IndexError list index out of range

[Lou511]

Hi. I am trying to parse data exported from a forensic image, to my case folder. I encounter the following traceback output:

Traceback (most recent call last):
File "bottle.py", line 862, in _handle
File "bottle.py", line 1732, in wrapper
File "hindsight_gui.py", line 161, in do_run
File "pyhindsight\analysis.py", line 127, in run
File "pyhindsight\browsers\chrome.py", line 1335, in process
IndexError: list index out of range

Exception is: IndexError('list index out of range',)

When I open chrome.py, and inspect line 1335, it appears there is a trigger for run failure, if a cache-related circumstance exists in the source. Am I on the right path with this interpretation? Am I doing something wrong when running Hindsight?

[obsidianforensics]

Can you show me how you ran Hindsight? From the command line or through the web UI? What does your input directory look like (the Chrome profile folder)? This error shouldn't happen, so I'm trying to understand what went wrong. Can you attach the log file?

There's a chance you did something wrong, but more likely you found a bug or something in Chrome changed (again). Thanks for reporting it either way.

[Lou511]

Hi Ryan. Using a forensic image, first I export the “default” folder, to directory within my case folder. I launch the web UI, and enter the path to the exported default folder I described above. I’ve used this method successfully in the past. Not sure why it’s not working now, though. I can share the log. I do not have access to it this moment, but will send it over as soon as I can. Thanks.

…

On Nov 30, 2018, at 6:58 PM, Ryan Benson ***@***.***> wrote: Can you show me how you ran Hindsight? From the command line or through the web UI? What does your input directory look like (the Chrome profile folder)? This error shouldn't happen, so I'm trying to understand what went wrong. Can you attach the log file? There's a chance you did something wrong, but more likely you found a bug or something in Chrome changed (again). Thanks for reporting it either way. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub, or mute the thread.

[Bjorn92]

I am also getting this same error when I run in the CLI and the UI. I am on Windows 10, but it resolves when it is run on a UNIX device.

[obsidianforensics]

Hi there - can you retry with the 2.4 release? I believe this issue was fixed by a3b92b5.

Basically, one of Chrome's database schema changes resulted in an edge case in Hindsight's version determination logic, which resulted in it eliminating all Chrome versions as possibilities (and then it tries to access a list item that doesn't exist, resulting in that error message you see).

[Bjorn92]

I checked the recent source file for 2,4 but the compiled code is still for 2.3 and is failing.

[obsidianforensics]

You've tried the compiled exe at https://github.com/obsidianforensics/hindsight/releases/tag/v2.4.0?

[Bjorn92]

Yeah, I downloaded the Source File (zip). Extracted it, and ran the exe out of that file. You can see in the first image the path that I am in when I ran it.

[Bjorn92]

So I downloaded the standalone exe listed there not the Source File(zip), and it worked @obsidianforensics

So maybe just the Source File needs updated?

[obsidianforensics]

Yeah it looks like I missed updating those bundled exes, sorry about that. Good catch.

[obsidianforensics]

8f1e99e pushes the new exes to source

[Bjorn92]

Looks great! Thanks man!