGUAGE=en_CA:en
> LC_CTYPE="en_CA.utf8"
> LC_NUMERIC="en_CA.utf8"
> LC_TIME="en_CA.utf8"
> LC_COLLATE="en_CA.utf8"
> LC_MONETARY="en_CA.utf8"
> LC_MESSAGES="en_CA.utf8"
> LC_PAPER="en_CA.utf8"
> LC_NAME="en_CA.utf8"
> LC_ADDRESS="en_CA.utf8"
> LC_TELEPHONE="en_CA.utf8"
> LC_MEASUREMENT="en_CA.utf8"
> LC_IDENTIFICATION="en_CA.utf8"
> LC_ALL=
> dk@anubis:~$ locale charmap
> UTF-8
> 
> I tested my system under Autopsy 4.9.0 and 4.9.1 and both ran fine.
> While I'm not convinced we are on the right track with the locales
> stuff we could try something:
> 
>   $ sudo dpkg-reconfigure locales (generate "en_US.UTF-8" and set it
> as the default locale)
>   <log out of the Caine X session>
>   $ locale (make sure it's all "en_US.utf8")
>   <test Autopsy again>
> 
> Derrick
> 
> On Sun, Dec 9, 2018 at 10:18 PM <hyl...@is...> wrote:
> > 
> > > Hi Joseph.
> > > 
> > > This question might be better asked directly to Nanni as it
> > > sounds
> > > like it may be Caine specific!  I just tested mbox parsing under
> > > Debian testing w/Autopsy 4.9.1 and didn't have any issues with
> > > keyword
> > > searches.
> > > 
> > > While I don't have a copy of Caine to test with at the moment I
> > > wonder
> > > if it's a manifestation of your systems locale.  If you fire up a
> > > terminal emulator, can you send the output from 'locale' and
> > > 'locale
> > > charmap'?  From MboxParser.java:111 in Autopsy it looks like if
> > > it
> > > can't detect the character encoder that it'll throw that message
> > > but I
> > > could be way off base here.
> > 
> > Hi Derrick,
> > 
> > Thank you very much for the quick reply.  Below is the output of
> > 'locale':
> > 
> > jhylkema@caine-vm:~$ locale
> > LANG=en_US.UTF-8
> > LANGUAGE=en_US
> > LC_CTYPE="en_US.UTF-8"
> > LC_NUMERIC=it_IT.UTF-8
> > LC_TIME=it_IT.UTF-8
> > LC_COLLATE="en_US.UTF-8"
> > LC_MONETARY=it_IT.UTF-8
> > LC_MESSAGES="en_US.UTF-8"
> > LC_PAPER=it_IT.UTF-8
> > LC_NAME=it_IT.UTF-8
> > LC_ADDRESS=it_IT.UTF-8
> > LC_TELEPHONE=it_IT.UTF-8
> > LC_MEASUREMENT=it_IT.UTF-8
> > LC_IDENTIFICATION=it_IT.UTF-8
> > LC_ALL=
> > 
> > And below is the output of 'locale charmap':
> > 
> > jhylkema@caine-vm:~$ locale charmap
> > UTF-8
> > 
> > If I were a betting man, my money would be on the fact that LC_ALL
> > isn't
> > set.  Is that environment variable set in your Debian test distro?
> > 
> > I will also email Nanni.
> > 
> > Thank you.
> > 
> > > 
> > > Derrick
> > > On Sun, Dec 9, 2018 at 1:18 AM Joseph Hylkema <
> > > hyl...@is...>
> > > wrote:
> > > > 
> > > > Hi all,
> > > > 
> > > > First post to the list.
> > > > 
> > > > I am trying to use Autopsy to run some keyword searches on mbox
> > > > files
> > > > downloaded from gmail.  Unfortunately, autopsy returns an
> > > > error:
> > > > "Error while processing:  Could not find appropriate charset
> > > > encoder."
> > > > I am running Autopsy on Caine 10 in a KVM VM with 8GB RAM on a
> > > > Lenovo
> > > > P51 with a Core I7 processor.
> > > > 
> > > > Any help would be appreciated.
> > > > 
> > > > --
> > > > "Far better it is to dare mighty things, to win glorious
> > > > triumphs, even
> > > > though checkered by failure, than to take rank with those poor
> > > > spirits
> > > > who neither enjoy much nor suffer much, because they live in
> > > > the gray
> > > > twilight that knows neither victory nor defeat."
> > > > 
> > > > -- Theodore Roosevelt, "The Strenuous Life."
> > > > 
> > > > 
> > > > 
> > > > _______________________________________________
> > > > sleuthkit-users mailing list
> > > > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> > > > http://www.sleuthkit.org
> > 
> > 

Re: [sleuthkit-users] Charset encoder error when processing mbox files

[Derrick K. <dk...@gm...>]

Hi Joseph.

I've attached my locale output below:

dk@anubis:~$ locale
LANG=en_CA.utf8
LANGUAGE=en_CA:en
LC_CTYPE="en_CA.utf8"
LC_NUMERIC="en_CA.utf8"
LC_TIME="en_CA.utf8"
LC_COLLATE="en_CA.utf8"
LC_MONETARY="en_CA.utf8"
LC_MESSAGES="en_CA.utf8"
LC_PAPER="en_CA.utf8"
LC_NAME="en_CA.utf8"
LC_ADDRESS="en_CA.utf8"
LC_TELEPHONE="en_CA.utf8"
LC_MEASUREMENT="en_CA.utf8"
LC_IDENTIFICATION="en_CA.utf8"
LC_ALL=
dk@anubis:~$ locale charmap
UTF-8

I tested my system under Autopsy 4.9.0 and 4.9.1 and both ran fine.
While I'm not convinced we are on the right track with the locales
stuff we could try something:

  $ sudo dpkg-reconfigure locales (generate "en_US.UTF-8" and set it
as the default locale)
  <log out of the Caine X session>
  $ locale (make sure it's all "en_US.utf8")
  <test Autopsy again>

Derrick

On Sun, Dec 9, 2018 at 10:18 PM <hyl...@is...> wrote:
>
> > Hi Joseph.
> >
> > This question might be better asked directly to Nanni as it sounds
> > like it may be Caine specific!  I just tested mbox parsing under
> > Debian testing w/Autopsy 4.9.1 and didn't have any issues with keyword
> > searches.
> >
> > While I don't have a copy of Caine to test with at the moment I wonder
> > if it's a manifestation of your systems locale.  If you fire up a
> > terminal emulator, can you send the output from 'locale' and 'locale
> > charmap'?  From MboxParser.java:111 in Autopsy it looks like if it
> > can't detect the character encoder that it'll throw that message but I
> > could be way off base here.
>
> Hi Derrick,
>
> Thank you very much for the quick reply.  Below is the output of 'locale':
>
> jhylkema@caine-vm:~$ locale
> LANG=en_US.UTF-8
> LANGUAGE=en_US
> LC_CTYPE="en_US.UTF-8"
> LC_NUMERIC=it_IT.UTF-8
> LC_TIME=it_IT.UTF-8
> LC_COLLATE="en_US.UTF-8"
> LC_MONETARY=it_IT.UTF-8
> LC_MESSAGES="en_US.UTF-8"
> LC_PAPER=it_IT.UTF-8
> LC_NAME=it_IT.UTF-8
> LC_ADDRESS=it_IT.UTF-8
> LC_TELEPHONE=it_IT.UTF-8
> LC_MEASUREMENT=it_IT.UTF-8
> LC_IDENTIFICATION=it_IT.UTF-8
> LC_ALL=
>
> And below is the output of 'locale charmap':
>
> jhylkema@caine-vm:~$ locale charmap
> UTF-8
>
> If I were a betting man, my money would be on the fact that LC_ALL isn't
> set.  Is that environment variable set in your Debian test distro?
>
> I will also email Nanni.
>
> Thank you.
>
> >
> > Derrick
> > On Sun, Dec 9, 2018 at 1:18 AM Joseph Hylkema <hyl...@is...>
> > wrote:
> >>
> >> Hi all,
> >>
> >> First post to the list.
> >>
> >> I am trying to use Autopsy to run some keyword searches on mbox files
> >> downloaded from gmail.  Unfortunately, autopsy returns an error:
> >> "Error while processing:  Could not find appropriate charset encoder."
> >> I am running Autopsy on Caine 10 in a KVM VM with 8GB RAM on a Lenovo
> >> P51 with a Core I7 processor.
> >>
> >> Any help would be appreciated.
> >>
> >> --
> >> "Far better it is to dare mighty things, to win glorious triumphs, even
> >> though checkered by failure, than to take rank with those poor spirits
> >> who neither enjoy much nor suffer much, because they live in the gray
> >> twilight that knows neither victory nor defeat."
> >>
> >> -- Theodore Roosevelt, "The Strenuous Life."
> >>
> >>
> >>
> >> _______________________________________________
> >> sleuthkit-users mailing list
> >> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> >> http://www.sleuthkit.org
> >
>
>

Re: [sleuthkit-users] Charset encoder error when processing mbox files

[Nanni B. <dig...@gm...>]

Hi,
I did not test this, but I have to remind you that Caine 10 has Autopsy 4.9
onboard and not 4.9.1, so could it be a 4.9's issue?
Thanks

Il giorno lun 10 dic 2018 alle ore 06:20 <hyl...@is...> ha scritto:

> > Hi Joseph.
> >
> > This question might be better asked directly to Nanni as it sounds
> > like it may be Caine specific!  I just tested mbox parsing under
> > Debian testing w/Autopsy 4.9.1 and didn't have any issues with keyword
> > searches.
> >
> > While I don't have a copy of Caine to test with at the moment I wonder
> > if it's a manifestation of your systems locale.  If you fire up a
> > terminal emulator, can you send the output from 'locale' and 'locale
> > charmap'?  From MboxParser.java:111 in Autopsy it looks like if it
> > can't detect the character encoder that it'll throw that message but I
> > could be way off base here.
>
> Hi Derrick,
>
> Thank you very much for the quick reply.  Below is the output of 'locale':
>
> jhylkema@caine-vm:~$ locale
> LANG=en_US.UTF-8
> LANGUAGE=en_US
> LC_CTYPE="en_US.UTF-8"
> LC_NUMERIC=it_IT.UTF-8
> LC_TIME=it_IT.UTF-8
> LC_COLLATE="en_US.UTF-8"
> LC_MONETARY=it_IT.UTF-8
> LC_MESSAGES="en_US.UTF-8"
> LC_PAPER=it_IT.UTF-8
> LC_NAME=it_IT.UTF-8
> LC_ADDRESS=it_IT.UTF-8
> LC_TELEPHONE=it_IT.UTF-8
> LC_MEASUREMENT=it_IT.UTF-8
> LC_IDENTIFICATION=it_IT.UTF-8
> LC_ALL=
>
> And below is the output of 'locale charmap':
>
> jhylkema@caine-vm:~$ locale charmap
> UTF-8
>
> If I were a betting man, my money would be on the fact that LC_ALL isn't
> set.  Is that environment variable set in your Debian test distro?
>
> I will also email Nanni.
>
> Thank you.
>
> >
> > Derrick
> > On Sun, Dec 9, 2018 at 1:18 AM Joseph Hylkema <hyl...@is...>
> > wrote:
> >>
> >> Hi all,
> >>
> >> First post to the list.
> >>
> >> I am trying to use Autopsy to run some keyword searches on mbox files
> >> downloaded from gmail.  Unfortunately, autopsy returns an error:
> >> "Error while processing:  Could not find appropriate charset encoder."
> >> I am running Autopsy on Caine 10 in a KVM VM with 8GB RAM on a Lenovo
> >> P51 with a Core I7 processor.
> >>
> >> Any help would be appreciated.
> >>
> >> --
> >> "Far better it is to dare mighty things, to win glorious triumphs, even
> >> though checkered by failure, than to take rank with those poor spirits
> >> who neither enjoy much nor suffer much, because they live in the gray
> >> twilight that knows neither victory nor defeat."
> >>
> >> -- Theodore Roosevelt, "The Strenuous Life."
> >>
> >>
> >>
> >> _______________________________________________
> >> sleuthkit-users mailing list
> >> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> >> http://www.sleuthkit.org
> >
>
>
>
>
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>


-- 
Dott. Nanni Bassetti
http://www.nannibassetti.com
CAINE project manager - http://www.caine-live.net

Re: [sleuthkit-users] Charset encoder error when processing mbox files

[<hyl...@is...>]

> Hi Joseph.
>
> This question might be better asked directly to Nanni as it sounds
> like it may be Caine specific!  I just tested mbox parsing under
> Debian testing w/Autopsy 4.9.1 and didn't have any issues with keyword
> searches.
>
> While I don't have a copy of Caine to test with at the moment I wonder
> if it's a manifestation of your systems locale.  If you fire up a
> terminal emulator, can you send the output from 'locale' and 'locale
> charmap'?  From MboxParser.java:111 in Autopsy it looks like if it
> can't detect the character encoder that it'll throw that message but I
> could be way off base here.

Hi Derrick,

Thank you very much for the quick reply.  Below is the output of 'locale':

jhylkema@caine-vm:~$ locale
LANG=en_US.UTF-8
LANGUAGE=en_US
LC_CTYPE="en_US.UTF-8"
LC_NUMERIC=it_IT.UTF-8
LC_TIME=it_IT.UTF-8
LC_COLLATE="en_US.UTF-8"
LC_MONETARY=it_IT.UTF-8
LC_MESSAGES="en_US.UTF-8"
LC_PAPER=it_IT.UTF-8
LC_NAME=it_IT.UTF-8
LC_ADDRESS=it_IT.UTF-8
LC_TELEPHONE=it_IT.UTF-8
LC_MEASUREMENT=it_IT.UTF-8
LC_IDENTIFICATION=it_IT.UTF-8
LC_ALL=

And below is the output of 'locale charmap':

jhylkema@caine-vm:~$ locale charmap
UTF-8

If I were a betting man, my money would be on the fact that LC_ALL isn't
set.  Is that environment variable set in your Debian test distro?

I will also email Nanni.

Thank you.

>
> Derrick
> On Sun, Dec 9, 2018 at 1:18 AM Joseph Hylkema <hyl...@is...>
> wrote:
>>
>> Hi all,
>>
>> First post to the list.
>>
>> I am trying to use Autopsy to run some keyword searches on mbox files
>> downloaded from gmail.  Unfortunately, autopsy returns an error:
>> "Error while processing:  Could not find appropriate charset encoder."
>> I am running Autopsy on Caine 10 in a KVM VM with 8GB RAM on a Lenovo
>> P51 with a Core I7 processor.
>>
>> Any help would be appreciated.
>>
>> --
>> "Far better it is to dare mighty things, to win glorious triumphs, even
>> though checkered by failure, than to take rank with those poor spirits
>> who neither enjoy much nor suffer much, because they live in the gray
>> twilight that knows neither victory nor defeat."
>>
>> -- Theodore Roosevelt, "The Strenuous Life."
>>
>>
>>
>> _______________________________________________
>> sleuthkit-users mailing list
>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>> http://www.sleuthkit.org
>

Re: [sleuthkit-users] Charset encoder error when processing mbox files

[Derrick K. <dk...@gm...>]

Hi Joseph.

This question might be better asked directly to Nanni as it sounds
like it may be Caine specific!  I just tested mbox parsing under
Debian testing w/Autopsy 4.9.1 and didn't have any issues with keyword
searches.

While I don't have a copy of Caine to test with at the moment I wonder
if it's a manifestation of your systems locale.  If you fire up a
terminal emulator, can you send the output from 'locale' and 'locale
charmap'?  From MboxParser.java:111 in Autopsy it looks like if it
can't detect the character encoder that it'll throw that message but I
could be way off base here.

Derrick
On Sun, Dec 9, 2018 at 1:18 AM Joseph Hylkema <hyl...@is...> wrote:
>
> Hi all,
>
> First post to the list.
>
> I am trying to use Autopsy to run some keyword searches on mbox files
> downloaded from gmail.  Unfortunately, autopsy returns an error:
> "Error while processing:  Could not find appropriate charset encoder."
> I am running Autopsy on Caine 10 in a KVM VM with 8GB RAM on a Lenovo
> P51 with a Core I7 processor.
>
> Any help would be appreciated.
>
> --
> "Far better it is to dare mighty things, to win glorious triumphs, even
> though checkered by failure, than to take rank with those poor spirits
> who neither enjoy much nor suffer much, because they live in the gray
> twilight that knows neither victory nor defeat."
>
> -- Theodore Roosevelt, "The Strenuous Life."
>
>
>
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org

[sleuthkit-users] Charset encoder error when processing mbox files

[Joseph H. <hyl...@is...>]

Hi all, 

First post to the list.  

I am trying to use Autopsy to run some keyword searches on mbox files
downloaded from gmail.  Unfortunately, autopsy returns an error: 
"Error while processing:  Could not find appropriate charset encoder." 
I am running Autopsy on Caine 10 in a KVM VM with 8GB RAM on a Lenovo
P51 with a Core I7 processor.

Any help would be appreciated.

-- 
"Far better it is to dare mighty things, to win glorious triumphs, even
though checkered by failure, than to take rank with those poor spirits
who neither enjoy much nor suffer much, because they live in the gray
twilight that knows neither victory nor defeat."

-- Theodore Roosevelt, "The Strenuous Life."

[sleuthkit-users] Running several instances of multi-user Autopsy from same host, with different users

[Luis 'P. G. <po...@po...>]

Hi everyone,

I'm very happy to say I managed to get multi-user Autopsy running on Linux
(all of it). In particular, Ubuntu 18.04 LTS with these components:

   - postgresql 10 as shipped with the distro.
   - activemq 5.15 as shipped with the distro.
   - solr-4.10.3 (not the bitnami stack, just the regular download from
   Apache website).

I do know the doc suggests running the multi-user services in 1-2 separate
machines, however I'm using a fairly powerful system (140 GB RAM and a
bunch of Xeon processors) and everything is running in the same host right
now - including the Autopsy program itself.

Thing is, I have a number of users on that server and I would like each of
those accounts to run Autopsy in this same host (each sending their X
windows to the corresponding windows server in their local machine).

I have observed that the file structure created in the storage is like:

(autopsy base dir) / (case name) / (host name) / ....


And I am concerned this may cause issues when several connections to the
same case are open from the same host. Wouldn't it make sense to use "user
name + host name" instead of just host name? That would be:

(autopsy base dir) / (case name) / (user name) @ (host name) / ....

If anyone has valuable input, I will appreciate it. Otherwise, I may open
an issue about this in github.

Thanks for your time,

Pope

Re: [sleuthkit-users] Autopsy Not Running on Linux

[Derrick K. <dk...@gm...>]

Excellent!

Any custom plugins would be copied into there so those would need to be
copied back into ~/.autopsy/dev/python_modules.  The shortcut listing of
your recent cases is listed there to so you'll have to manually browse and
open any previous cases.  If you have any custom ingest module settings
then those get nuked as well including things like custom keywords etc.
from what I recall.  Also, the Autopsy debug logs are in there so you might
want to check out the logs in ~/.autopsy/dev/var/log if you want to dig
into debugging your startup issue!  I don't have a full listing of what's
in that directory but it's a bunch of cached items that Autopsy will
regenerate cleanly on first run.

Removing ~/.autopsy is a pretty big hammer and I think you might be able to
get away with removing ~/.autopsy/dev/config/Preferences or one of the
other directories underneath there.  I was looking through my old emails
trying to find out which I removed when I had this issue way back when but
I can't seem to locate it.

Derrick


On Mon, Nov 26, 2018 at 11:38 AM Daniel Oliveira <dan...@gm...>
wrote:

> Worked like a charm. Thank you so much!
>
> What do i lose by deleting .autopsy ?
>
> Em seg, 26 de nov de 2018 às 16:34, Derrick Karpo <dk...@gm...>
> escreveu:
>
>> Hello.
>>
>> If you are running Oracle's Java 8, can you try move your old ~/.autopsy
>> directory out of the way and run Autopsy again to see what happens?
>>
>>   $ mv ~/.autopsy ~/.autopsy-ORIG
>>
>> Derrick
>>
>>
>> On Sun, Nov 25, 2018 at 6:51 AM Daniel Oliveira <dan...@gm...>
>> wrote:
>>
>>>
>>> Hello everyone im on Linux Mint 19 and was runnig Autopsy OK. Java from
>>> Oracle and all dependencies are OK. Any ideas  about whats going on?
>>>
>>> *devzero@jupiter:~/tools/autopsy$ sh unix_setup.sh *
>>> photorec found
>>> Java found in /usr
>>> /usr/share/java/sleuthkit-4.6.4.jar found
>>> Copying into the Autopsy directory
>>> Autopsy is now configured. You can execute bin/autopsy to start it
>>> *devzero@jupiter:~/tools/autopsy$ ./bin/autopsy *
>>>
>>> *then:*
>>>
>>> [image: Captura de tela de 2018-11-25 09-53-12.png]
>>>
>>> --
>>> Daniel Oliveira
>>> _______________________________________________
>>> sleuthkit-users mailing list
>>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>>> http://www.sleuthkit.org
>>>
>>
>
> --
> Daniel Oliveira
>

Re: [sleuthkit-users] Autopsy Not Running on Linux

[Daniel O. <dan...@gm...>]

Worked like a charm. Thank you so much!

What do i lose by deleting .autopsy ?

Em seg, 26 de nov de 2018 às 16:34, Derrick Karpo <dk...@gm...>
escreveu:

> Hello.
>
> If you are running Oracle's Java 8, can you try move your old ~/.autopsy
> directory out of the way and run Autopsy again to see what happens?
>
>   $ mv ~/.autopsy ~/.autopsy-ORIG
>
> Derrick
>
>
> On Sun, Nov 25, 2018 at 6:51 AM Daniel Oliveira <dan...@gm...>
> wrote:
>
>>
>> Hello everyone im on Linux Mint 19 and was runnig Autopsy OK. Java from
>> Oracle and all dependencies are OK. Any ideas  about whats going on?
>>
>> *devzero@jupiter:~/tools/autopsy$ sh unix_setup.sh *
>> photorec found
>> Java found in /usr
>> /usr/share/java/sleuthkit-4.6.4.jar found
>> Copying into the Autopsy directory
>> Autopsy is now configured. You can execute bin/autopsy to start it
>> *devzero@jupiter:~/tools/autopsy$ ./bin/autopsy *
>>
>> *then:*
>>
>> [image: Captura de tela de 2018-11-25 09-53-12.png]
>>
>> --
>> Daniel Oliveira
>> _______________________________________________
>> sleuthkit-users mailing list
>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>> http://www.sleuthkit.org
>>
>

-- 
Daniel Oliveira

Re: [sleuthkit-users] Autopsy Not Running on Linux

[Derrick K. <dk...@gm...>]

Hello.

If you are running Oracle's Java 8, can you try move your old ~/.autopsy
directory out of the way and run Autopsy again to see what happens?

  $ mv ~/.autopsy ~/.autopsy-ORIG

Derrick


On Sun, Nov 25, 2018 at 6:51 AM Daniel Oliveira <dan...@gm...>
wrote:

>
> Hello everyone im on Linux Mint 19 and was runnig Autopsy OK. Java from
> Oracle and all dependencies are OK. Any ideas  about whats going on?
>
> *devzero@jupiter:~/tools/autopsy$ sh unix_setup.sh *
> photorec found
> Java found in /usr
> /usr/share/java/sleuthkit-4.6.4.jar found
> Copying into the Autopsy directory
> Autopsy is now configured. You can execute bin/autopsy to start it
> *devzero@jupiter:~/tools/autopsy$ ./bin/autopsy *
>
> *then:*
>
> [image: Captura de tela de 2018-11-25 09-53-12.png]
>
> --
> Daniel Oliveira
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>

[sleuthkit-users] Autopsy Not Running on Linux

[Daniel O. <dan...@gm...>]

Hello everyone im on Linux Mint 19 and was runnig Autopsy OK. Java from
Oracle and all dependencies are OK. Any ideas  about whats going on?

*devzero@jupiter:~/tools/autopsy$ sh unix_setup.sh *
photorec found
Java found in /usr
/usr/share/java/sleuthkit-4.6.4.jar found
Copying into the Autopsy directory
Autopsy is now configured. You can execute bin/autopsy to start it
*devzero@jupiter:~/tools/autopsy$ ./bin/autopsy *

*then:*

[image: Captura de tela de 2018-11-25 09-53-12.png]

-- 
Daniel Oliveira

Re: [sleuthkit-users] "Proper" install method for TSK on Ubuntu

[Derrick K. <dk...@gm...>]

tl;dr please try recompile with the below patch applied to srch_strings.c?

Hmmm.  That is odd.  I *may* have been able to replicate the error
here albeit my srch_strings doesn't core dump but throws a double free
error on a text file as well (Mine is broken too!??!!?):

<snip>
<snip>
dk@anubis:~$ srch_strings -a /usr/share/common-licenses/GPL-3
                    GNU GENERAL PUBLIC LICENSE
                       Version 3, 29 June 2007
double free or corruption (fasttop)
Aborted
<snip>
<snip>

I ran it through valgrind to figure out what is up and it may be the
free() call that's in srch_strings.c:589.  Keep in mind that IANACPBAM
(I Am Not A C Programmer By Any Means) so take this with a grain of
salt.  :)  srch_strings.c allocates a 'unsigned char buf[4];' and then
later calls free() on this buf[].  My understanding is in C you don't
need to free() arrays like this as they automatically get deallocated
when the function returns.  You only need to free() pointers that are
malloc() etc.

After removing the call to free() on line 589 srch_strings runs
cleanly and does not explode.  For good measure, the below patch
removes both free() calls since they are both operating on that same
buf[].  Hopefully Brian et al or some other actual C coder can comment
if I'm on glue or not as this seems too simple to fix the problem!

Did it fix anything?

Derrick


Here's the patch:

dk@anubis:~/sc/git-ext/sleuthkit$ diff -u
tools/srchtools/srch_strings.c-ORIG tools/srchtools/srch_strings.c
--- tools/srchtools/srch_strings.c-ORIG 2018-11-19 18:51:46.936162930 -0700
+++ tools/srchtools/srch_strings.c      2018-11-19 19:07:48.990158388 -0700
@@ -554,7 +554,6 @@
        {
          c = get_char (stream, &address, &magiccount, &magic);
          if (c == EOF) {
-            free(buf);
            return;
           }
          if (! STRING_ISGRAPHIC (c))
@@ -586,7 +585,6 @@

       buf[i] = '\0';
       fputs (buf, stdout);
-      free(buf);

       while (1)
        {

Re: [sleuthkit-users] "Proper" install method for TSK on Ubuntu

[Tom Y. <to...@ya...>]

I can try that, but it will dump if I just run it against a text file.
Also, this isn't confined to one machine, we're talking three or four
different systems (over the span of two or so years). The rest of the TSK
tools work fine (except for the recent problem I had with fls), it's only
srch_strings.

Tom

PGP Key ID - B32585D0


On Mon, Nov 19, 2018 at 3:35 PM Derrick Karpo <dk...@gm...> wrote:

> Hi Tom.
>
> I doubt you are doing anything wrong in regards to getting TSK built
> and installed on your machine.  I'm wondering if you have something
> else up with your machine in regards to insufficient memory, a bad
> memory module, or maybe a kernel issue?  I suspect the issue isn't
> within TSK but maybe you could link us your core dump to investigate
> further.
>
> I replicated using srch_strings and fls using my latest "TCU Live"
> (https://drive.google.com/drive/u/1/folders/0B8zx3qPcj9rJVjJrcnB4aXl1VG8)
> on a couple different hardware configs and within a KVM VM.  I didn't
> run in to any issues at all so as a test maybe try using that as a
> base just to rule out any hardware or kernel issues?
>
> Derrick
>
>
> On Fri, Nov 16, 2018 at 11:26 PM Tom Yarrish <to...@ya...> wrote:
> >
> > Hello,
> > I wanted to find out if anyone has or knows of a write up on the proper
> way to install TSK on an Ubuntu system. I'm not talking about using the
> packages (because they are behind in terms of releases), I mean building
> from the Source Release packages on the Github site.
> >
> > The reason I'm asking is there seems to be a step I'm missing. The last
> three version of Ubuntu I've run (all LTS) I've never been able to run
> srch_strings on it. It ALWAYS core dumps. Even if I run it against a text
> file.
> >
> > Then recently I was using F-Response (my Tactical license) to connect to
> a VM running on my Ubuntu Host (Windows Guest). I had a raw image of the
> guest mounted, but when I tried to do an fls on it (I was looking for a
> specific file), it core dumped.
> >
> > I'm at the point that I'm wonder if there's an installation step that
> I'm doing wrong, some library I might be missing, or something else. No
> matter which way I've installed it, apt for all the packages (even libewf,
> libaff, etc), or using apt for libewf, libaff, etc and then installing from
> the release source, or even a git pull from the Github site, I end up with
> the same result.
> >
> > I'm getting ready to build a new Linux Forensic laptop (Ubuntu 18.04) so
> I wanted to get the kinks out of my install process (and I'd rather not run
> the SIFT installer on top of it).
> >
> > Thanks.....
> > Tom
> >
> > PGP Key ID - B32585D0
> > _______________________________________________
> > sleuthkit-users mailing list
> > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> > http://www.sleuthkit.org
>

Re: [sleuthkit-users] "Proper" install method for TSK on Ubuntu

[Derrick K. <dk...@gm...>]

Hi Tom.

I doubt you are doing anything wrong in regards to getting TSK built
and installed on your machine.  I'm wondering if you have something
else up with your machine in regards to insufficient memory, a bad
memory module, or maybe a kernel issue?  I suspect the issue isn't
within TSK but maybe you could link us your core dump to investigate
further.

I replicated using srch_strings and fls using my latest "TCU Live"
(https://drive.google.com/drive/u/1/folders/0B8zx3qPcj9rJVjJrcnB4aXl1VG8)
on a couple different hardware configs and within a KVM VM.  I didn't
run in to any issues at all so as a test maybe try using that as a
base just to rule out any hardware or kernel issues?

Derrick


On Fri, Nov 16, 2018 at 11:26 PM Tom Yarrish <to...@ya...> wrote:
>
> Hello,
> I wanted to find out if anyone has or knows of a write up on the proper way to install TSK on an Ubuntu system. I'm not talking about using the packages (because they are behind in terms of releases), I mean building from the Source Release packages on the Github site.
>
> The reason I'm asking is there seems to be a step I'm missing. The last three version of Ubuntu I've run (all LTS) I've never been able to run srch_strings on it. It ALWAYS core dumps. Even if I run it against a text file.
>
> Then recently I was using F-Response (my Tactical license) to connect to a VM running on my Ubuntu Host (Windows Guest). I had a raw image of the guest mounted, but when I tried to do an fls on it (I was looking for a specific file), it core dumped.
>
> I'm at the point that I'm wonder if there's an installation step that I'm doing wrong, some library I might be missing, or something else. No matter which way I've installed it, apt for all the packages (even libewf, libaff, etc), or using apt for libewf, libaff, etc and then installing from the release source, or even a git pull from the Github site, I end up with the same result.
>
> I'm getting ready to build a new Linux Forensic laptop (Ubuntu 18.04) so I wanted to get the kinks out of my install process (and I'd rather not run the SIFT installer on top of it).
>
> Thanks.....
> Tom
>
> PGP Key ID - B32585D0
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org

[sleuthkit-users] libswt-gtk-3-java (unlisted requirement for Autopsy in Linux)

[Luis 'P. G. <po...@po...>]

Hi everyone

TL/DR: libswt-gtk-3-java is a requirement, not listed anywhere.

I was trying to get Autopsy running on Linux, under different distros so
far: Debian 9.6, Ubuntu 18.04 LTS, and Kali, all of them 64-bit.

After installing sleuthkit-java and following all these steps
<https://github.com/sleuthkit/autopsy/blob/develop/Running_Linux_OSX.txt>,
the software would run but I couldn't create cases. Thing is:

   - Click "Create case"
   - Enter case name and base path (permissions are OK there)
   - Optionally enter case number, notes...
   - Upon clicking FINISH, "creating case database" appears briefly and
   then a dialog is shown with "Cannot create case", and "null" as the only
   description, and an OK button.
   - After this point, if the above process is repeated, the same error
   appears but instead of null, it says: "Cannot initialize
   class.org.sleuthkit.autopsy.casemodule.services.TagNameDefinition".

In the bottom right corner I could see this error: "Error initializing
JavaFX. Some features will not be available. Check that you have the right
JRE installed (Oracle JRE > 1.7.10)."

I tried to get Java in several ways, including this PPA repo
<https://medium.com/coderscorner/installing-oracle-java-8-in-ubuntu-16-10-845507b13343>,
as well as downloading jdk-8u192-linux-x64.tar.gz
and/or server-jre-8u192-linux-x64.tar.gz directly from Oracle, and
update-alternatives accordingly, and putting the right JAVA_HOME in
/etc/environment.

Finally found the solution here:
https://stackoverflow.com/questions/21185156/javafx-on-linux-is-showing-a-graphics-device-initialization-failed-for-es2-s
and it's as simple as installing libswt-gtk-3-java. I guess this should be
a dependency of the sleuthkit-java package.

Now let's enjoy it in Linux. I've been missing this since the good old 2.x
days!

Pope

Re: [sleuthkit-users] Recent Releases

[Nanni B. <dig...@gm...>]

I tested it and yes there is a problem in the pictures preview and in the
gallery, for the rest it works...so maybe it's better to wait some months
before releasing a new CAINE, so I can gather, eventually, new issues not
only about Autopsy. I was been unlucky this time :-)

<https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail>
Mail
priva di virus. www.avast.com
<https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail>
<#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2>

Il giorno sab 17 nov 2018 alle ore 14:07 Stephen Pearson <st...@go...>
ha scritto:

> Nanni,
>
> You will want to update. Our test images failed using 4.9.0 an worked
> correctly under 4.9.1.
>
>
>
>
>
> V/r
>
> Stephen
>
>
>
> *From:* Nanni Bassetti <dig...@gm...>
> *Sent:* Saturday, November 17, 2018 4:46 AM
> *To:* Brian Carrier <ca...@sl...>
> *Cc:* sle...@li... users <
> sle...@li...>;
> sle...@li...
> *Subject:* Re: [sleuthkit-users] Recent Releases
>
>
>
> Oh no! Just a Week ago I release CAINE 10.0 with Autopsy 4.9 on board, I
> dont want to remake the dietro :-D I hope this bug is not so bad...what do
> you think?
>
> Thanks
>
>
>
> Dott. Nanni Bassetti
>
> http://www.nannibassetti.com
>
> CAINE project manager - http://www.caine-live.net
>
>
>
>
> Il giorno Ven 16 Nov 2018, 20:21 Brian Carrier <ca...@sl...> ha
> scritto:
>
> I just realized that I did not do a very good job at announcing the past
> two releases via email.  The Autopsy 4.9.1 release was focused on a fairly
> serious Image Gallery bug fix (that could cause the entire application to
> hang).  Autopsy 4.9.0 had the bulk of the new features.
>
>
>
> Autopsy Download: http://www.sleuthkit.org/autopsy/download.php
>
> The Sleuth Kit Download: http://www.sleuthkit.org/sleuthkit/download.php
>
>
>
> Autopsy Highlights:
>
>    - Added ability to find common items (files, emails, etc.) between
>    current case and past cases using the Central Repository.
>    - Added ability to ignore common items that exist in a large number of
>    cases by using Central Repository data.
>    - Allow users to specify that an ad-hoc keyword search should not be
>    saved to database
>    - New “Annotations” content viewer that shows all tags and comments
>    associated with an item
>    - Added 2 icons to the table to show the item’s score (if it is
>    notable or suspicious) and if it has a comment.
>    - Added column to the table to show previous number of occurrences.
>    - Tags are now associated with the user (in a multi-user environment)
>    and you can hide other people’s tags
>    - Hash sets can be copied into the user’s config folder (AppData),
>    which makes it easier to run Autopsy from a Live Triage USB and not care
>    about what drive letter it gets.
>    - Image Gallery works better in multi-user setups and reloads the
>    database when other nodes add data sources.
>
> The Sleuth Kit Highlights:
>
>    - Mostly all changes to support Autopsy features.
>
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>
> HTCI offers Training Software and Consultation. See all of our latest
> tools at http://www.gohtci.com , training.gohtci.com , dart.gohtci.com,
> and maplink.gohtci.com High Tech Crime Institute is a Verified Service
> Disabled Veteran Owned Small Business. We are of the Troops and still
> serving the Troops CONFIDENTIALITY NOTICE: This message contains
> confidential information and is intended only for this email's recipient.
> If you are not the named addressee, you should not disseminate, distribute
> or copy this e-mail. Please notify tec...@go... immediately by
> e-mail if you have received this e-mail by mistake, delete this e-mail from
> your system. E-mail transmission cannot be guaranteed to be secure or
> error-free as information could be intercepted, corrupted, lost, destroyed,
> arrive late or incomplete or contain viruses. High Tech Crime Institute Inc
> therefore does not accept liability for any errors or omissions in the
> contents of this message, which arise as a result of e-mail transmission.
> If verification is required please request a hard-copy version. High Tech
> Crime Institute Group Inc., 695 Alderman Road Palm Harbor, FL 34683
>


-- 
Dott. Nanni Bassetti
http://www.nannibassetti.com
CAINE project manager - http://www.caine-live.net

INFORMATIVA TRATTAMENTO DATI:
I dati da voi inviati alla mia e-mail dig...@gm... (
https://www.google.com/intl/it/policies/privacy/) sono trattati
esclusivamente da me medesimo (Dott. Giovanni Bassetti) presso la mia sede
legale e protetti adeguatamente e gli allegati sono anche conservati
cifrati. Per qualsiasi informazione e richiesta non esitate a contattarmi.
L'interessato, può chiedere in qualsiasi momento informazioni e/o
cancellazione dei suoi dati. La finalità, la tempistica e la modalità del
trattamento è formata dalla richiesta stessa dell'interessato e degli
accordi intrapresi col sottoscritto.*Si prega di LEGGERE l'informativa
completa sulla PRIVACY* https://nannibassetti.com/privacy.html
<https://nannibassetti.com/privacy.html>

<https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail>
Mail
priva di virus. www.avast.com
<https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail>
<#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2>

[sleuthkit-users] Odp: Recent Releases

[grzegorz.ginalski <grz...@o2...>]

I installed Autopsy 4.9.1 but Image Gallery does not work properly for me. It hangs while i scrolling images. It is impossible to view photos.   Regards  Grzegorz Ginalski 
                
              
               
                 
                  Dnia 16 listopada 2018 20:21 Brian Carrier <ca...@sl...> napisał(a):
                 
                 
                   I just realized that I did not do a very good job at announcing the past two releases via email.  The Autopsy 4.9.1 release was focused on a fairly serious Image Gallery bug fix (that could cause the entire application to hang).  Autopsy 4.9.0 had the bulk of the new features.    Autopsy Download:  www.sleuthkit.org www.sleuthkit.org The Sleuth Kit Download:  www.sleuthkit.org www.sleuthkit.org   Autopsy Highlights:   Added ability to find common items (files, emails, etc.) between current case and past cases using the Central Repository. Added ability to ignore common items that exist in a large number of cases by using Central Repository data. Allow users to specify that an ad-hoc keyword search should not be saved to database New “Annotations” content viewer that shows all tags and comments associated with an item Added 2 icons to the table to show the item’s score (if it is notable or suspicious) and if it has a comment. Added column to the table to show previous number of occurrences. Tags are now associated with the user (in a multi-user environment) and you can hide other people’s tags Hash sets can be copied into the user’s config folder (AppData), which makes it easier to run Autopsy from a Live Triage USB and not care about what drive letter it gets. Image Gallery works better in multi-user setups and reloads the database when other nodes add data sources. The Sleuth Kit Highlights: Mostly all changes to support Autopsy features.  ______________________________ 
 sleuthkit-users mailing list 
 lists.sourceforge.net lists.sourceforge.net 
 www.sleuthkit.org www.sleuthkit.org

Re: [sleuthkit-users] Recent Releases

[Nanni B. <dig...@gm...>]

Oh no! Just a Week ago I release CAINE 10.0 with Autopsy 4.9 on board, I
dont want to remake the dietro :-D I hope this bug is not so bad...what do
you think?
Thanks



Dott. Nanni Bassetti

http://www.nannibassetti.com

CAINE project manager - http://www.caine-live.net




Il giorno Ven 16 Nov 2018, 20:21 Brian Carrier <ca...@sl...> ha
scritto:

> I just realized that I did not do a very good job at announcing the past
> two releases via email.  The Autopsy 4.9.1 release was focused on a fairly
> serious Image Gallery bug fix (that could cause the entire application to
> hang).  Autopsy 4.9.0 had the bulk of the new features.
>
> Autopsy Download: http://www.sleuthkit.org/autopsy/download.php
> The Sleuth Kit Download: http://www.sleuthkit.org/sleuthkit/download.php
>
> Autopsy Highlights:
>
>    - Added ability to find common items (files, emails, etc.) between
>    current case and past cases using the Central Repository.
>    - Added ability to ignore common items that exist in a large number of
>    cases by using Central Repository data.
>    - Allow users to specify that an ad-hoc keyword search should not be
>    saved to database
>    - New “Annotations” content viewer that shows all tags and comments
>    associated with an item
>    - Added 2 icons to the table to show the item’s score (if it is
>    notable or suspicious) and if it has a comment.
>    - Added column to the table to show previous number of occurrences.
>    - Tags are now associated with the user (in a multi-user environment)
>    and you can hide other people’s tags
>    - Hash sets can be copied into the user’s config folder (AppData),
>    which makes it easier to run Autopsy from a Live Triage USB and not care
>    about what drive letter it gets.
>    - Image Gallery works better in multi-user setups and reloads the
>    database when other nodes add data sources.
>
> The Sleuth Kit Highlights:
>
>    - Mostly all changes to support Autopsy features.
>
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>

[sleuthkit-users] "Proper" install method for TSK on Ubuntu

[Tom Y. <to...@ya...>]

Hello,
I wanted to find out if anyone has or knows of a write up on the proper way
to install TSK on an Ubuntu system. I'm not talking about using the
packages (because they are behind in terms of releases), I mean building
from the Source Release packages on the Github site.

The reason I'm asking is there seems to be a step I'm missing. The last
three version of Ubuntu I've run (all LTS) I've never been able to run
srch_strings on it. It ALWAYS core dumps. Even if I run it against a text
file.

Then recently I was using F-Response (my Tactical license) to connect to a
VM running on my Ubuntu Host (Windows Guest). I had a raw image of the
guest mounted, but when I tried to do an fls on it (I was looking for a
specific file), it core dumped.

I'm at the point that I'm wonder if there's an installation step that I'm
doing wrong, some library I might be missing, or something else. No matter
which way I've installed it, apt for all the packages (even libewf, libaff,
etc), or using apt for libewf, libaff, etc and then installing from the
release source, or even a git pull from the Github site, I end up with the
same result.

I'm getting ready to build a new Linux Forensic laptop (Ubuntu 18.04) so I
wanted to get the kinks out of my install process (and I'd rather not run
the SIFT installer on top of it).

Thanks.....
Tom

PGP Key ID - B32585D0