sleuthkit-users — List to discuss Autopsy and The Sleuth Kit.

Re: [sleuthkit-users] fiwalk output

[Simson G. <si...@ac...>]

The real question is this — how does SleuthKit handle it, and how do you want to indicate it?

On Oct 11, 2013, at 1:46 PM, Alex Nelson <ajn...@cs...> wrote:

> That's interesting.  It might, but I don't understand the whole situation you're describing.  What are indicators of reallocation for a disk image at a single point in time?  Do you mean multiple hard-links to the same file exist and are legitimate files?  Or do you mean a file was unlinked somewhere and reallocated, but the file system was imaged in an inconsistent state?
> 
> --Alex
> 
> 
> On Oct 11, 2013, at 13:36 , Jason Wright <jwr...@gm...> wrote:
> 
>> All,
>> 
>> 
>> Does the dfxml output of fiwalk report whether a file object has been reallocated? Fls will (indicated by realloc), but will fiwalk do the same? I've come across this situation for a particular ntfs partition and have found two references for the same inode in fiwalk. In know which one is the allocated entry based off of fls, but I'm not sure of how that can be identified in fiwalk. Does anyone have any suggestions?
>> 
>> Thanks,
>> 
>> Jason Wright
>> ------------------------------------------------------------------------------
>> October Webinars: Code for Performance
>> Free Intel webinars can help you accelerate application performance.
>> Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from 
>> the latest Intel processors and coprocessors. See abstracts and register >
>> http://pubads.g.doubleclick.net/gampad/clk?id=60134071&iu=/4140/ostg.clktrk_______________________________________________
>> sleuthkit-users mailing list
>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>> http://www.sleuthkit.org
> 
> ------------------------------------------------------------------------------
> October Webinars: Code for Performance
> Free Intel webinars can help you accelerate application performance.
> Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from 
> the latest Intel processors and coprocessors. See abstracts and register >
> http://pubads.g.doubleclick.net/gampad/clk?id=60134071&iu=/4140/ostg.clktrk_______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org

Re: [sleuthkit-users] fiwalk output

[Jason W. <jwr...@gm...>]

Yes, it does normally, but in this case it did not. For both entries in the
dfxml, the alloc field is 1.


On Fri, Oct 11, 2013 at 2:34 PM, Simson Garfinkel <si...@ac...> wrote:

> The XML indicates whether the file is allocated or not.
>
> On Oct 11, 2013, at 2:32 PM, Jason Wright <jwr...@gm...> wrote:
>
> I don't have the exact fiwalk output accessible here, so sorry that I
> can't paste it in for more clarity, but at present the only difference in
> the fileobjects for both inodes in the dfxml, is the filename. After
> researching I think found that one was for a deleted entry based off of
> some fls output I obtained. That cleared things up. My next thought was
> then, how can I use fiwalk to help differentiate between the allocated and
> deleted entries for two files referencing the same inode from the same
> partition on a drive.
>
> I'm not sure there is anything at present and wanted to find out before
> creating something on my own.
>
> Thanks again,
>
> Jason
>
>
> On Fri, Oct 11, 2013 at 2:19 PM, Alex Nelson <ajn...@cs...> wrote:
>
>> Whoops, looks like you beat me to a response.  But yes, that clarifies
>> your question.
>>
>> I think your question boils down to recording allocation status.  Do you
>> have DFXML output from Fiwalk?  Are there <alloc> or <unalloc> elements for
>> the fileobjects that you're looking at?
>>
>> --Alex
>>
>>
>> On Oct 11, 2013, at 14:16 , Jason Wright <jwr...@gm...> wrote:
>>
>> Thanks, Alex. What I've come across is two references for the same inode
>> in the fiwalk output for a particular drive. Both are on the same
>> partition. One is for the allocated file the other is for the unallocated
>> state for the filename of the file that previously used the inode.
>>
>> If running fls and looking for inode 79456, for example, you may get
>> these two outputs
>> +++ r/r 79456-128-3: filename1.ext
>> ++++++++ r/r 79456-128-3(realloc): filename2.ext
>>
>> So, in this case filename2.ext is a reference for a file that once used
>> inode 79456 and the file that currently uses the inode is filename1.ext.
>>
>> What I'm interested in is a possible reference in the dfxml fiwalk output
>> that would differentiate the two references?
>>
>> Hopefully, that helps explain it a little better.
>>
>> R/
>>
>> Jason
>>
>>
>>
>>
>> On Fri, Oct 11, 2013 at 1:46 PM, Alex Nelson <ajn...@cs...>wrote:
>>
>>> That's interesting.  It might, but I don't understand the whole
>>> situation you're describing.  What are indicators of reallocation for a
>>> disk image at a single point in time?  Do you mean multiple hard-links to
>>> the same file exist and are legitimate files?  Or do you mean a file was
>>> unlinked somewhere and reallocated, but the file system was imaged in an
>>> inconsistent state?
>>>
>>> --Alex
>>>
>>>
>>> On Oct 11, 2013, at 13:36 , Jason Wright <jwr...@gm...> wrote:
>>>
>>> All,
>>>
>>>
>>> Does the dfxml output of fiwalk report whether a file object has been
>>> reallocated? Fls will (indicated by realloc), but will fiwalk do the same?
>>> I've come across this situation for a particular ntfs partition and have
>>> found two references for the same inode in fiwalk. In know which one is the
>>> allocated entry based off of fls, but I'm not sure of how that can be
>>> identified in fiwalk. Does anyone have any suggestions?
>>>
>>> Thanks,
>>>
>>> Jason Wright
>>>
>>> ------------------------------------------------------------------------------
>>> October Webinars: Code for Performance
>>> Free Intel webinars can help you accelerate application performance.
>>> Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most
>>> from
>>> the latest Intel processors and coprocessors. See abstracts and register
>>> >
>>>
>>> http://pubads.g.doubleclick.net/gampad/clk?id=60134071&iu=/4140/ostg.clktrk_______________________________________________
>>> sleuthkit-users mailing list
>>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>>> http://www.sleuthkit.org
>>>
>>>
>>>
>>
>>
>
> ------------------------------------------------------------------------------
> October Webinars: Code for Performance
> Free Intel webinars can help you accelerate application performance.
> Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most
> from
> the latest Intel processors and coprocessors. See abstracts and register >
>
> http://pubads.g.doubleclick.net/gampad/clk?id=60134071&iu=/4140/ostg.clktrk_______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>
>
>

Re: [sleuthkit-users] fiwalk output

[Alex N. <ajn...@cs...>]

Whoops, looks like you beat me to a response.  But yes, that clarifies your question.

I think your question boils down to recording allocation status.  Do you have DFXML output from Fiwalk?  Are there <alloc> or <unalloc> elements for the fileobjects that you're looking at?

--Alex


On Oct 11, 2013, at 14:16 , Jason Wright <jwr...@gm...> wrote:

> Thanks, Alex. What I've come across is two references for the same inode in the fiwalk output for a particular drive. Both are on the same partition. One is for the allocated file the other is for the unallocated state for the filename of the file that previously used the inode. 
> 
> If running fls and looking for inode 79456, for example, you may get these two outputs
> +++ r/r 79456-128-3: filename1.ext
> ++++++++ r/r 79456-128-3(realloc): filename2.ext
> 
> So, in this case filename2.ext is a reference for a file that once used inode 79456 and the file that currently uses the inode is filename1.ext. 
> 
> What I'm interested in is a possible reference in the dfxml fiwalk output that would differentiate the two references?
> 
> Hopefully, that helps explain it a little better. 
> 
> R/
> 
> Jason
> 
> 
> 
> 
> On Fri, Oct 11, 2013 at 1:46 PM, Alex Nelson <ajn...@cs...> wrote:
> That's interesting.  It might, but I don't understand the whole situation you're describing.  What are indicators of reallocation for a disk image at a single point in time?  Do you mean multiple hard-links to the same file exist and are legitimate files?  Or do you mean a file was unlinked somewhere and reallocated, but the file system was imaged in an inconsistent state?
> 
> --Alex
> 
> 
> On Oct 11, 2013, at 13:36 , Jason Wright <jwr...@gm...> wrote:
> 
>> All,
>> 
>> 
>> Does the dfxml output of fiwalk report whether a file object has been reallocated? Fls will (indicated by realloc), but will fiwalk do the same? I've come across this situation for a particular ntfs partition and have found two references for the same inode in fiwalk. In know which one is the allocated entry based off of fls, but I'm not sure of how that can be identified in fiwalk. Does anyone have any suggestions?
>> 
>> Thanks,
>> 
>> Jason Wright
>> ------------------------------------------------------------------------------
>> October Webinars: Code for Performance
>> Free Intel webinars can help you accelerate application performance.
>> Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from 
>> the latest Intel processors and coprocessors. See abstracts and register >
>> http://pubads.g.doubleclick.net/gampad/clk?id=60134071&iu=/4140/ostg.clktrk_______________________________________________
>> sleuthkit-users mailing list
>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>> http://www.sleuthkit.org
> 
> 

Re: [sleuthkit-users] fiwalk output

[Simson G. <si...@ac...>]

The XML indicates whether the file is allocated or not.

On Oct 11, 2013, at 2:32 PM, Jason Wright <jwr...@gm...> wrote:

> I don't have the exact fiwalk output accessible here, so sorry that I can't paste it in for more clarity, but at present the only difference in the fileobjects for both inodes in the dfxml, is the filename. After researching I think found that one was for a deleted entry based off of some fls output I obtained. That cleared things up. My next thought was then, how can I use fiwalk to help differentiate between the allocated and deleted entries for two files referencing the same inode from the same partition on a drive. 
> 
> I'm not sure there is anything at present and wanted to find out before creating something on my own. 
> 
> Thanks again,
> 
> Jason
> 
> 
> On Fri, Oct 11, 2013 at 2:19 PM, Alex Nelson <ajn...@cs...> wrote:
> Whoops, looks like you beat me to a response.  But yes, that clarifies your question.
> 
> I think your question boils down to recording allocation status.  Do you have DFXML output from Fiwalk?  Are there <alloc> or <unalloc> elements for the fileobjects that you're looking at?
> 
> --Alex
> 
> 
> On Oct 11, 2013, at 14:16 , Jason Wright <jwr...@gm...> wrote:
> 
>> Thanks, Alex. What I've come across is two references for the same inode in the fiwalk output for a particular drive. Both are on the same partition. One is for the allocated file the other is for the unallocated state for the filename of the file that previously used the inode. 
>> 
>> If running fls and looking for inode 79456, for example, you may get these two outputs
>> +++ r/r 79456-128-3: filename1.ext
>> ++++++++ r/r 79456-128-3(realloc): filename2.ext
>> 
>> So, in this case filename2.ext is a reference for a file that once used inode 79456 and the file that currently uses the inode is filename1.ext. 
>> 
>> What I'm interested in is a possible reference in the dfxml fiwalk output that would differentiate the two references?
>> 
>> Hopefully, that helps explain it a little better. 
>> 
>> R/
>> 
>> Jason
>> 
>> 
>> 
>> 
>> On Fri, Oct 11, 2013 at 1:46 PM, Alex Nelson <ajn...@cs...> wrote:
>> That's interesting.  It might, but I don't understand the whole situation you're describing.  What are indicators of reallocation for a disk image at a single point in time?  Do you mean multiple hard-links to the same file exist and are legitimate files?  Or do you mean a file was unlinked somewhere and reallocated, but the file system was imaged in an inconsistent state?
>> 
>> --Alex
>> 
>> 
>> On Oct 11, 2013, at 13:36 , Jason Wright <jwr...@gm...> wrote:
>> 
>>> All,
>>> 
>>> 
>>> Does the dfxml output of fiwalk report whether a file object has been reallocated? Fls will (indicated by realloc), but will fiwalk do the same? I've come across this situation for a particular ntfs partition and have found two references for the same inode in fiwalk. In know which one is the allocated entry based off of fls, but I'm not sure of how that can be identified in fiwalk. Does anyone have any suggestions?
>>> 
>>> Thanks,
>>> 
>>> Jason Wright
>>> ------------------------------------------------------------------------------
>>> October Webinars: Code for Performance
>>> Free Intel webinars can help you accelerate application performance.
>>> Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from 
>>> the latest Intel processors and coprocessors. See abstracts and register >
>>> http://pubads.g.doubleclick.net/gampad/clk?id=60134071&iu=/4140/ostg.clktrk_______________________________________________
>>> sleuthkit-users mailing list
>>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>>> http://www.sleuthkit.org
>> 
>> 
> 
> 
> ------------------------------------------------------------------------------
> October Webinars: Code for Performance
> Free Intel webinars can help you accelerate application performance.
> Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from 
> the latest Intel processors and coprocessors. See abstracts and register >
> http://pubads.g.doubleclick.net/gampad/clk?id=60134071&iu=/4140/ostg.clktrk_______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org

Re: [sleuthkit-users] fiwalk output

[Jason W. <jwr...@gm...>]

I don't have the exact fiwalk output accessible here, so sorry that I can't
paste it in for more clarity, but at present the only difference in the
fileobjects for both inodes in the dfxml, is the filename. After
researching I think found that one was for a deleted entry based off of
some fls output I obtained. That cleared things up. My next thought was
then, how can I use fiwalk to help differentiate between the allocated and
deleted entries for two files referencing the same inode from the same
partition on a drive.

I'm not sure there is anything at present and wanted to find out before
creating something on my own.

Thanks again,

Jason


On Fri, Oct 11, 2013 at 2:19 PM, Alex Nelson <ajn...@cs...> wrote:

> Whoops, looks like you beat me to a response.  But yes, that clarifies
> your question.
>
> I think your question boils down to recording allocation status.  Do you
> have DFXML output from Fiwalk?  Are there <alloc> or <unalloc> elements for
> the fileobjects that you're looking at?
>
> --Alex
>
>
> On Oct 11, 2013, at 14:16 , Jason Wright <jwr...@gm...> wrote:
>
> Thanks, Alex. What I've come across is two references for the same inode
> in the fiwalk output for a particular drive. Both are on the same
> partition. One is for the allocated file the other is for the unallocated
> state for the filename of the file that previously used the inode.
>
> If running fls and looking for inode 79456, for example, you may get these
> two outputs
> +++ r/r 79456-128-3: filename1.ext
> ++++++++ r/r 79456-128-3(realloc): filename2.ext
>
> So, in this case filename2.ext is a reference for a file that once used
> inode 79456 and the file that currently uses the inode is filename1.ext.
>
> What I'm interested in is a possible reference in the dfxml fiwalk output
> that would differentiate the two references?
>
> Hopefully, that helps explain it a little better.
>
> R/
>
> Jason
>
>
>
>
> On Fri, Oct 11, 2013 at 1:46 PM, Alex Nelson <ajn...@cs...> wrote:
>
>> That's interesting.  It might, but I don't understand the whole situation
>> you're describing.  What are indicators of reallocation for a disk image at
>> a single point in time?  Do you mean multiple hard-links to the same file
>> exist and are legitimate files?  Or do you mean a file was unlinked
>> somewhere and reallocated, but the file system was imaged in an
>> inconsistent state?
>>
>> --Alex
>>
>>
>> On Oct 11, 2013, at 13:36 , Jason Wright <jwr...@gm...> wrote:
>>
>> All,
>>
>>
>> Does the dfxml output of fiwalk report whether a file object has been
>> reallocated? Fls will (indicated by realloc), but will fiwalk do the same?
>> I've come across this situation for a particular ntfs partition and have
>> found two references for the same inode in fiwalk. In know which one is the
>> allocated entry based off of fls, but I'm not sure of how that can be
>> identified in fiwalk. Does anyone have any suggestions?
>>
>> Thanks,
>>
>> Jason Wright
>>
>> ------------------------------------------------------------------------------
>> October Webinars: Code for Performance
>> Free Intel webinars can help you accelerate application performance.
>> Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most
>> from
>> the latest Intel processors and coprocessors. See abstracts and register >
>>
>> http://pubads.g.doubleclick.net/gampad/clk?id=60134071&iu=/4140/ostg.clktrk_______________________________________________
>> sleuthkit-users mailing list
>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>> http://www.sleuthkit.org
>>
>>
>>
>
>

Re: [sleuthkit-users] fiwalk output

[Simson G. <si...@ac...>]

From Jason's description it sounds like he has an allocated file and a deleted file that use the same filenode. This has caused confusion for others. The deleted "file" is probably just an old deleted directory entry.

On Oct 11, 2013, at 2:17 PM, Alex Nelson <ajn...@cs...> wrote:

> Jason, if you actually meant the multiple hard-link situation, then TSK should be able to expose this as finding multiple directory entries (I forgot the struct name, but it's an abstract-sounding "Name" struct).  In the TSK API, you would encounter this during a directory hierarchy walk, and I think you'd have to retain this in your own structure.
> 
> Currently, Fiwalk indirectly records multiple paths referencing the same MFT entry by using the <inode> and <parent_object> elements.
> 
> It's theoretically possible to record a file's name with from where the name came:
> https://github.com/dfxml-working-group/dfxml_schema/issues/12
> That's engineering that is awaiting (1) free time and (2) a little discussion for whether it's something worth doing, and whether what's in that Issue is the right way to go about it.
> 
> Of course, if I'm guessing wrong and you mean only one of the entries was actually allocated (which seems so, now that I've re-read your original message), that's a different matter.
> 
> --Alex
> 
> 
> On Oct 11, 2013, at 14:08 , Simson Garfinkel <si...@ac...> wrote:
> 
>> The real question is this — how does SleuthKit handle it, and how do you want to indicate it?
>> 
>> On Oct 11, 2013, at 1:46 PM, Alex Nelson <ajn...@cs...> wrote:
>> 
>>> That's interesting.  It might, but I don't understand the whole situation you're describing.  What are indicators of reallocation for a disk image at a single point in time?  Do you mean multiple hard-links to the same file exist and are legitimate files?  Or do you mean a file was unlinked somewhere and reallocated, but the file system was imaged in an inconsistent state?
>>> 
>>> --Alex
>>> 
>>> 
>>> On Oct 11, 2013, at 13:36 , Jason Wright <jwr...@gm...> wrote:
>>> 
>>>> All,
>>>> 
>>>> 
>>>> Does the dfxml output of fiwalk report whether a file object has been reallocated? Fls will (indicated by realloc), but will fiwalk do the same? I've come across this situation for a particular ntfs partition and have found two references for the same inode in fiwalk. In know which one is the allocated entry based off of fls, but I'm not sure of how that can be identified in fiwalk. Does anyone have any suggestions?
>>>> 
>>>> Thanks,
>>>> 
>>>> Jason Wright
>>>> ------------------------------------------------------------------------------
>>>> October Webinars: Code for Performance
>>>> Free Intel webinars can help you accelerate application performance.
>>>> Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from 
>>>> the latest Intel processors and coprocessors. See abstracts and register >
>>>> http://pubads.g.doubleclick.net/gampad/clk?id=60134071&iu=/4140/ostg.clktrk_______________________________________________
>>>> sleuthkit-users mailing list
>>>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>>>> http://www.sleuthkit.org
>>> 
>>> ------------------------------------------------------------------------------
>>> October Webinars: Code for Performance
>>> Free Intel webinars can help you accelerate application performance.
>>> Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from 
>>> the latest Intel processors and coprocessors. See abstracts and register >
>>> http://pubads.g.doubleclick.net/gampad/clk?id=60134071&iu=/4140/ostg.clktrk_______________________________________________
>>> sleuthkit-users mailing list
>>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>>> http://www.sleuthkit.org
>> 
> 

Re: [sleuthkit-users] fiwalk output

[Alex N. <ajn...@cs...>]

Jason, if you actually meant the multiple hard-link situation, then TSK should be able to expose this as finding multiple directory entries (I forgot the struct name, but it's an abstract-sounding "Name" struct).  In the TSK API, you would encounter this during a directory hierarchy walk, and I think you'd have to retain this in your own structure.

Currently, Fiwalk indirectly records multiple paths referencing the same MFT entry by using the <inode> and <parent_object> elements.

It's theoretically possible to record a file's name with from where the name came:
https://github.com/dfxml-working-group/dfxml_schema/issues/12
That's engineering that is awaiting (1) free time and (2) a little discussion for whether it's something worth doing, and whether what's in that Issue is the right way to go about it.

Of course, if I'm guessing wrong and you mean only one of the entries was actually allocated (which seems so, now that I've re-read your original message), that's a different matter.

--Alex


On Oct 11, 2013, at 14:08 , Simson Garfinkel <si...@ac...> wrote:

> The real question is this — how does SleuthKit handle it, and how do you want to indicate it?
> 
> On Oct 11, 2013, at 1:46 PM, Alex Nelson <ajn...@cs...> wrote:
> 
>> That's interesting.  It might, but I don't understand the whole situation you're describing.  What are indicators of reallocation for a disk image at a single point in time?  Do you mean multiple hard-links to the same file exist and are legitimate files?  Or do you mean a file was unlinked somewhere and reallocated, but the file system was imaged in an inconsistent state?
>> 
>> --Alex
>> 
>> 
>> On Oct 11, 2013, at 13:36 , Jason Wright <jwr...@gm...> wrote:
>> 
>>> All,
>>> 
>>> 
>>> Does the dfxml output of fiwalk report whether a file object has been reallocated? Fls will (indicated by realloc), but will fiwalk do the same? I've come across this situation for a particular ntfs partition and have found two references for the same inode in fiwalk. In know which one is the allocated entry based off of fls, but I'm not sure of how that can be identified in fiwalk. Does anyone have any suggestions?
>>> 
>>> Thanks,
>>> 
>>> Jason Wright
>>> ------------------------------------------------------------------------------
>>> October Webinars: Code for Performance
>>> Free Intel webinars can help you accelerate application performance.
>>> Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from 
>>> the latest Intel processors and coprocessors. See abstracts and register >
>>> http://pubads.g.doubleclick.net/gampad/clk?id=60134071&iu=/4140/ostg.clktrk_______________________________________________
>>> sleuthkit-users mailing list
>>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>>> http://www.sleuthkit.org
>> 
>> ------------------------------------------------------------------------------
>> October Webinars: Code for Performance
>> Free Intel webinars can help you accelerate application performance.
>> Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from 
>> the latest Intel processors and coprocessors. See abstracts and register >
>> http://pubads.g.doubleclick.net/gampad/clk?id=60134071&iu=/4140/ostg.clktrk_______________________________________________
>> sleuthkit-users mailing list
>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>> http://www.sleuthkit.org
> 

Re: [sleuthkit-users] fiwalk output

[Jason W. <jwr...@gm...>]

Thanks, Alex. What I've come across is two references for the same inode in
the fiwalk output for a particular drive. Both are on the same partition.
One is for the allocated file the other is for the unallocated state for
the filename of the file that previously used the inode.

If running fls and looking for inode 79456, for example, you may get these
two outputs
+++ r/r 79456-128-3: filename1.ext
++++++++ r/r 79456-128-3(realloc): filename2.ext

So, in this case filename2.ext is a reference for a file that once used
inode 79456 and the file that currently uses the inode is filename1.ext.

What I'm interested in is a possible reference in the dfxml fiwalk output
that would differentiate the two references?

Hopefully, that helps explain it a little better.

R/

Jason




On Fri, Oct 11, 2013 at 1:46 PM, Alex Nelson <ajn...@cs...> wrote:

> That's interesting.  It might, but I don't understand the whole situation
> you're describing.  What are indicators of reallocation for a disk image at
> a single point in time?  Do you mean multiple hard-links to the same file
> exist and are legitimate files?  Or do you mean a file was unlinked
> somewhere and reallocated, but the file system was imaged in an
> inconsistent state?
>
> --Alex
>
>
> On Oct 11, 2013, at 13:36 , Jason Wright <jwr...@gm...> wrote:
>
> All,
>
>
> Does the dfxml output of fiwalk report whether a file object has been
> reallocated? Fls will (indicated by realloc), but will fiwalk do the same?
> I've come across this situation for a particular ntfs partition and have
> found two references for the same inode in fiwalk. In know which one is the
> allocated entry based off of fls, but I'm not sure of how that can be
> identified in fiwalk. Does anyone have any suggestions?
>
> Thanks,
>
> Jason Wright
>
> ------------------------------------------------------------------------------
> October Webinars: Code for Performance
> Free Intel webinars can help you accelerate application performance.
> Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most
> from
> the latest Intel processors and coprocessors. See abstracts and register >
>
> http://pubads.g.doubleclick.net/gampad/clk?id=60134071&iu=/4140/ostg.clktrk_______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>
>
>

Re: [sleuthkit-users] fiwalk output

[Alex N. <ajn...@cs...>]

That's interesting.  It might, but I don't understand the whole situation you're describing.  What are indicators of reallocation for a disk image at a single point in time?  Do you mean multiple hard-links to the same file exist and are legitimate files?  Or do you mean a file was unlinked somewhere and reallocated, but the file system was imaged in an inconsistent state?

--Alex


On Oct 11, 2013, at 13:36 , Jason Wright <jwr...@gm...> wrote:

> All,
> 
> 
> Does the dfxml output of fiwalk report whether a file object has been reallocated? Fls will (indicated by realloc), but will fiwalk do the same? I've come across this situation for a particular ntfs partition and have found two references for the same inode in fiwalk. In know which one is the allocated entry based off of fls, but I'm not sure of how that can be identified in fiwalk. Does anyone have any suggestions?
> 
> Thanks,
> 
> Jason Wright
> ------------------------------------------------------------------------------
> October Webinars: Code for Performance
> Free Intel webinars can help you accelerate application performance.
> Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from 
> the latest Intel processors and coprocessors. See abstracts and register >
> http://pubads.g.doubleclick.net/gampad/clk?id=60134071&iu=/4140/ostg.clktrk_______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org

[sleuthkit-users] fiwalk output

[Jason W. <jwr...@gm...>]

All,


Does the dfxml output of fiwalk report whether a file object has been
reallocated? Fls will (indicated by realloc), but will fiwalk do the same?
I've come across this situation for a particular ntfs partition and have
found two references for the same inode in fiwalk. In know which one is the
allocated entry based off of fls, but I'm not sure of how that can be
identified in fiwalk. Does anyone have any suggestions?

Thanks,

Jason Wright

Re: [sleuthkit-users] Autopsy 3.07 keywords search issue

[Brian C. <ca...@sl...>]

Thanks for the painful phone typing!

I think I found it.  

Can you rename this folder (remove the 7):

C:\Program Files\Autopsy-3.0.7\autopsy\jre7 
  to 
C:\Program Files\Autopsy-3.0.7\autopsy\jre 

And see if that works.  I think this was introduced because we now do 32-bit and 64-bit and missed that we call it something different. Not everyone is seeing the error because they may already have java on their path.

thanks,
brian



On Oct 11, 2013, at 12:14 PM, Alex <ix...@gm...> wrote:

> The error message is preceded by:
> INFO: Starting Solr using: java -Xmx512m -DSTOP.PORT=34343 -Djetty.port=23232 -DSTOP.KEY=jjk#09s -Djava.util.logging.config.file=C:\Program Files\Autopsy-3.0.7\autopsy\solr\solr\conf\logging-release.properties -jar start.jar 
> 
> Not sending more logs as I have to type this on the phone, if you need more logs will send on Monday. 
> 
> Hope this helps,
> 
> Alex 
> 
> Brian Carrier <ca...@sl...> wrote:
> Strange.  In that log, there should be a message about what command it was going to run, something like "Starting Solr using:".  What did that say? 
> 
> thanks,
> brian
> 
> 
> On Oct 10, 2013, at 5:56 PM, Alex <ix...@gm...> wrote:
> 
> I take back my postscript: Fresh install on Win7 x64 has same issue. Logs show: 
> 
> WARNING: Could not start Solr server process!Exception: java.io.IOException: Cannot run program "java" (in directory "C:\Program Files\Autopsy-3.0.7\autopsy\solr"): CreateProcess error=2, The system cannot find the file specified. 
> 
> So it looks like a path issue, but how to fix?
> 
> Thanks
> 
> Alex 
> 
> Alex <ix...@gm...> wrote:
> I think I'm experiencing the same bug with Autopsy 3.x on a Windows 8 x64 VMware
>   host,
> running 64-bit Autopsy. 
> 
> 
> Autopsy 3.01 message on application launch: "Error initializing Keyword Search module. File indexing and search will not be functional. Please try to restart your computer and the application."
> Autopsy 3.07 message has slightly different wording but log still shows:
> 
> SEVERE: Starting server failed. Exception: org.sleuthkit.autopsy.keywordsearch.KeywordSearchModuleException: Error checking if Solr server is running. 
> 
> Rebooting doesn't appear to help. How could I troubleshoot this?
> 
> Thanks
> Alex
> 
> PS: All fine on Windows 7 x64. 
> 
> Brian Carrier <ca...@sl...> wrote:
> For everyone's update, seems that the SOLR (keyword search) service was not happy.  A reboot fixed the problem, but we will look into make sure that we give better errors in this case.
> 
> thanks,
> brian
> 
> On Oct 3, 2013, at 10:04 AM, Nanni Bassetti <dig...@gm...> wrote:
> 64bit and yes I see all the file system hierarchy, I don't get any error, all the rest works fine!
> thanks bye
> 
> 
> 2013/10/3 Brian Carrier <ca...@sl...>
> 32-bit version or 64-bit version?
> 
> If you open up the "Data Sources" node in the tree, does it show you the file system hierarchy or is it one big unallocated chunk?
> 
> You don't get any other errors?
> 
> 
> On Oct 3, 2013, at 2:46 AM, Nanni Bassetti <dig...@gm...> wrote:
> 
> Hi all,
> I ran Autopsy 3.07, in a Win 7 OS against, a 500Gb NTFS disk image file in EWF format made by Guymager 7.1.
> When I tried to do a keywords search I got this msg:
> 
> "No files were indexed - Re-Ingest the image with keyword search module enabled"
> 
> The keyword module is enabled, I re-ingest all, it finished and I re-tried the keyword search, but nothing...the same previous error message.
> In the directory
> "\ModuleOutput\keywordsearch\data\index", I have only two files 1Kb size:
> 
> segments.gen and segments_1
> 
> With the past release I did not get this problem...what I'm wrong?
> Thanks
> 
> --
> Dr. Nanni Bassetti
> http://www.nannibassetti.com
> CAINE project manager - http://www.caine-live.net
> 
> October Webina
> rs:
> Code for Performance
> 
> Free Intel webinars can help you accelerate application performance.
> Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from
> the latest Intel processors and coprocessors. See abstracts and register >
> http://pubads.g.doubleclick.net/gampad/clk?id=60134791&iu=/4140/ostg.clktrk
> 
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
> 
> 
> 
> 
> -- 
> Dr. Nanni Bassetti
> http://www.nannibassetti.com
> CAINE project manager - http://www.caine-live.net
> 
> October Webinars: Code for Performance
> Fre
> e Intel
> webinars can help you accelerate application performance.
> 
> Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from 
> the latest Intel processors and coprocessors. See abstracts and register >
> http://pubads.g.doubleclick.net/gampad/clk?id=60134791&iu=/4140/ostg.clktrk
> 
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
> 
> 
> 
> October Webinars: Code for Performance
> Free Intel webinars can help you accelerate application performance.
> Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from 
> the latest Intel processors and coprocessors. See abstracts and register >
> http://pubads.g.doubleclick.net/gampad/clk?id=60134791&iu=/4140/ostg.clktrk
> 
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
> 
> October Webinars: Code for Performance<
>  br
> />Free Intel webinars can help you accelerate application performance.
> 
> Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from 
> the latest Intel processors and coprocessors. See abstracts and register >
> http://pubads.g.doubleclick.net/gampad/clk?id=60134071&iu=/4140/ostg.clktrk
> 
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
> 
> ------------------------------------------------------------------------------
> October Webinars: Code for Performance
> Free Intel webinars can help you accelerate application performance.
> Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from 
> the latest Intel processors and coprocessors. See abstracts and register >
> http://pubads.g.doubleclick.net/gampad/clk?id=60134071&iu=/4140/ostg.clktrk_______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org

Re: [sleuthkit-users] Autopsy 3.07 keywords search issue

[Alex <ix...@gm...>]

The error message is preceded by:
INFO: Starting Solr using: java -Xmx512m -DSTOP.PORT=34343 -Djetty.port=23232 -DSTOP.KEY=jjk#09s -Djava.util.logging.config.file=C:\Program Files\Autopsy-3.0.7\autopsy\solr\solr\conf\logging-release.properties -jar start.jar 

Not sending more logs as I have to type this on the phone, if you need more logs will send on Monday. 

Hope this helps,

Alex 

Brian Carrier <ca...@sl...> wrote:
>Strange.  In that log, there should be a message about what command it
>was going to run, something like "Starting Solr using:".  What did that
>say? 
>
>thanks,
>brian
>
>
>On Oct 10, 2013, at 5:56 PM, Alex <ix...@gm...> wrote:
>
>> I take back my postscript: Fresh install on Win7 x64 has same issue.
>Logs show: 
>> 
>> WARNING: Could not start Solr server process!Exception:
>java.io.IOException: Cannot run program "java" (in directory
>"C:\Program Files\Autopsy-3.0.7\autopsy\solr"): CreateProcess error=2,
>The system cannot find the file specified. 
>> 
>> So it looks like a path issue, but how to fix?
>> 
>> Thanks
>> 
>> Alex 
>> 
>> Alex <ix...@gm...> wrote:
>> I think I'm experiencing the same bug with Autopsy 3.x on a Windows 8
>x64 VMware host, running 64-bit Autopsy. 
>> 
>> Autopsy 3.01 message on application launch: "Error initializing
>Keyword Search module. File indexing and search will not be functional.
>Please try to restart your computer and the application."
>> Autopsy 3.07 message has slightly different wording but log still
>shows:
>> 
>> SEVERE: Starting server failed. Exception:
>org.sleuthkit.autopsy.keywordsearch.KeywordSearchModuleException: Error
>checking if Solr server is running. 
>> 
>> Rebooting doesn't appear to help. How could I troubleshoot this?
>> 
>> Thanks
>> Alex
>> 
>> PS: All fine on Windows 7 x64. 
>> 
>> Brian Carrier <ca...@sl...> wrote:
>> For everyone's update, seems that the SOLR (keyword search) service
>was not happy.  A reboot fixed the problem, but we will look into make
>sure that we give better errors in this case.
>> 
>> thanks,
>> brian
>> 
>> On Oct 3, 2013, at 10:04 AM, Nanni Bassetti <dig...@gm...>
>wrote:
>> 
>> 64bit and yes I see all the file system hierarchy, I don't get any
>error, all the rest works fine!
>> thanks bye
>> 
>> 
>> 2013/10/3 Brian Carrier <ca...@sl...>
>> 32-bit version or 64-bit version?
>> 
>> If you open up the "Data Sources" node in the tree, does it show you
>the file system hierarchy or is it one big unallocated chunk?
>> 
>> You don't get any other errors?
>> 
>> 
>> On Oct 3, 2013, at 2:46 AM, Nanni Bassetti <dig...@gm...>
>wrote:
>> 
>> Hi all,
>> I ran Autopsy 3.07, in a Win 7 OS against, a 500Gb NTFS disk image
>file in EWF format made by Guymager 7.1.
>> When I tried to do a keywords search I got this msg:
>> 
>> "No files were indexed - Re-Ingest the image with keyword search
>module enabled"
>> 
>> The keyword module is enabled, I re-ingest all, it finished and I
>re-tried the keyword search, but nothing...the same previous error
>message.
>> In the directory "\ModuleOutput\keywordsearch\data\index", I have
>only two files 1Kb size:
>> segments.gen and segments_1
>> 
>> With the past release I did not get this problem...what I'm wrong?
>> Thanks
>> 
>> --
>> Dr. Nanni Bassetti
>> http://www.nannibassetti.com
>> CAINE project manager - http://www.caine-live.net
>> 
>> October Webina
>>  rs:
>> Code for Performance
>> 
>> Free Intel webinars can help you accelerate application performance.
>> Explore tips for MPI, OpenMP, advanced profiling, and more. Get the
>most from
>> the latest Intel processors and coprocessors. See abstracts and
>register >
>>
>http://pubads.g.doubleclick.net/gampad/clk?id=60134791&iu=/4140/ostg.clktrk
>> 
>> sleuthkit-users mailing list
>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>> http://www.sleuthkit.org
>> 
>> 
>> 
>> 
>> -- 
>> Dr. Nanni Bassetti
>> http://www.nannibassetti.com
>> CAINE project manager - http://www.caine-live.net
>> 
>> October Webinars: Code for Performance
>> Fre
>>  e Intel
>> webinars can help you accelerate application performance.
>> 
>> Explore tips for MPI, OpenMP, advanced profiling, and more. Get the
>most from 
>> the latest Intel processors and coprocessors. See abstracts and
>register >
>>
>http://pubads.g.doubleclick.net/gampad/clk?id=60134791&iu=/4140/ostg.clktrk
>> 
>> sleuthkit-users mailing list
>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>> http://www.sleuthkit.org
>> 
>> 
>> 
>> October Webinars: Code for Performance
>> Free Intel webinars can help you accelerate application performance.
>> Explore tips for MPI, OpenMP, advanced profiling, and more. Get the
>most from 
>> the latest Intel processors and coprocessors. See abstracts and
>register >
>>
>http://pubads.g.doubleclick.net/gampad/clk?id=60134791&iu=/4140/ostg.clktrk
>> 
>> sleuthkit-users mailing list
>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>> http://www.sleuthkit.org
>>
>------------------------------------------------------------------------------
>> October Webinars: Code for Performance
>> Free Intel webinars can help you accelerate application performance.
>> Explore tips for MPI, OpenMP, advanced profiling, and more. Get the
>most from 
>> the latest Intel processors and coprocessors. See abstracts and
>register >
>>
>http://pubads.g.doubleclick.net/gampad/clk?id=60134071&iu=/4140/ostg.clktrk_______________________________________________
>> sleuthkit-users mailing list
>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>> http://www.sleuthkit.org

Re: [sleuthkit-users] tsk_recover with L01 and Lx01

[Tom Y. <to...@ya...>]

ewfmount -f files <name of L01 file> <mount point> will allow you to view
the contents of the L01 file.

(with the caveat that you need a newer version of libewf - within the last
year IIRC)

Tom


PGP Key ID - B32585D0


On Fri, Oct 11, 2013 at 8:37 AM, Brian Carrier <ca...@sl...>wrote:

> There could be a tool in libewf that extracts L01 contents.
>
>
> On Oct 11, 2013, at 5:11 AM, Bala <bal...@cs...> wrote:
>
> > Brian
> >
> > I wouldn’t want to analyze L01 images, however I would my program to
> extract the files in L01. Is there a possibility ?
> >
> > I would like to see how the framework reads/extracts the .L01 files as
> well. Let me know if this is possible too.
> >
> > Regards
> > Bala
> >
> >
> > -----Original Message-----
> > From: Brian Carrier [mailto:ca...@sl...]
> > Sent: Thursday, October 10, 2013 8:43 PM
> > To: Bala
> > Cc: sle...@li...
> > Subject: Re: [sleuthkit-users] tsk_recover with L01 and Lx01
> >
> > My understanding is that an L01 file is basically a glorified ZIP file
> with forensically-interesting metadata embedded in it.  It was created by a
> forensics tool that likely analyzed a disk image and made an L01 with a
> subset of the files.
> >
> > None of the TSK tools analyze L01 files.  The TSK core tools all take
> disk images in as input (which could be in an E01 format, but not L01).
>  The framework supports L01, but that isn't going to help you in this case.
> >
> >
> >
> >
> > On Oct 10, 2013, at 2:11 AM, Bala <bal...@cs...> wrote:
> >
> > > Hi
> > >
> > > I’m trying to use recover *.L01 files using the tsk_recover (from
> version 4.2.1).
> > >
> > > However to my disappointment I get the following error.
> > > Cannot determine file system type (Sector offset: 0)Files Recovered: 0
> > >
> > > I used the following command to recover the files tsk_recover -o 32 -e
> > > "C:\Files\part-of-usb-disk-logical-file.Lx01" "Extract"
> > >
> > > I presume the error is due to the wrong offset. Let me know if its
> otherwise.
> > > Could I use any other offset?  If YES how do I determine the offset
> > > suitable for *.L01
> > >
> > > I’m on a Windows 2012 server
> > >
> > >
> > > Regards
> > > Bala
> > >
> > > ----------------------------------------------------------------------
> > > -------- October Webinars: Code for Performance Free Intel webinars
> > > can help you accelerate application performance.
> > > Explore tips for MPI, OpenMP, advanced profiling, and more. Get the
> > > most from the latest Intel processors and coprocessors. See abstracts
> > > and register >
> > > http://pubads.g.doubleclick.net/gampad/clk?id=60134071&iu=/4140/ostg.c
> > > lktrk_______________________________________________
> > > sleuthkit-users mailing list
> > > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> > > http://www.sleuthkit.org
> >
> >
> ------------------------------------------------------------------------------
> > October Webinars: Code for Performance
> > Free Intel webinars can help you accelerate application performance.
> > Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most
> from
> > the latest Intel processors and coprocessors. See abstracts and register
> >
> >
> http://pubads.g.doubleclick.net/gampad/clk?id=60134071&iu=/4140/ostg.clktrk_______________________________________________
> > sleuthkit-users mailing list
> > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> > http://www.sleuthkit.org
>
>
>
> ------------------------------------------------------------------------------
> October Webinars: Code for Performance
> Free Intel webinars can help you accelerate application performance.
> Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most
> from
> the latest Intel processors and coprocessors. See abstracts and register >
> http://pubads.g.doubleclick.net/gampad/clk?id=60134071&iu=/4140/ostg.clktrk
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>

Re: [sleuthkit-users] tsk_recover with L01 and Lx01

[Brian C. <ca...@sl...>]

There could be a tool in libewf that extracts L01 contents.


On Oct 11, 2013, at 5:11 AM, Bala <bal...@cs...> wrote:

> Brian
>  
> I wouldn’t want to analyze L01 images, however I would my program to extract the files in L01. Is there a possibility ?
>  
> I would like to see how the framework reads/extracts the .L01 files as well. Let me know if this is possible too.
>  
> Regards
> Bala
>  
>  
> -----Original Message-----
> From: Brian Carrier [mailto:ca...@sl...] 
> Sent: Thursday, October 10, 2013 8:43 PM
> To: Bala
> Cc: sle...@li...
> Subject: Re: [sleuthkit-users] tsk_recover with L01 and Lx01
>  
> My understanding is that an L01 file is basically a glorified ZIP file with forensically-interesting metadata embedded in it.  It was created by a forensics tool that likely analyzed a disk image and made an L01 with a subset of the files.
>  
> None of the TSK tools analyze L01 files.  The TSK core tools all take disk images in as input (which could be in an E01 format, but not L01).  The framework supports L01, but that isn't going to help you in this case.
>  
>  
>  
>  
> On Oct 10, 2013, at 2:11 AM, Bala <bal...@cs...> wrote:
>  
> > Hi
> > 
> > I’m trying to use recover *.L01 files using the tsk_recover (from version 4.2.1).
> > 
> > However to my disappointment I get the following error.
> > Cannot determine file system type (Sector offset: 0)Files Recovered: 0
> > 
> > I used the following command to recover the files tsk_recover -o 32 -e
> > "C:\Files\part-of-usb-disk-logical-file.Lx01" "Extract"
> > 
> > I presume the error is due to the wrong offset. Let me know if its otherwise.
> > Could I use any other offset?  If YES how do I determine the offset
> > suitable for *.L01
> > 
> > I’m on a Windows 2012 server
> > 
> > 
> > Regards
> > Bala
> > 
> > ----------------------------------------------------------------------
> > -------- October Webinars: Code for Performance Free Intel webinars
> > can help you accelerate application performance.
> > Explore tips for MPI, OpenMP, advanced profiling, and more. Get the
> > most from the latest Intel processors and coprocessors. See abstracts
> > and register >
> > http://pubads.g.doubleclick.net/gampad/clk?id=60134071&iu=/4140/ostg.c
> > lktrk_______________________________________________
> > sleuthkit-users mailing list
> > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> > http://www.sleuthkit.org
>  
> ------------------------------------------------------------------------------
> October Webinars: Code for Performance
> Free Intel webinars can help you accelerate application performance.
> Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from 
> the latest Intel processors and coprocessors. See abstracts and register >
> http://pubads.g.doubleclick.net/gampad/clk?id=60134071&iu=/4140/ostg.clktrk_______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org

Re: [sleuthkit-users] Autopsy 3.07 keywords search issue

[Brian C. <ca...@sl...>]

Strange.  In that log, there should be a message about what command it was going to run, something like "Starting Solr using:".  What did that say? 

thanks,
brian


On Oct 10, 2013, at 5:56 PM, Alex <ix...@gm...> wrote:

> I take back my postscript: Fresh install on Win7 x64 has same issue. Logs show: 
> 
> WARNING: Could not start Solr server process!Exception: java.io.IOException: Cannot run program "java" (in directory "C:\Program Files\Autopsy-3.0.7\autopsy\solr"): CreateProcess error=2, The system cannot find the file specified. 
> 
> So it looks like a path issue, but how to fix?
> 
> Thanks
> 
> Alex 
> 
> Alex <ix...@gm...> wrote:
> I think I'm experiencing the same bug with Autopsy 3.x on a Windows 8 x64 VMware host, running 64-bit Autopsy. 
> 
> Autopsy 3.01 message on application launch: "Error initializing Keyword Search module. File indexing and search will not be functional. Please try to restart your computer and the application."
> Autopsy 3.07 message has slightly different wording but log still shows:
> 
> SEVERE: Starting server failed. Exception: org.sleuthkit.autopsy.keywordsearch.KeywordSearchModuleException: Error checking if Solr server is running. 
> 
> Rebooting doesn't appear to help. How could I troubleshoot this?
> 
> Thanks
> Alex
> 
> PS: All fine on Windows 7 x64. 
> 
> Brian Carrier <ca...@sl...> wrote:
> For everyone's update, seems that the SOLR (keyword search) service was not happy.  A reboot fixed the problem, but we will look into make sure that we give better errors in this case.
> 
> thanks,
> brian
> 
> On Oct 3, 2013, at 10:04 AM, Nanni Bassetti <dig...@gm...> wrote:
> 
> 64bit and yes I see all the file system hierarchy, I don't get any error, all the rest works fine!
> thanks bye
> 
> 
> 2013/10/3 Brian Carrier <ca...@sl...>
> 32-bit version or 64-bit version?
> 
> If you open up the "Data Sources" node in the tree, does it show you the file system hierarchy or is it one big unallocated chunk?
> 
> You don't get any other errors?
> 
> 
> On Oct 3, 2013, at 2:46 AM, Nanni Bassetti <dig...@gm...> wrote:
> 
> Hi all,
> I ran Autopsy 3.07, in a Win 7 OS against, a 500Gb NTFS disk image file in EWF format made by Guymager 7.1.
> When I tried to do a keywords search I got this msg:
> 
> "No files were indexed - Re-Ingest the image with keyword search module enabled"
> 
> The keyword module is enabled, I re-ingest all, it finished and I re-tried the keyword search, but nothing...the same previous error message.
> In the directory "\ModuleOutput\keywordsearch\data\index", I have only two files 1Kb size:
> segments.gen and segments_1
> 
> With the past release I did not get this problem...what I'm wrong?
> Thanks
> 
> --
> Dr. Nanni Bassetti
> http://www.nannibassetti.com
> CAINE project manager - http://www.caine-live.net
> 
> October Webina
>  rs:
> Code for Performance
> 
> Free Intel webinars can help you accelerate application performance.
> Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from
> the latest Intel processors and coprocessors. See abstracts and register >
> http://pubads.g.doubleclick.net/gampad/clk?id=60134791&iu=/4140/ostg.clktrk
> 
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
> 
> 
> 
> 
> -- 
> Dr. Nanni Bassetti
> http://www.nannibassetti.com
> CAINE project manager - http://www.caine-live.net
> 
> October Webinars: Code for Performance
> Fre
>  e Intel
> webinars can help you accelerate application performance.
> 
> Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from 
> the latest Intel processors and coprocessors. See abstracts and register >
> http://pubads.g.doubleclick.net/gampad/clk?id=60134791&iu=/4140/ostg.clktrk
> 
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
> 
> 
> 
> October Webinars: Code for Performance
> Free Intel webinars can help you accelerate application performance.
> Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from 
> the latest Intel processors and coprocessors. See abstracts and register >
> http://pubads.g.doubleclick.net/gampad/clk?id=60134791&iu=/4140/ostg.clktrk
> 
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
> ------------------------------------------------------------------------------
> October Webinars: Code for Performance
> Free Intel webinars can help you accelerate application performance.
> Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from 
> the latest Intel processors and coprocessors. See abstracts and register >
> http://pubads.g.doubleclick.net/gampad/clk?id=60134071&iu=/4140/ostg.clktrk_______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org

Re: [sleuthkit-users] tsk_recover with L01 and Lx01

[Bala <bal...@cs...>]

Brian

 

I wouldn't want to analyze L01 images, however I would my program to extract
the files in L01. Is there a possibility ?

 

I would like to see how the framework reads/extracts the .L01 files as well.
Let me know if this is possible too.

 

Regards

Bala

 

 

-----Original Message-----
From: Brian Carrier [mailto:ca...@sl...] 
Sent: Thursday, October 10, 2013 8:43 PM
To: Bala
Cc: sle...@li...
Subject: Re: [sleuthkit-users] tsk_recover with L01 and Lx01

 

My understanding is that an L01 file is basically a glorified ZIP file with
forensically-interesting metadata embedded in it.  It was created by a
forensics tool that likely analyzed a disk image and made an L01 with a
subset of the files. 

 

None of the TSK tools analyze L01 files.  The TSK core tools all take disk
images in as input (which could be in an E01 format, but not L01).  The
framework supports L01, but that isn't going to help you in this case.

 

 

 

 

On Oct 10, 2013, at 2:11 AM, Bala < <mailto:bal...@cs...>
bal...@cs...> wrote:

 

> Hi

>  

> I'm trying to use recover *.L01 files using the tsk_recover (from version
4.2.1).

>  

> However to my disappointment I get the following error.

> Cannot determine file system type (Sector offset: 0)Files Recovered: 0

>  

> I used the following command to recover the files tsk_recover -o 32 -e 

> "C:\Files\part-of-usb-disk-logical-file.Lx01" "Extract"

>  

> I presume the error is due to the wrong offset. Let me know if its
otherwise.

> Could I use any other offset?  If YES how do I determine the offset 

> suitable for *.L01

>  

> I'm on a Windows 2012 server

>  

>  

> Regards

> Bala

>  

> ----------------------------------------------------------------------

> -------- October Webinars: Code for Performance Free Intel webinars 

> can help you accelerate application performance.

> Explore tips for MPI, OpenMP, advanced profiling, and more. Get the 

> most from the latest Intel processors and coprocessors. See abstracts 

> and register > 

>  <http://pubads.g.doubleclick.net/gampad/clk?id=60134071&iu=/4140/ostg.c>
http://pubads.g.doubleclick.net/gampad/clk?id=60134071&iu=/4140/ostg.c

> lktrk_______________________________________________

> sleuthkit-users mailing list

>  <https://lists.sourceforge.net/lists/listinfo/sleuthkit-users>
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users

>  <http://www.sleuthkit.org> http://www.sleuthkit.org

 

Re: [sleuthkit-users] Autopsy 3.07 keywords search issue

[grzegorz.ginalski <grz...@o2...>]

J have the same problem on Windows 7 64bit with Autopsy 3.07 x64.  Autopsy 32bit works fine. 
Dnia 10 października 2013 22:56 Alex <ix...@gm...> napisał(a):
I think I'm experiencing the same bug with Autopsy 3.x on a Windows 8 x64 VMware host, running 64-bit Autopsy.
Autopsy 3.01 message on application launch: "Error initializing Keyword Search module. File indexing and search will not be functional. Please try to restart your computer and the application."
Autopsy 3.07 message has slightly different wording but log still shows:
SEVERE: Starting server failed. Exception: org.sleuthkit.autopsy.keywordsearch.KeywordSearchModuleException: Error checking if Solr server is running.
Rebooting doesn't appear to help. How could I troubleshoot this?
Thanks
Alex
PS: All fine on Windows 7 x64.
Brian Carrier <ca...@sl...> wrote:For everyone's update, seems that the SOLR (keyword search)service was not happy. A reboot fixed the problem, but we willlook into make sure that we give better errors in this case.
thanks,
brian
On Oct 3, 2013, at 10:04 AM, Nanni Bassetti<dig...@gm...> wrote:
64bit and yes I see all the file system hierarchy, I don't get any error, all the rest works fine!
thanks bye
2013/10/3 Brian Carrier <ca...@sl...>
32-bit version or 64-bit version?
If you open up the "Data Sources" node in the tree, does it show you the file system hierarchy or is it one big unallocated chunk?
You don't get any other errors?
On Oct 3, 2013, at 2:46 AM, Nanni Bassetti <dig...@gm...> wrote:
Hi all,
I ran Autopsy 3.07, in a Win 7 OS against, a 500Gb NTFS disk image file in EWF format made by Guymager 7.1.
When I tried to do a keywords search I got this msg:
"No files were indexed - Re-Ingest the image with keyword search module enabled"
The keyword module is enabled, I re-ingest all, it finished and I re-tried the keyword search, but nothing...the same previous error message.
In the directory "\ModuleOutput\keywordsearch\data\index", I have only two files 1Kb size:
segments.gen and segments_1
With the past release I did not get this problem...what I'm wrong?
Thanks
--
Dr. Nanni Bassetti
http://www.nannibassetti.com
CAINE project manager - http://www.caine-live.net
October Webinars: Code for Performance
Free Intel webinars can help you accelerate application performance.
Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from
the latest Intel processors and coprocessors. See abstracts and register >
http://pubads.g.doubleclick.net/gampad/clk?id=60134791&iu=/4140/ostg.clktrk
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org
--
Dr. Nanni Bassetti
http://www.nannibassetti.com
CAINE project manager - http://www.caine-live.net
October Webinars: Code for Performance
Free Intel webinars can help you accelerate application performance.
Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from
the latest Intel processors and coprocessors. See abstracts and register >
http://pubads.g.doubleclick.net/gampad/clk?id=60134791&iu=/4140/ostg.clktrk
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org
October Webinars: Code for Performance
Free Intel webinars can help you accelerate applicationperformance.
Explore tips for MPI, OpenMP, advanced profiling, and more. Get themost from 
the latest Intel processors and coprocessors. See abstracts andregister >
http://pubads.g.doubleclick.net/gampad/clk?id=60134791&iu=/4140/ostg.clktrk
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org------------------------------------------------------------------------------October Webinars: Code for PerformanceFree Intel webinars can help you accelerate application performance.Explore tips for MPI, OpenMP, advanced profiling, and more. Get the mostfrom the latest Intel processors and coprocessors. See abstracts and register >http://pubads.g.doubleclick.net/gampad/clk?id=60134071&iu=/4140/ostg.clktrk_______________________________________________sleuthkit-users mailing listhttps://lists.sourceforge.net/lists/listinfo/sleuthkit-usershttp://www.sleuthkit.org

Re: [sleuthkit-users] Autopsy 3.07 keywords search issue

[Alex <ix...@gm...>]

I take back my postscript: Fresh install on Win7 x64 has same issue. Logs show: 

WARNING: Could not start Solr server process!Exception: java.io.IOException: Cannot run program "java" (in directory "C:\Program Files\Autopsy-3.0.7\autopsy\solr"): CreateProcess error=2, The system cannot find the file specified. 

So it looks like a path issue, but how to fix?

Thanks

Alex 

Alex <ix...@gm...> wrote:
>I think I'm experiencing the same bug with Autopsy 3.x on a Windows 8
>x64 VMware host, running 64-bit Autopsy. 
>
>Autopsy 3.01 message on application launch: "Error initializing Keyword
>Search module. File indexing and search will not be functional. Please
>try to restart your computer and the application."
>Autopsy 3.07 message has slightly different wording but log still
>shows:
>
>SEVERE: Starting server failed. Exception:
>org.sleuthkit.autopsy.keywordsearch.KeywordSearchModuleException: Error
>checking if Solr server is running. 
>
>Rebooting doesn't appear to help. How could I troubleshoot this?
>
>Thanks
>Alex
>
>PS: All fine on Windows 7 x64. 
>
>Brian Carrier <ca...@sl...> wrote:
>>For everyone's update, seems that the SOLR (keyword search) service
>was
>>not happy.  A reboot fixed the problem, but we will look into make
>sure
>>that we give better errors in this case.
>>
>>thanks,
>>brian
>>
>>On Oct 3, 2013, at 10:04 AM, Nanni Bassetti <dig...@gm...>
>wrote:
>>
>>> 64bit and yes I see all the file system hierarchy, I don't get any
>>error, all the rest works fine!
>>> thanks bye
>>> 
>>> 
>>> 2013/10/3 Brian Carrier <ca...@sl...>
>>> 32-bit version or 64-bit version?
>>> 
>>> If you open up the "Data Sources" node in the tree, does it show you
>>the file system hierarchy or is it one big unallocated chunk?
>>> 
>>> You don't get any other errors?
>>> 
>>> 
>>> On Oct 3, 2013, at 2:46 AM, Nanni Bassetti <dig...@gm...>
>>wrote:
>>> 
>>> > Hi all,
>>> > I ran Autopsy 3.07, in a Win 7 OS against, a 500Gb NTFS disk image
>>file in EWF format made by Guymager 7.1.
>>> > When I tried to do a keywords search I got this msg:
>>> >
>>> > "No files were indexed - Re-Ingest the image with keyword search
>>module enabled"
>>> >
>>> > The keyword module is enabled, I re-ingest all, it finished and I
>>re-tried the keyword search, but nothing...the same previous error
>>message.
>>> > In the directory "\ModuleOutput\keywordsearch\data\index", I have
>>only two files 1Kb size:
>>> > segments.gen and segments_1
>>> >
>>> > With the past release I did not get this problem...what I'm wrong?
>>> > Thanks
>>> >
>>> > --
>>> > Dr. Nanni Bassetti
>>> > http://www.nannibassetti.com
>>> > CAINE project manager - http://www.caine-live.net
>>> >
>>------------------

Re: [sleuthkit-users] Autopsy 3.07 keywords search issue

[Alex <ix...@gm...>]

I think I'm experiencing the same bug with Autopsy 3.x on a Windows 8 x64 VMware host, running 64-bit Autopsy. 

Autopsy 3.01 message on application launch: "Error initializing Keyword Search module. File indexing and search will not be functional. Please try to restart your computer and the application."
Autopsy 3.07 message has slightly different wording but log still shows:

SEVERE: Starting server failed. Exception: org.sleuthkit.autopsy.keywordsearch.KeywordSearchModuleException: Error checking if Solr server is running. 

Rebooting doesn't appear to help. How could I troubleshoot this?

Thanks
Alex

PS: All fine on Windows 7 x64. 

Brian Carrier <ca...@sl...> wrote:
>For everyone's update, seems that the SOLR (keyword search) service was
>not happy.  A reboot fixed the problem, but we will look into make sure
>that we give better errors in this case.
>
>thanks,
>brian
>
>On Oct 3, 2013, at 10:04 AM, Nanni Bassetti <dig...@gm...> wrote:
>
>> 64bit and yes I see all the file system hierarchy, I don't get any
>error, all the rest works fine!
>> thanks bye
>> 
>> 
>> 2013/10/3 Brian Carrier <ca...@sl...>
>> 32-bit version or 64-bit version?
>> 
>> If you open up the "Data Sources" node in the tree, does it show you
>the file system hierarchy or is it one big unallocated chunk?
>> 
>> You don't get any other errors?
>> 
>> 
>> On Oct 3, 2013, at 2:46 AM, Nanni Bassetti <dig...@gm...>
>wrote:
>> 
>> > Hi all,
>> > I ran Autopsy 3.07, in a Win 7 OS against, a 500Gb NTFS disk image
>file in EWF format made by Guymager 7.1.
>> > When I tried to do a keywords search I got this msg:
>> >
>> > "No files were indexed - Re-Ingest the image with keyword search
>module enabled"
>> >
>> > The keyword module is enabled, I re-ingest all, it finished and I
>re-tried the keyword search, but nothing...the same previous error
>message.
>> > In the directory "\ModuleOutput\keywordsearch\data\index", I have
>only two files 1Kb size:
>> > segments.gen and segments_1
>> >
>> > With the past release I did not get this problem...what I'm wrong?
>> > Thanks
>> >
>> > --
>> > Dr. Nanni Bassetti
>> > http://www.nannibassetti.com
>> > CAINE project manager - http://www.caine-live.net
>> >
>------------------

Re: [sleuthkit-users] tsk_recover with L01 and Lx01

[Brian C. <ca...@sl...>]

My understanding is that an L01 file is basically a glorified ZIP file with forensically-interesting metadata embedded in it.  It was created by a forensics tool that likely analyzed a disk image and made an L01 with a subset of the files. 

None of the TSK tools analyze L01 files.  The TSK core tools all take disk images in as input (which could be in an E01 format, but not L01).  The framework supports L01, but that isn't going to help you in this case.




On Oct 10, 2013, at 2:11 AM, Bala <bal...@cs...> wrote:

> Hi
>  
> I’m trying to use recover *.L01 files using the tsk_recover (from version 4.2.1).
>  
> However to my disappointment I get the following error.
> Cannot determine file system type (Sector offset: 0)Files Recovered: 0
>  
> I used the following command to recover the files
> tsk_recover -o 32 -e "C:\Files\part-of-usb-disk-logical-file.Lx01" "Extract"
>  
> I presume the error is due to the wrong offset. Let me know if its otherwise.
> Could I use any other offset?  If YES how do I determine the offset suitable for *.L01
>  
> I’m on a Windows 2012 server
>  
>  
> Regards
> Bala
>  
> ------------------------------------------------------------------------------
> October Webinars: Code for Performance
> Free Intel webinars can help you accelerate application performance.
> Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from 
> the latest Intel processors and coprocessors. See abstracts and register >
> http://pubads.g.doubleclick.net/gampad/clk?id=60134071&iu=/4140/ostg.clktrk_______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org

[sleuthkit-users] tsk_recover with L01 and Lx01

[Bala <bal...@cs...>]

Hi 

 

I'm trying to use recover *.L01 files using the tsk_recover (from version
4.2.1). 

 

However to my disappointment I get the following error.

Cannot determine file system type (Sector offset: 0)Files Recovered: 0

 

I used the following command to recover the files

tsk_recover -o 32 -e "C:\Files\part-of-usb-disk-logical-file.Lx01" "Extract"

 

I presume the error is due to the wrong offset. Let me know if its
otherwise. 

Could I use any other offset?  If YES how do I determine the offset suitable
for *.L01

 

I'm on a Windows 2012 server 

 

 

Regards

Bala

 

[sleuthkit-users] Free Autopsy Training for Law Enforcement

[Brian C. <ca...@sl...>]

Given the current budget issues, we (Basis Technology) have reserved some seats at the Nov 6 & 7 Autopsy training in Chantilly VA (right after OSDFCon) for law enforcement.  The only catch is that you need to use Autopsy on a real case (alongside your currently preferred tool) and provide feedback on what you liked better about it and what you didn't like about it.  More details can be found here:

   http://info.basistech.com/blog/bid/318962/Free-Autopsy-Training-For-Law-Enforcement

For non-law enforcement, there are also still some seats available (http://www.basistech.com/digital-forensics/training/). 

And of course registration for the Open Source Digital Forensics Conference (OSDFCon) on Nov 5 is still open and free for govn't employees.  The reduced rate for the hotel ends on Oct 13, so you should book that soon.  

   http://www.osdfcon.org/

thanks,
brian

Re: [sleuthkit-users] What if a module fails to initialize

[Jason L. <jle...@ba...>]

As a quick note on the retry topic, you can re-ingest by right-clicking the datasources in the case and selecting "Run Ingest" - this lets you configure the ingest modules again too if you ant.  Seems like this should be a bit more obvious in the UI based on the discussion thread.

Jason






------------------------------------------------

Jason Letourneau
Product Manager, Digital Forensics
Basis Technology
jle...@ba...
617-386-2000 ext. 152




On Oct 7, 2013, at 2:31 PM, Alex Nelson <ajn...@cs...> wrote:

> I guess my vote came with too big a string attached.  (Again, not commentary, though the taste in timing is looking like a losing debate.)
> 
> Like others are saying, bailing early and clearly looks like the best option, especially if Willi's right and there isn't a "Re-try ingest" procedure.  On that note, though, is there one?
> 
> --Alex
> 
> 
> On Oct 7, 2013, at 14:15 , Willi Ballenthin <wil...@gm...> wrote:
> 
>> Perhaps I've missed a menu item, but I don't remember seeing a way to re-run the ingest process on a given case. Assuming that's true, I would prefer to bail at the first opportunity. 
>> 
>> If I'm using Autopsy during an investigation with a set of plugins, I've decided to use them for a specific reason (otherwise they'd be disabled for better performance). Therefore, if I spend a while waiting for processing to complete, only to learn its in fact incomplete and the only way to finish is to re-ingest, I'd be annoyed. 
>> 
>> If there is a way to re-ingest a case, then a large warning dialog with a quick fix/reconfigure button would be my second choice. 
>> 
>> Willi
>> 
>> 
>> On Mon, Oct 7, 2013 at 1:44 PM, Alex Nelson <ajn...@cs...> wrote:
>> I vote 1, because one faulty module should not prevent the other modules' results, which may take a long time, from doing their work.  (Please believe me that this is not commentary on other current events.)
>> 
>> However, this requires the module framework have support for a results dependency graph.  This'll take some intelligent designer's time to get across gracefully to the end user if one module among many fails.  (I can say from experience that Make and Dot/GraphViz are not a simple solution.)
>> 
>> How do later modules in a pipeline specify that they need the results of an earlier module?
>> 
>> --Alex
>> 
>> 
>> On Oct 7, 2013, at 13:26 , Nanni Bassetti <dig...@gm...> wrote:
>> 
>>> My vote is for the number 2 :-)
>>> bye
>>> -- 
>>> Dr. Nanni Bassetti
>>> http://www.nannibassetti.com
>>> CAINE project manager - http://www.caine-live.net
>>> ------------------------------------------------------------------------------
>>> October Webinars: Code for Performance
>>> Free Intel webinars can help you accelerate application performance.
>>> Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from 
>>> the latest Intel processors and coprocessors. See abstracts and register >
>>> http://pubads.g.doubleclick.net/gampad/clk?id=60134791&iu=/4140/ostg.clktrk_______________________________________________
>>> sleuthkit-users mailing list
>>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>>> http://www.sleuthkit.org
>> 
>> 
>> ------------------------------------------------------------------------------
>> October Webinars: Code for Performance
>> Free Intel webinars can help you accelerate application performance.
>> Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from
>> the latest Intel processors and coprocessors. See abstracts and register >
>> http://pubads.g.doubleclick.net/gampad/clk?id=60134071&iu=/4140/ostg.clktrk
>> _______________________________________________
>> sleuthkit-users mailing list
>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>> http://www.sleuthkit.org
>> 
>> 
> 
> ------------------------------------------------------------------------------
> October Webinars: Code for Performance
> Free Intel webinars can help you accelerate application performance.
> Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from 
> the latest Intel processors and coprocessors. See abstracts and register >
> http://pubads.g.doubleclick.net/gampad/clk?id=60134071&iu=/4140/ostg.clktrk_______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org

Re: [sleuthkit-users] What if a module fails to initialize

[Hoyt H. <hoy...@gm...>]

I'll vote for #2, assuming results from successful modules that completed
prior to the failure were added to the case as normal. I'm also assuming
that a module isn't initialized until after the one before it completes
unless it's the first module in the pipeline. If that's the case and as
long as the user notification tells the user to re-ingest with only the
failed and subsequent modules (including those with output dependencies),
then those modules that successfully ran should be excluded by the user
with no duplication of results.

Hoyt


On Mon, Oct 7, 2013 at 12:22 PM, Brian Carrier <ca...@sl...>wrote:

> There was an error reported last week that the Keyword Search module
> failed to initialize.  We're reviewing how that situation was handled and
> we have two options.  We're looking for feedback.  The scenario is that the
> user has selected the ingest modules that they want to run on the data
> source.  One of the modules fails to initialize (we have a model where each
> module is initialized, it then runs on the entire disk or set of files, and
> then is closed). What should we do when a module does not initialize (for
> the sake of example, let's say it was a hash calculation module).
>
> 1) We log the error, notify the user with a message, and continue to run
> the modules that did initialize. In our current example, a challenge is
> that the later modules in the pipeline may be depending on that module's
> output. For example, the  hash lookup module will need the  hash value so
> that it can use its hash databases.   This approach requires the user to
> then decide to cancel and restart (which may result in duplicate data).
>
> 2) We halt the pipeline and no data is analyzed unless all modules could
> initialize.  The user is notified and can either fix the problem or remove
> the module from the pipeline so that it can continue.
>
> Preferences?
>
> brian
>
>
>
>
>
> ------------------------------------------------------------------------------
> October Webinars: Code for Performance
> Free Intel webinars can help you accelerate application performance.
> Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most
> from
> the latest Intel processors and coprocessors. See abstracts and register >
> http://pubads.g.doubleclick.net/gampad/clk?id=60134791&iu=/4140/ostg.clktrk
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>

Re: [sleuthkit-users] What if a module fails to initialize

[Alex N. <ajn...@cs...>]

I guess my vote came with too big a string attached.  (Again, not commentary, though the taste in timing is looking like a losing debate.)

Like others are saying, bailing early and clearly looks like the best option, especially if Willi's right and there isn't a "Re-try ingest" procedure.  On that note, though, is there one?

--Alex


On Oct 7, 2013, at 14:15 , Willi Ballenthin <wil...@gm...> wrote:

> Perhaps I've missed a menu item, but I don't remember seeing a way to re-run the ingest process on a given case. Assuming that's true, I would prefer to bail at the first opportunity. 
> 
> If I'm using Autopsy during an investigation with a set of plugins, I've decided to use them for a specific reason (otherwise they'd be disabled for better performance). Therefore, if I spend a while waiting for processing to complete, only to learn its in fact incomplete and the only way to finish is to re-ingest, I'd be annoyed. 
> 
> If there is a way to re-ingest a case, then a large warning dialog with a quick fix/reconfigure button would be my second choice. 
> 
> Willi
> 
> 
> On Mon, Oct 7, 2013 at 1:44 PM, Alex Nelson <ajn...@cs...> wrote:
> I vote 1, because one faulty module should not prevent the other modules' results, which may take a long time, from doing their work.  (Please believe me that this is not commentary on other current events.)
> 
> However, this requires the module framework have support for a results dependency graph.  This'll take some intelligent designer's time to get across gracefully to the end user if one module among many fails.  (I can say from experience that Make and Dot/GraphViz are not a simple solution.)
> 
> How do later modules in a pipeline specify that they need the results of an earlier module?
> 
> --Alex
> 
> 
> On Oct 7, 2013, at 13:26 , Nanni Bassetti <dig...@gm...> wrote:
> 
>> My vote is for the number 2 :-)
>> bye
>> -- 
>> Dr. Nanni Bassetti
>> http://www.nannibassetti.com
>> CAINE project manager - http://www.caine-live.net
>> ------------------------------------------------------------------------------
>> October Webinars: Code for Performance
>> Free Intel webinars can help you accelerate application performance.
>> Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from 
>> the latest Intel processors and coprocessors. See abstracts and register >
>> http://pubads.g.doubleclick.net/gampad/clk?id=60134791&iu=/4140/ostg.clktrk_______________________________________________
>> sleuthkit-users mailing list
>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>> http://www.sleuthkit.org
> 
> 
> ------------------------------------------------------------------------------
> October Webinars: Code for Performance
> Free Intel webinars can help you accelerate application performance.
> Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from
> the latest Intel processors and coprocessors. See abstracts and register >
> http://pubads.g.doubleclick.net/gampad/clk?id=60134071&iu=/4140/ostg.clktrk
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
> 
>