Fatal error v3.0b3 (multiple EWF images) #53

FabianoQ · 2012-06-18T21:01:36Z

While ingesting an EWF hd image (Windows XP inside) i received the following error
"Fatal error during ingest.
Caused by: java.lang.NoSuchMethodError: org.sleuthkit.datamodel.TskCoreException: method ()V not found"
after answering OK Autopsy closed.

I can provide the hd image.

--NOTE: the linkage issue is resolved, but see issue about multiple EWF images in a Case below

adam-m · 2012-06-18T21:13:14Z

Hi Fabiono,

It looks like you have not (re)compiled the Java bindings - the error is
usually an indication of that.
Please add the sleuthkit/bindings/java project to netbeans and rebuild the
project (or, alternatively, use ant from command line).

With regards to the missing activity problem, are you running your Autopsy
build on Linux ?
Unfortunately, on Linux recent activity module is unsupported (we need to
handle this better), because it currently relies on some windows-only tools
(maybe we could get them to run with wine, but it's slightly hackish).

Thanks,
Adam (Autopsy team)

On Mon, Jun 18, 2012 at 5:01 PM, FabianoQ <
reply@reply.github.com

wrote:

While ingesting an EWF hd image (Windows XP inside) i received the
following error
"Fatal error during ingest.
Caused by: java.lang.NoSuchMethodError:
org.sleuthkit.datamodel.TskCoreException: method ()V not found"
after answering OK Autopsy closed.

I can provide the hd image.

Reply to this email directly or view it on GitHub:
#53

FabianoQ · 2012-06-18T21:28:41Z

Hi Adam, thanks for your lightning-fast response.

My pc environment is Windows 7 Ultimate SP1 x64;
about the "not (re)compiled" stuff, i'm using Autopsy
from the installer not from the source and i tried 3
or 4 hd images and just one produced the error.

If we can think of a method to deal with the size of them
(and you think it's useful) i can provide the .e01 images.

Regards

Fabiano Querceto

Da: adam reply@reply.github.com
A: FabianoQ fabiano.querceto@yahoo.it
Inviato: Lunedì 18 Giugno 2012 23:13
Oggetto: Re: [autopsy] Fatal error v3.0b3 (#53)

Hi Fabiono,

It looks like you have not (re)compiled the Java bindings - the error is
usually an indication of that.
Please add the sleuthkit/bindings/java project to netbeans and rebuild the
project (or, alternatively, use ant from command line).

With regards to the missing activity problem, are you running your Autopsy
build on Linux ?
Unfortunately, on Linux recent activity module is unsupported (we need to
handle this better), because it currently relies on some windows-only tools
(maybe we could get them to run with wine, but it's slightly hackish).

Thanks,
Adam (Autopsy team)

On Mon, Jun 18, 2012 at 5:01 PM, FabianoQ <
reply@reply.github.com

wrote:

While ingesting an EWF hd image (Windows XP inside) i received the
following error
"Fatal error during ingest.
Caused by: java.lang.NoSuchMethodError:
org.sleuthkit.datamodel.TskCoreException: method ()V not found"
after answering OK Autopsy closed.

I can provide the hd image.

Reply to this email directly or view it on GitHub:
#53

Reply to this email directly or view it on GitHub:
#53 (comment)

adam-m · 2012-06-18T21:31:18Z

Thanks, Fabiano,

Yes, it'd be very useful. We'll see if we can find a (secure) way for you
to upload them and get back to you.

Adam

On Mon, Jun 18, 2012 at 5:28 PM, FabianoQ <
reply@reply.github.com

wrote:

Hi Adam, thanks for your lightning-fast response.

My pc environment is Windows 7 Ultimate SP1 x64;
about the "not (re)compiled" stuff, i'm using Autopsy
from the installer not from the source and i tried 3
or 4 hd images and just one produced the error.

If we can think of a method to deal with the size of them
(and you think it's useful) i can provide the .e01 images.

Regards

Fabiano Querceto

Da: adam reply@reply.github.com
A: FabianoQ fabiano.querceto@yahoo.it
Inviato: Lunedì 18 Giugno 2012 23:13
Oggetto: Re: [autopsy] Fatal error v3.0b3 (#53)

Hi Fabiono,

It looks like you have not (re)compiled the Java bindings - the error is
usually an indication of that.
Please add the sleuthkit/bindings/java project to netbeans and rebuild the
project (or, alternatively, use ant from command line).

With regards to the missing activity problem, are you running your Autopsy
build on Linux ?
Unfortunately, on Linux recent activity module is unsupported (we need to
handle this better), because it currently relies on some windows-only tools
(maybe we could get them to run with wine, but it's slightly hackish).

Thanks,
Adam (Autopsy team)

On Mon, Jun 18, 2012 at 5:01 PM, FabianoQ <
reply@reply.github.com

wrote:

While ingesting an EWF hd image (Windows XP inside) i received the
following error
"Fatal error during ingest.
Caused by: java.lang.NoSuchMethodError:
org.sleuthkit.datamodel.TskCoreException: method ()V not found"
after answering OK Autopsy closed.

I can provide the hd image.

Reply to this email directly or view it on GitHub:
#53

Reply to this email directly or view it on GitHub:
#53 (comment)

Reply to this email directly or view it on GitHub:
#53 (comment)

adam-m · 2012-06-19T16:36:56Z

Hi Fabiano,
what is roughly the size of the Win XP image ? We have an FTP site we
could use if it fits, what's your email I can use (need to send you the
creds).
Thanks,
Adam

On Mon, Jun 18, 2012 at 5:31 PM, Adam Malinowski
amalinowski@basistech.comwrote:

Thanks, Fabiano,

Yes, it'd be very useful. We'll see if we can find a (secure) way for you
to upload them and get back to you.

Adam

On Mon, Jun 18, 2012 at 5:28 PM, FabianoQ <
reply@reply.github.com

wrote:

Hi Adam, thanks for your lightning-fast response.

My pc environment is Windows 7 Ultimate SP1 x64;
about the "not (re)compiled" stuff, i'm using Autopsy
from the installer not from the source and i tried 3
or 4 hd images and just one produced the error.

If we can think of a method to deal with the size of them
(and you think it's useful) i can provide the .e01 images.

Regards

Fabiano Querceto

Da: adam reply@reply.github.com
A: FabianoQ fabiano.querceto@yahoo.it
Inviato: Lunedì 18 Giugno 2012 23:13
Oggetto: Re: [autopsy] Fatal error v3.0b3 (#53)

Hi Fabiono,

It looks like you have not (re)compiled the Java bindings - the error is
usually an indication of that.
Please add the sleuthkit/bindings/java project to netbeans and rebuild the
project (or, alternatively, use ant from command line).

With regards to the missing activity problem, are you running your Autopsy
build on Linux ?
Unfortunately, on Linux recent activity module is unsupported (we need to
handle this better), because it currently relies on some windows-only
tools
(maybe we could get them to run with wine, but it's slightly hackish).

Thanks,
Adam (Autopsy team)

On Mon, Jun 18, 2012 at 5:01 PM, FabianoQ <
reply@reply.github.com

wrote:

While ingesting an EWF hd image (Windows XP inside) i received the
following error
"Fatal error during ingest.
Caused by: java.lang.NoSuchMethodError:
org.sleuthkit.datamodel.TskCoreException: method ()V not found"
after answering OK Autopsy closed.

I can provide the hd image.

Reply to this email directly or view it on GitHub:
#53

Reply to this email directly or view it on GitHub:
#53 (comment)

Reply to this email directly or view it on GitHub:
#53 (comment)

FabianoQ · 2012-06-20T20:44:10Z

Hi Adam

all the images i tested are over 100gb (compressed)let me know ...

Fabiano Querceto

Da: adam reply@reply.github.com
A: FabianoQ fabiano.querceto@yahoo.it
Inviato: Martedì 19 Giugno 2012 18:36
Oggetto: Re: [autopsy] Fatal error v3.0b3 (#53)

Hi Fabiano,
what is roughly the size of the Win XP image ? We have an FTP site we
could use if it fits, what's your email I can use (need to send you the
creds).
Thanks,
Adam

On Mon, Jun 18, 2012 at 5:31 PM, Adam Malinowski
amalinowski@basistech.comwrote:

Thanks, Fabiano,

Yes, it'd be very useful. We'll see if we can find a (secure) way for you
to upload them and get back to you.

Adam

On Mon, Jun 18, 2012 at 5:28 PM, FabianoQ <
reply@reply.github.com

wrote:

Hi Adam, thanks for your lightning-fast response.

My pc environment is Windows 7 Ultimate SP1 x64;
about the "not (re)compiled" stuff, i'm using Autopsy
from the installer not from the source and i tried 3
or 4 hd images and just one produced the error.

If we can think of a method to deal with the size of them
(and you think it's useful) i can provide the .e01 images.

Regards

Fabiano Querceto

Da: adam reply@reply.github.com
A: FabianoQ fabiano.querceto@yahoo.it
Inviato: Lunedì 18 Giugno 2012 23:13
Oggetto: Re: [autopsy] Fatal error v3.0b3 (#53)

Hi Fabiono,

It looks like you have not (re)compiled the Java bindings - the error is
usually an indication of that.
Please add the sleuthkit/bindings/java project to netbeans and rebuild the
project (or, alternatively, use ant from command line).

With regards to the missing activity problem, are you running your Autopsy
build on Linux ?
Unfortunately, on Linux recent activity module is unsupported (we need to
handle this better), because it currently relies on some windows-only
tools
(maybe we could get them to run with wine, but it's slightly hackish).

Thanks,
Adam (Autopsy team)

On Mon, Jun 18, 2012 at 5:01 PM, FabianoQ <
reply@reply.github.com

wrote:

While ingesting an EWF hd image (Windows XP inside) i received the
following error
"Fatal error during ingest.
Caused by: java.lang.NoSuchMethodError:
org.sleuthkit.datamodel.TskCoreException: method ()V not found"
after answering OK Autopsy closed.

I can provide the hd image.

Reply to this email directly or view it on GitHub:
#53

Reply to this email directly or view it on GitHub:
#53 (comment)

Reply to this email directly or view it on GitHub:
#53 (comment)

Reply to this email directly or view it on GitHub:
#53 (comment)

adam-m · 2012-06-22T18:05:42Z

Hi Fabiano,

We will release another beta next week that likely fixes the linking error
you experienced.
We can then see if the image can be added to Autopsy or not. If not, we
can then decide how further to debug issue with the image (100GB upload is
huge, but not impossible).

Thanks,
Adam

On Wed, Jun 20, 2012 at 4:44 PM, FabianoQ <
reply@reply.github.com

wrote:

Hi Adam

all the images i tested are over 100gb (compressed)let me know ...

Fabiano Querceto
339-3032968
348-4707739

Da: adam reply@reply.github.com
A: FabianoQ fabiano.querceto@yahoo.it
Inviato: Martedì 19 Giugno 2012 18:36
Oggetto: Re: [autopsy] Fatal error v3.0b3 (#53)

Hi Fabiano,
what is roughly the size of the Win XP image ? We have an FTP site we
could use if it fits, what's your email I can use (need to send you the
creds).
Thanks,
Adam

On Mon, Jun 18, 2012 at 5:31 PM, Adam Malinowski
amalinowski@basistech.comwrote:

Thanks, Fabiano,

Yes, it'd be very useful. We'll see if we can find a (secure) way for
you
to upload them and get back to you.

Adam

On Mon, Jun 18, 2012 at 5:28 PM, FabianoQ <
reply@reply.github.com

wrote:

Hi Adam, thanks for your lightning-fast response.

My pc environment is Windows 7 Ultimate SP1 x64;
about the "not (re)compiled" stuff, i'm using Autopsy
from the installer not from the source and i tried 3
or 4 hd images and just one produced the error.

If we can think of a method to deal with the size of them
(and you think it's useful) i can provide the .e01 images.

Regards

Fabiano Querceto

Da: adam reply@reply.github.com
A: FabianoQ fabiano.querceto@yahoo.it
Inviato: Lunedì 18 Giugno 2012 23:13
Oggetto: Re: [autopsy] Fatal error v3.0b3 (#53)

Hi Fabiono,

It looks like you have not (re)compiled the Java bindings - the error is
usually an indication of that.
Please add the sleuthkit/bindings/java project to netbeans and rebuild
the
project (or, alternatively, use ant from command line).

With regards to the missing activity problem, are you running your
Autopsy
build on Linux ?
Unfortunately, on Linux recent activity module is unsupported (we need
to
handle this better), because it currently relies on some windows-only
tools
(maybe we could get them to run with wine, but it's slightly hackish).

Thanks,
Adam (Autopsy team)

On Mon, Jun 18, 2012 at 5:01 PM, FabianoQ <
reply@reply.github.com

wrote:

While ingesting an EWF hd image (Windows XP inside) i received the
following error
"Fatal error during ingest.
Caused by: java.lang.NoSuchMethodError:
org.sleuthkit.datamodel.TskCoreException: method ()V not found"
after answering OK Autopsy closed.

I can provide the hd image.

Reply to this email directly or view it on GitHub:
#53

Reply to this email directly or view it on GitHub:
#53 (comment)

Reply to this email directly or view it on GitHub:
#53 (comment)

Reply to this email directly or view it on GitHub:
#53 (comment)

Reply to this email directly or view it on GitHub:
#53 (comment)

adam-m · 2012-06-25T16:16:05Z

Hi Fabiano,

Uploading 100GB file may be quite difficult. However, we may be able to
trace the issue other ways.
Would you be mind to run a sleuthkit command on the image and send us a log
?

Steps:

download latest beta sleuthkit build from

http://sourceforge.net/projects/sleuthkit/files/sleuthkit/4.0.0/sleuthkit-win32-4.0.0b1.zip/download

unzip it
execute command from windows shell, like:

sleuthkit-win32-4.0.0b1\bin\tsk_loaddb.exe -v YOUR_IMAGE.E01 >
tsk_loaddb.txt 2>&1

it will generate a huge log file, tsk_loaddb.txt

zip the tsk_loaddb.txt file and email to us. If it's too large, we can
setup FTP.

Thanks,
Adam

On Fri, Jun 22, 2012 at 2:05 PM, Adam Malinowski
amalinowski@basistech.comwrote:

Hi Fabiano,

We will release another beta next week that likely fixes the linking error
you experienced.
We can then see if the image can be added to Autopsy or not. If not, we
can then decide how further to debug issue with the image (100GB upload is
huge, but not impossible).

Thanks,
Adam

On Wed, Jun 20, 2012 at 4:44 PM, FabianoQ <
reply@reply.github.com

wrote:

Hi Adam

all the images i tested are over 100gb (compressed)let me know ...

Fabiano Querceto
339-3032968
348-4707739

Da: adam reply@reply.github.com
A: FabianoQ fabiano.querceto@yahoo.it
Inviato: Martedì 19 Giugno 2012 18:36
Oggetto: Re: [autopsy] Fatal error v3.0b3 (#53)

Hi Fabiano,
what is roughly the size of the Win XP image ? We have an FTP site we
could use if it fits, what's your email I can use (need to send you the
creds).
Thanks,
Adam

On Mon, Jun 18, 2012 at 5:31 PM, Adam Malinowski
amalinowski@basistech.comwrote:

Thanks, Fabiano,

Yes, it'd be very useful. We'll see if we can find a (secure) way for
you
to upload them and get back to you.

Adam

On Mon, Jun 18, 2012 at 5:28 PM, FabianoQ <
reply@reply.github.com

wrote:

Hi Adam, thanks for your lightning-fast response.

My pc environment is Windows 7 Ultimate SP1 x64;
about the "not (re)compiled" stuff, i'm using Autopsy
from the installer not from the source and i tried 3
or 4 hd images and just one produced the error.

If we can think of a method to deal with the size of them
(and you think it's useful) i can provide the .e01 images.

Regards

Fabiano Querceto

Da: adam reply@reply.github.com
A: FabianoQ fabiano.querceto@yahoo.it
Inviato: Lunedì 18 Giugno 2012 23:13
Oggetto: Re: [autopsy] Fatal error v3.0b3 (#53)

Hi Fabiono,

It looks like you have not (re)compiled the Java bindings - the error
is
usually an indication of that.
Please add the sleuthkit/bindings/java project to netbeans and rebuild
the
project (or, alternatively, use ant from command line).

With regards to the missing activity problem, are you running your
Autopsy
build on Linux ?
Unfortunately, on Linux recent activity module is unsupported (we need
to
handle this better), because it currently relies on some windows-only
tools
(maybe we could get them to run with wine, but it's slightly hackish).

Thanks,
Adam (Autopsy team)

On Mon, Jun 18, 2012 at 5:01 PM, FabianoQ <
reply@reply.github.com

wrote:

While ingesting an EWF hd image (Windows XP inside) i received the
following error
"Fatal error during ingest.
Caused by: java.lang.NoSuchMethodError:
org.sleuthkit.datamodel.TskCoreException: method ()V not found"
after answering OK Autopsy closed.

I can provide the hd image.

Reply to this email directly or view it on GitHub:
#53

Reply to this email directly or view it on GitHub:
#53 (comment)

Reply to this email directly or view it on GitHub:
#53 (comment)

Reply to this email directly or view it on GitHub:
#53 (comment)

Reply to this email directly or view it on GitHub:
#53 (comment)

FabianoQ · 2012-06-26T07:09:29Z

Ok, this evening i'll do ..

Fabiano Querceto
339-3032968
348-4707739

Da: adam reply@reply.github.com
A: FabianoQ fabiano.querceto@yahoo.it
Inviato: Lunedì 25 Giugno 2012 18:16
Oggetto: Re: [autopsy] Fatal error v3.0b3 (#53)

Hi Fabiano,

Uploading 100GB file may be quite difficult. However, we may be able to
trace the issue other ways.
Would you be mind to run a sleuthkit command on the image and send us a log
?

Steps:

download latest beta sleuthkit build from

http://sourceforge.net/projects/sleuthkit/files/sleuthkit/4.0.0/sleuthkit-win32-4.0.0b1.zip/download

unzip it
execute command from windows shell, like:

sleuthkit-win32-4.0.0b1\bin\tsk_loaddb.exe -v YOUR_IMAGE.E01 >
tsk_loaddb.txt 2>&1

it will generate a huge log file, tsk_loaddb.txt

zip the tsk_loaddb.txt file and email to us. If it's too large, we can
setup FTP.

Thanks,
Adam

On Fri, Jun 22, 2012 at 2:05 PM, Adam Malinowski
amalinowski@basistech.comwrote:

Hi Fabiano,

We will release another beta next week that likely fixes the linking error
you experienced.
We can then see if the image can be added to Autopsy or not. If not, we
can then decide how further to debug issue with the image (100GB upload is
huge, but not impossible).

Thanks,
Adam

On Wed, Jun 20, 2012 at 4:44 PM, FabianoQ <
reply@reply.github.com

wrote:

Hi Adam

all the images i tested are over 100gb (compressed)let me know ...

Fabiano Querceto
339-3032968
348-4707739

Da: adam reply@reply.github.com
A: FabianoQ fabiano.querceto@yahoo.it
Inviato: Martedì 19 Giugno 2012 18:36
Oggetto: Re: [autopsy] Fatal error v3.0b3 (#53)

Hi Fabiano,
what is roughly the size of the Win XP image ? We have an FTP site we
could use if it fits, what's your email I can use (need to send you the
creds).
Thanks,
Adam

On Mon, Jun 18, 2012 at 5:31 PM, Adam Malinowski
amalinowski@basistech.comwrote:

Thanks, Fabiano,

Yes, it'd be very useful. We'll see if we can find a (secure) way for
you
to upload them and get back to you.

Adam

On Mon, Jun 18, 2012 at 5:28 PM, FabianoQ <
reply@reply.github.com

wrote:

Hi Adam, thanks for your lightning-fast response.

My pc environment is Windows 7 Ultimate SP1 x64;
about the "not (re)compiled" stuff, i'm using Autopsy
from the installer not from the source and i tried 3
or 4 hd images and just one produced the error.

If we can think of a method to deal with the size of them
(and you think it's useful) i can provide the .e01 images.

Regards

Fabiano Querceto

Da: adam reply@reply.github.com
A: FabianoQ fabiano.querceto@yahoo.it
Inviato: Lunedì 18 Giugno 2012 23:13
Oggetto: Re: [autopsy] Fatal error v3.0b3 (#53)

Hi Fabiono,

It looks like you have not (re)compiled the Java bindings - the error
is
usually an indication of that.
Please add the sleuthkit/bindings/java project to netbeans and rebuild
the
project (or, alternatively, use ant from command line).

With regards to the missing activity problem, are you running your
Autopsy
build on Linux ?
Unfortunately, on Linux recent activity module is unsupported (we need
to
handle this better), because it currently relies on some windows-only
tools
(maybe we could get them to run with wine, but it's slightly hackish).

Thanks,
Adam (Autopsy team)

On Mon, Jun 18, 2012 at 5:01 PM, FabianoQ <
reply@reply.github.com

wrote:

While ingesting an EWF hd image (Windows XP inside) i received the
following error
"Fatal error during ingest.
Caused by: java.lang.NoSuchMethodError:
org.sleuthkit.datamodel.TskCoreException: method ()V not found"
after answering OK Autopsy closed.

I can provide the hd image.

Reply to this email directly or view it on GitHub:
#53

Reply to this email directly or view it on GitHub:
#53 (comment)

Reply to this email directly or view it on GitHub:
#53 (comment)

Reply to this email directly or view it on GitHub:
#53 (comment)

Reply to this email directly or view it on GitHub:
#53 (comment)

Reply to this email directly or view it on GitHub:
#53 (comment)

FabianoQ · 2012-06-26T20:53:25Z

The tsk_loaddb.txt file is about 2gb (89 mb compressed)
here is the link to my dropbox https://dl.dropbox.com/u/42442949/tsk_loaddb.rar

Let me know ...

Fabiano Querceto
339-3032968
348-4707739

Da: adam reply@reply.github.com
A: FabianoQ fabiano.querceto@yahoo.it
Inviato: Lunedì 25 Giugno 2012 18:16
Oggetto: Re: [autopsy] Fatal error v3.0b3 (#53)

Hi Fabiano,

Uploading 100GB file may be quite difficult. However, we may be able to
trace the issue other ways.
Would you be mind to run a sleuthkit command on the image and send us a log
?

Steps:

download latest beta sleuthkit build from

http://sourceforge.net/projects/sleuthkit/files/sleuthkit/4.0.0/sleuthkit-win32-4.0.0b1.zip/download

unzip it
execute command from windows shell, like:

sleuthkit-win32-4.0.0b1\bin\tsk_loaddb.exe -v YOUR_IMAGE.E01 >
tsk_loaddb.txt 2>&1

it will generate a huge log file, tsk_loaddb.txt

zip the tsk_loaddb.txt file and email to us. If it's too large, we can
setup FTP.

Thanks,
Adam

On Fri, Jun 22, 2012 at 2:05 PM, Adam Malinowski
amalinowski@basistech.comwrote:

Hi Fabiano,

We will release another beta next week that likely fixes the linking error
you experienced.
We can then see if the image can be added to Autopsy or not. If not, we
can then decide how further to debug issue with the image (100GB upload is
huge, but not impossible).

Thanks,
Adam

On Wed, Jun 20, 2012 at 4:44 PM, FabianoQ <
reply@reply.github.com

wrote:

Hi Adam

all the images i tested are over 100gb (compressed)let me know ...

Fabiano Querceto
339-3032968
348-4707739

Da: adam reply@reply.github.com
A: FabianoQ fabiano.querceto@yahoo.it
Inviato: Martedì 19 Giugno 2012 18:36
Oggetto: Re: [autopsy] Fatal error v3.0b3 (#53)

Hi Fabiano,
what is roughly the size of the Win XP image ? We have an FTP site we
could use if it fits, what's your email I can use (need to send you the
creds).
Thanks,
Adam

On Mon, Jun 18, 2012 at 5:31 PM, Adam Malinowski
amalinowski@basistech.comwrote:

Thanks, Fabiano,

Yes, it'd be very useful. We'll see if we can find a (secure) way for
you
to upload them and get back to you.

Adam

On Mon, Jun 18, 2012 at 5:28 PM, FabianoQ <
reply@reply.github.com

wrote:

Hi Adam, thanks for your lightning-fast response.

My pc environment is Windows 7 Ultimate SP1 x64;
about the "not (re)compiled" stuff, i'm using Autopsy
from the installer not from the source and i tried 3
or 4 hd images and just one produced the error.

If we can think of a method to deal with the size of them
(and you think it's useful) i can provide the .e01 images.

Regards

Fabiano Querceto

Da: adam reply@reply.github.com
A: FabianoQ fabiano.querceto@yahoo.it
Inviato: Lunedì 18 Giugno 2012 23:13
Oggetto: Re: [autopsy] Fatal error v3.0b3 (#53)

Hi Fabiono,

It looks like you have not (re)compiled the Java bindings - the error
is
usually an indication of that.
Please add the sleuthkit/bindings/java project to netbeans and rebuild
the
project (or, alternatively, use ant from command line).

With regards to the missing activity problem, are you running your
Autopsy
build on Linux ?
Unfortunately, on Linux recent activity module is unsupported (we need
to
handle this better), because it currently relies on some windows-only
tools
(maybe we could get them to run with wine, but it's slightly hackish).

Thanks,
Adam (Autopsy team)

On Mon, Jun 18, 2012 at 5:01 PM, FabianoQ <
reply@reply.github.com

wrote:

While ingesting an EWF hd image (Windows XP inside) i received the
following error
"Fatal error during ingest.
Caused by: java.lang.NoSuchMethodError:
org.sleuthkit.datamodel.TskCoreException: method ()V not found"
after answering OK Autopsy closed.

I can provide the hd image.

Reply to this email directly or view it on GitHub:
#53

Reply to this email directly or view it on GitHub:
#53 (comment)

Reply to this email directly or view it on GitHub:
#53 (comment)

Reply to this email directly or view it on GitHub:
#53 (comment)

Reply to this email directly or view it on GitHub:
#53 (comment)

Reply to this email directly or view it on GitHub:
#53 (comment)

adam-m · 2012-06-26T21:14:30Z

Thanks very much!
Adam

On Tue, Jun 26, 2012 at 4:53 PM, FabianoQ <
reply@reply.github.com

wrote:

The tsk_loaddb.txt file is about 2gb (89 mb compressed)
here is the link to my dropbox
https://dl.dropbox.com/u/42442949/tsk_loaddb.rar

Let me know ...

Fabiano Querceto
339-3032968
348-4707739

Da: adam reply@reply.github.com
A: FabianoQ fabiano.querceto@yahoo.it
Inviato: Lunedì 25 Giugno 2012 18:16
Oggetto: Re: [autopsy] Fatal error v3.0b3 (#53)

Hi Fabiano,

Uploading 100GB file may be quite difficult. However, we may be able to
trace the issue other ways.
Would you be mind to run a sleuthkit command on the image and send us a log
?

Steps:

download latest beta sleuthkit build from

http://sourceforge.net/projects/sleuthkit/files/sleuthkit/4.0.0/sleuthkit-win32-4.0.0b1.zip/download

unzip it

execute command from windows shell, like:

sleuthkit-win32-4.0.0b1\bin\tsk_loaddb.exe -v YOUR_IMAGE.E01 >
tsk_loaddb.txt 2>&1

it will generate a huge log file, tsk_loaddb.txt

zip the tsk_loaddb.txt file and email to us. If it's too large, we can
setup FTP.

Thanks,
Adam

On Fri, Jun 22, 2012 at 2:05 PM, Adam Malinowski
amalinowski@basistech.comwrote:

Hi Fabiano,

We will release another beta next week that likely fixes the linking
error
you experienced.
We can then see if the image can be added to Autopsy or not. If not, we
can then decide how further to debug issue with the image (100GB upload
is
huge, but not impossible).

Thanks,
Adam

On Wed, Jun 20, 2012 at 4:44 PM, FabianoQ <
reply@reply.github.com

wrote:

Hi Adam

all the images i tested are over 100gb (compressed)let me know ...

Fabiano Querceto
339-3032968
348-4707739

Da: adam reply@reply.github.com
A: FabianoQ fabiano.querceto@yahoo.it
Inviato: Martedì 19 Giugno 2012 18:36
Oggetto: Re: [autopsy] Fatal error v3.0b3 (#53)

Hi Fabiano,
what is roughly the size of the Win XP image ? We have an FTP site we
could use if it fits, what's your email I can use (need to send you the
creds).
Thanks,
Adam

On Mon, Jun 18, 2012 at 5:31 PM, Adam Malinowski
amalinowski@basistech.comwrote:

Thanks, Fabiano,

Yes, it'd be very useful. We'll see if we can find a (secure) way for
you
to upload them and get back to you.

Adam

On Mon, Jun 18, 2012 at 5:28 PM, FabianoQ <
reply@reply.github.com

wrote:

Hi Adam, thanks for your lightning-fast response.

My pc environment is Windows 7 Ultimate SP1 x64;
about the "not (re)compiled" stuff, i'm using Autopsy
from the installer not from the source and i tried 3
or 4 hd images and just one produced the error.

If we can think of a method to deal with the size of them
(and you think it's useful) i can provide the .e01 images.

Regards

Fabiano Querceto

Da: adam reply@reply.github.com
A: FabianoQ fabiano.querceto@yahoo.it
Inviato: Lunedì 18 Giugno 2012 23:13
Oggetto: Re: [autopsy] Fatal error v3.0b3 (#53)

Hi Fabiono,

It looks like you have not (re)compiled the Java bindings - the error
is
usually an indication of that.
Please add the sleuthkit/bindings/java project to netbeans and
rebuild
the
project (or, alternatively, use ant from command line).

With regards to the missing activity problem, are you running your
Autopsy
build on Linux ?
Unfortunately, on Linux recent activity module is unsupported (we
need
to
handle this better), because it currently relies on some windows-only
tools
(maybe we could get them to run with wine, but it's slightly
hackish).

Thanks,
Adam (Autopsy team)

On Mon, Jun 18, 2012 at 5:01 PM, FabianoQ <
reply@reply.github.com

wrote:

While ingesting an EWF hd image (Windows XP inside) i received the
following error
"Fatal error during ingest.
Caused by: java.lang.NoSuchMethodError:
org.sleuthkit.datamodel.TskCoreException: method ()V not
found"
after answering OK Autopsy closed.

I can provide the hd image.

Reply to this email directly or view it on GitHub:
#53

Reply to this email directly or view it on GitHub:
#53 (comment)

Reply to this email directly or view it on GitHub:
#53 (comment)

Reply to this email directly or view it on GitHub:
#53 (comment)

Reply to this email directly or view it on GitHub:
#53 (comment)

Reply to this email directly or view it on GitHub:
#53 (comment)

Reply to this email directly or view it on GitHub:
#53 (comment)

adam-m · 2012-07-03T22:10:59Z

Fabiano.

We just released a new version that fixes some bugs and adds better error
handing.

http://sourceforge.net/projects/autopsy/files/autopsy/3.0.0%20beta/

Could you try to reproduce the issue with the image using 3b4 ?
If it still fails to add the image, it should at least provide a better
error log.

Thanks,
Adam

On Tue, Jun 26, 2012 at 5:14 PM, Adam Malinowski
amalinowski@basistech.comwrote:

Thanks very much!
Adam

On Tue, Jun 26, 2012 at 4:53 PM, FabianoQ <
reply@reply.github.com

wrote:

The tsk_loaddb.txt file is about 2gb (89 mb compressed)
here is the link to my dropbox
https://dl.dropbox.com/u/42442949/tsk_loaddb.rar

Let me know ...

Fabiano Querceto
339-3032968
348-4707739

Da: adam reply@reply.github.com
A: FabianoQ fabiano.querceto@yahoo.it
Inviato: Lunedì 25 Giugno 2012 18:16
Oggetto: Re: [autopsy] Fatal error v3.0b3 (#53)

Hi Fabiano,

Uploading 100GB file may be quite difficult. However, we may be able to
trace the issue other ways.
Would you be mind to run a sleuthkit command on the image and send us a
log
?

Steps:

download latest beta sleuthkit build from

http://sourceforge.net/projects/sleuthkit/files/sleuthkit/4.0.0/sleuthkit-win32-4.0.0b1.zip/download

unzip it

execute command from windows shell, like:

sleuthkit-win32-4.0.0b1\bin\tsk_loaddb.exe -v YOUR_IMAGE.E01 >
tsk_loaddb.txt 2>&1

it will generate a huge log file, tsk_loaddb.txt

zip the tsk_loaddb.txt file and email to us. If it's too large, we can
setup FTP.

Thanks,
Adam

On Fri, Jun 22, 2012 at 2:05 PM, Adam Malinowski
amalinowski@basistech.comwrote:

Hi Fabiano,

We will release another beta next week that likely fixes the linking
error
you experienced.
We can then see if the image can be added to Autopsy or not. If not, we
can then decide how further to debug issue with the image (100GB upload
is
huge, but not impossible).

Thanks,
Adam

On Wed, Jun 20, 2012 at 4:44 PM, FabianoQ <
reply@reply.github.com

wrote:

Hi Adam

all the images i tested are over 100gb (compressed)let me know ...

Fabiano Querceto
339-3032968
348-4707739

Da: adam reply@reply.github.com
A: FabianoQ fabiano.querceto@yahoo.it
Inviato: Martedì 19 Giugno 2012 18:36
Oggetto: Re: [autopsy] Fatal error v3.0b3 (#53)

Hi Fabiano,
what is roughly the size of the Win XP image ? We have an FTP site we
could use if it fits, what's your email I can use (need to send you the
creds).
Thanks,
Adam

On Mon, Jun 18, 2012 at 5:31 PM, Adam Malinowski
amalinowski@basistech.comwrote:

Thanks, Fabiano,

Yes, it'd be very useful. We'll see if we can find a (secure) way
for
you
to upload them and get back to you.

Adam

On Mon, Jun 18, 2012 at 5:28 PM, FabianoQ <
reply@reply.github.com

wrote:

Hi Adam, thanks for your lightning-fast response.

My pc environment is Windows 7 Ultimate SP1 x64;
about the "not (re)compiled" stuff, i'm using Autopsy
from the installer not from the source and i tried 3
or 4 hd images and just one produced the error.

If we can think of a method to deal with the size of them
(and you think it's useful) i can provide the .e01 images.

Regards

Fabiano Querceto

Da: adam reply@reply.github.com
A: FabianoQ fabiano.querceto@yahoo.it
Inviato: Lunedì 18 Giugno 2012 23:13
Oggetto: Re: [autopsy] Fatal error v3.0b3 (#53)

Hi Fabiono,

It looks like you have not (re)compiled the Java bindings - the
error
is
usually an indication of that.
Please add the sleuthkit/bindings/java project to netbeans and
rebuild
the
project (or, alternatively, use ant from command line).

With regards to the missing activity problem, are you running your
Autopsy
build on Linux ?
Unfortunately, on Linux recent activity module is unsupported (we
need
to
handle this better), because it currently relies on some
windows-only
tools
(maybe we could get them to run with wine, but it's slightly
hackish).

Thanks,
Adam (Autopsy team)

On Mon, Jun 18, 2012 at 5:01 PM, FabianoQ <
reply@reply.github.com

wrote:

While ingesting an EWF hd image (Windows XP inside) i received the
following error
"Fatal error during ingest.
Caused by: java.lang.NoSuchMethodError:
org.sleuthkit.datamodel.TskCoreException: method ()V not
found"
after answering OK Autopsy closed.

I can provide the hd image.

Reply to this email directly or view it on GitHub:
#53

Reply to this email directly or view it on GitHub:
#53 (comment)

Reply to this email directly or view it on GitHub:
#53 (comment)

Reply to this email directly or view it on GitHub:
#53 (comment)

Reply to this email directly or view it on GitHub:
#53 (comment)

Reply to this email directly or view it on GitHub:
#53 (comment)

Reply to this email directly or view it on GitHub:
#53 (comment)

FabianoQ · 2012-07-04T11:00:53Z

Great, i'll give it a try immediatly

Fabiano Querceto
339-3032968
348-4707739

Da: adam reply@reply.github.com
A: FabianoQ fabiano.querceto@yahoo.it
Inviato: Mercoledì 4 Luglio 2012 0:11
Oggetto: Re: [autopsy] Fatal error v3.0b3 (#53)

Fabiano.

We just released a new version that fixes some bugs and adds better error
handing.

http://sourceforge.net/projects/autopsy/files/autopsy/3.0.0%20beta/

Could you try to reproduce the issue with the image using 3b4 ?
If it still fails to add the image, it should at least provide a better
error log.

Thanks,
Adam

On Tue, Jun 26, 2012 at 5:14 PM, Adam Malinowski
amalinowski@basistech.comwrote:

Thanks very much!
Adam

On Tue, Jun 26, 2012 at 4:53 PM, FabianoQ <
reply@reply.github.com

wrote:

The tsk_loaddb.txt file is about 2gb (89 mb compressed)
here is the link to my dropbox
https://dl.dropbox.com/u/42442949/tsk_loaddb.rar

Let me know ...

Fabiano Querceto
339-3032968
348-4707739

Da: adam reply@reply.github.com
A: FabianoQ fabiano.querceto@yahoo.it
Inviato: Lunedì 25 Giugno 2012 18:16
Oggetto: Re: [autopsy] Fatal error v3.0b3 (#53)

Hi Fabiano,

Uploading 100GB file may be quite difficult. However, we may be able to
trace the issue other ways.
Would you be mind to run a sleuthkit command on the image and send us a
log
?

Steps:

download latest beta sleuthkit build from

http://sourceforge.net/projects/sleuthkit/files/sleuthkit/4.0.0/sleuthkit-win32-4.0.0b1.zip/download

unzip it

execute command from windows shell, like:

sleuthkit-win32-4.0.0b1\bin\tsk_loaddb.exe -v YOUR_IMAGE.E01 >
tsk_loaddb.txt 2>&1

it will generate a huge log file, tsk_loaddb.txt

zip the tsk_loaddb.txt file and email to us. If it's too large, we can
setup FTP.

Thanks,
Adam

On Fri, Jun 22, 2012 at 2:05 PM, Adam Malinowski
amalinowski@basistech.comwrote:

Hi Fabiano,

We will release another beta next week that likely fixes the linking
error
you experienced.
We can then see if the image can be added to Autopsy or not. If not, we
can then decide how further to debug issue with the image (100GB upload
is
huge, but not impossible).

Thanks,
Adam

On Wed, Jun 20, 2012 at 4:44 PM, FabianoQ <
reply@reply.github.com

wrote:

Hi Adam

all the images i tested are over 100gb (compressed)let me know ...

Fabiano Querceto
339-3032968
348-4707739

Da: adam reply@reply.github.com
A: FabianoQ fabiano.querceto@yahoo.it
Inviato: Martedì 19 Giugno 2012 18:36
Oggetto: Re: [autopsy] Fatal error v3.0b3 (#53)

Hi Fabiano,
what is roughly the size of the Win XP image ? We have an FTP site we
could use if it fits, what's your email I can use (need to send you the
creds).
Thanks,
Adam

On Mon, Jun 18, 2012 at 5:31 PM, Adam Malinowski
amalinowski@basistech.comwrote:

Thanks, Fabiano,

Yes, it'd be very useful. We'll see if we can find a (secure) way
for
you
to upload them and get back to you.

Adam

On Mon, Jun 18, 2012 at 5:28 PM, FabianoQ <
reply@reply.github.com

wrote:

Hi Adam, thanks for your lightning-fast response.

My pc environment is Windows 7 Ultimate SP1 x64;
about the "not (re)compiled" stuff, i'm using Autopsy
from the installer not from the source and i tried 3
or 4 hd images and just one produced the error.

If we can think of a method to deal with the size of them
(and you think it's useful) i can provide the .e01 images.

Regards

Fabiano Querceto

Da: adam reply@reply.github.com
A: FabianoQ fabiano.querceto@yahoo.it
Inviato: Lunedì 18 Giugno 2012 23:13
Oggetto: Re: [autopsy] Fatal error v3.0b3 (#53)

Hi Fabiono,

It looks like you have not (re)compiled the Java bindings - the
error
is
usually an indication of that.
Please add the sleuthkit/bindings/java project to netbeans and
rebuild
the
project (or, alternatively, use ant from command line).

With regards to the missing activity problem, are you running your
Autopsy
build on Linux ?
Unfortunately, on Linux recent activity module is unsupported (we
need
to
handle this better), because it currently relies on some
windows-only
tools
(maybe we could get them to run with wine, but it's slightly
hackish).

Thanks,
Adam (Autopsy team)

On Mon, Jun 18, 2012 at 5:01 PM, FabianoQ <
reply@reply.github.com

wrote:

While ingesting an EWF hd image (Windows XP inside) i received the
following error
"Fatal error during ingest.
Caused by: java.lang.NoSuchMethodError:
org.sleuthkit.datamodel.TskCoreException: method ()V not
found"
after answering OK Autopsy closed.

I can provide the hd image.

Reply to this email directly or view it on GitHub:
#53

Reply to this email directly or view it on GitHub:
#53 (comment)

Reply to this email directly or view it on GitHub:
#53 (comment)

Reply to this email directly or view it on GitHub:
#53 (comment)

Reply to this email directly or view it on GitHub:
#53 (comment)

Reply to this email directly or view it on GitHub:
#53 (comment)

Reply to this email directly or view it on GitHub:
#53 (comment)

Reply to this email directly or view it on GitHub:
#53 (comment)

FabianoQ · 2012-07-05T21:47:11Z

Hi Adam

i had a go with 3b4 and the crash did not happened :-)

the recent activity module made it job too :-)

.. but ...

no internet history was found while before it worked :-(
all the hd images i have are made by Tableau TD1 in EWF format
split in 2gb chunks (some programs report them as being made by encase v3.22g ... )
now this happens:

when i start a new case and add the first hd image everything works fine
(the image is correctly recognized as EWF format and so on ..)
if i add a second (or third) image to the case it is mistaken as a plain
dd image the size of just the first chunk and consequently nothing is extracted
from the image;

if i start a new case and add the image that didn't worked as the first image
in the case it works fine 8still no internet history, no connected devices

:-(

let me know if i can do anything to help address this issue.

Thanks

Fabiano Querceto

Da: adam reply@reply.github.com
A: FabianoQ fabiano.querceto@yahoo.it
Inviato: Mercoledì 4 Luglio 2012 0:11
Oggetto: Re: [autopsy] Fatal error v3.0b3 (#53)

Fabiano.

We just released a new version that fixes some bugs and adds better error
handing.

http://sourceforge.net/projects/autopsy/files/autopsy/3.0.0%20beta/

Could you try to reproduce the issue with the image using 3b4 ?
If it still fails to add the image, it should at least provide a better
error log.

Thanks,
Adam

On Tue, Jun 26, 2012 at 5:14 PM, Adam Malinowski
amalinowski@basistech.comwrote:

Thanks very much!
Adam

On Tue, Jun 26, 2012 at 4:53 PM, FabianoQ <
reply@reply.github.com

wrote:

The tsk_loaddb.txt file is about 2gb (89 mb compressed)
here is the link to my dropbox
https://dl.dropbox.com/u/42442949/tsk_loaddb.rar

Let me know ...

Fabiano Querceto
339-3032968
348-4707739

Da: adam reply@reply.github.com
A: FabianoQ fabiano.querceto@yahoo.it
Inviato: Lunedì 25 Giugno 2012 18:16
Oggetto: Re: [autopsy] Fatal error v3.0b3 (#53)

Hi Fabiano,

Uploading 100GB file may be quite difficult. However, we may be able to
trace the issue other ways.
Would you be mind to run a sleuthkit command on the image and send us a
log
?

Steps:

download latest beta sleuthkit build from

http://sourceforge.net/projects/sleuthkit/files/sleuthkit/4.0.0/sleuthkit-win32-4.0.0b1.zip/download

unzip it

execute command from windows shell, like:

sleuthkit-win32-4.0.0b1\bin\tsk_loaddb.exe -v YOUR_IMAGE.E01 >
tsk_loaddb.txt 2>&1

it will generate a huge log file, tsk_loaddb.txt

zip the tsk_loaddb.txt file and email to us. If it's too large, we can
setup FTP.

Thanks,
Adam

On Fri, Jun 22, 2012 at 2:05 PM, Adam Malinowski
amalinowski@basistech.comwrote:

Hi Fabiano,

We will release another beta next week that likely fixes the linking
error
you experienced.
We can then see if the image can be added to Autopsy or not. If not, we
can then decide how further to debug issue with the image (100GB upload
is
huge, but not impossible).

Thanks,
Adam

On Wed, Jun 20, 2012 at 4:44 PM, FabianoQ <
reply@reply.github.com

wrote:

Hi Adam

all the images i tested are over 100gb (compressed)let me know ...

Fabiano Querceto
339-3032968
348-4707739

Da: adam reply@reply.github.com
A: FabianoQ fabiano.querceto@yahoo.it
Inviato: Martedì 19 Giugno 2012 18:36
Oggetto: Re: [autopsy] Fatal error v3.0b3 (#53)

Hi Fabiano,
what is roughly the size of the Win XP image ? We have an FTP site we
could use if it fits, what's your email I can use (need to send you the
creds).
Thanks,
Adam

On Mon, Jun 18, 2012 at 5:31 PM, Adam Malinowski
amalinowski@basistech.comwrote:

Thanks, Fabiano,

Yes, it'd be very useful. We'll see if we can find a (secure) way
for
you
to upload them and get back to you.

Adam

On Mon, Jun 18, 2012 at 5:28 PM, FabianoQ <
reply@reply.github.com

wrote:

Hi Adam, thanks for your lightning-fast response.

My pc environment is Windows 7 Ultimate SP1 x64;
about the "not (re)compiled" stuff, i'm using Autopsy
from the installer not from the source and i tried 3
or 4 hd images and just one produced the error.

If we can think of a method to deal with the size of them
(and you think it's useful) i can provide the .e01 images.

Regards

Fabiano Querceto

Da: adam reply@reply.github.com
A: FabianoQ fabiano.querceto@yahoo.it
Inviato: Lunedì 18 Giugno 2012 23:13
Oggetto: Re: [autopsy] Fatal error v3.0b3 (#53)

Hi Fabiono,

It looks like you have not (re)compiled the Java bindings - the
error
is
usually an indication of that.
Please add the sleuthkit/bindings/java project to netbeans and
rebuild
the
project (or, alternatively, use ant from command line).

With regards to the missing activity problem, are you running your
Autopsy
build on Linux ?
Unfortunately, on Linux recent activity module is unsupported (we
need
to
handle this better), because it currently relies on some
windows-only
tools
(maybe we could get them to run with wine, but it's slightly
hackish).

Thanks,
Adam (Autopsy team)

On Mon, Jun 18, 2012 at 5:01 PM, FabianoQ <
reply@reply.github.com

wrote:

While ingesting an EWF hd image (Windows XP inside) i received the
following error
"Fatal error during ingest.
Caused by: java.lang.NoSuchMethodError:
org.sleuthkit.datamodel.TskCoreException: method ()V not
found"
after answering OK Autopsy closed.

I can provide the hd image.

Reply to this email directly or view it on GitHub:
#53

Reply to this email directly or view it on GitHub:
#53 (comment)

Reply to this email directly or view it on GitHub:
#53 (comment)

Reply to this email directly or view it on GitHub:
#53 (comment)

Reply to this email directly or view it on GitHub:
#53 (comment)

Reply to this email directly or view it on GitHub:
#53 (comment)

Reply to this email directly or view it on GitHub:
#53 (comment)

Reply to this email directly or view it on GitHub:
#53 (comment)

adam-m · 2012-07-06T13:19:39Z

Hi Fabiano,
Thanks for the useful analysis.
Could you please send the zipped username\appdata\roaming.autopsy
directory with the log file after these issues were encountered ? No need
for turning on verbose log for now.

Thanks,
Adam

On Thu, Jul 5, 2012 at 5:48 PM, FabianoQ <
reply@reply.github.com

wrote:

Hi Adam

i had a go with 3b4 and the crash did not happened :-)

the recent activity module made it job too :-)

.. but ...

no internet history was found while before it worked :-(
all the hd images i have are made by Tableau TD1 in EWF format
split in 2gb chunks (some programs report them as being made by encase
v3.22g ... )
now this happens:

when i start a new case and add the first hd image everything works fine
(the image is correctly recognized as EWF format and so on ..)
if i add a second (or third) image to the case it is mistaken as a plain
dd image the size of just the first chunk and consequently nothing is
extracted
from the image;

if i start a new case and add the image that didn't worked as the first
image
in the case it works fine 8still no internet history, no connected devices

:-(

let me know if i can do anything to help address this issue.

Thanks

Fabiano Querceto

Da: adam reply@reply.github.com
A: FabianoQ fabiano.querceto@yahoo.it
Inviato: Mercoledì 4 Luglio 2012 0:11
Oggetto: Re: [autopsy] Fatal error v3.0b3 (#53)

Fabiano.

We just released a new version that fixes some bugs and adds better error
handing.

http://sourceforge.net/projects/autopsy/files/autopsy/3.0.0%20beta/

Could you try to reproduce the issue with the image using 3b4 ?
If it still fails to add the image, it should at least provide a better
error log.

Thanks,
Adam

On Tue, Jun 26, 2012 at 5:14 PM, Adam Malinowski
amalinowski@basistech.comwrote:

Thanks very much!
Adam

On Tue, Jun 26, 2012 at 4:53 PM, FabianoQ <
reply@reply.github.com

wrote:

The tsk_loaddb.txt file is about 2gb (89 mb compressed)
here is the link to my dropbox
https://dl.dropbox.com/u/42442949/tsk_loaddb.rar

Let me know ...

Fabiano Querceto
339-3032968
348-4707739

Da: adam reply@reply.github.com
A: FabianoQ fabiano.querceto@yahoo.it
Inviato: Lunedì 25 Giugno 2012 18:16
Oggetto: Re: [autopsy] Fatal error v3.0b3 (#53)

Hi Fabiano,

Uploading 100GB file may be quite difficult. However, we may be able to
trace the issue other ways.
Would you be mind to run a sleuthkit command on the image and send us a
log
?

Steps:

download latest beta sleuthkit build from

http://sourceforge.net/projects/sleuthkit/files/sleuthkit/4.0.0/sleuthkit-win32-4.0.0b1.zip/download

unzip it

execute command from windows shell, like:

sleuthkit-win32-4.0.0b1\bin\tsk_loaddb.exe -v YOUR_IMAGE.E01 >
tsk_loaddb.txt 2>&1

it will generate a huge log file, tsk_loaddb.txt

zip the tsk_loaddb.txt file and email to us. If it's too large, we
can
setup FTP.

Thanks,
Adam

On Fri, Jun 22, 2012 at 2:05 PM, Adam Malinowski
amalinowski@basistech.comwrote:

Hi Fabiano,

We will release another beta next week that likely fixes the linking
error
you experienced.
We can then see if the image can be added to Autopsy or not. If not,
we
can then decide how further to debug issue with the image (100GB
upload
is
huge, but not impossible).

Thanks,
Adam

On Wed, Jun 20, 2012 at 4:44 PM, FabianoQ <
reply@reply.github.com

wrote:

Hi Adam

all the images i tested are over 100gb (compressed)let me know ...

Fabiano Querceto
339-3032968
348-4707739

Da: adam reply@reply.github.com
A: FabianoQ fabiano.querceto@yahoo.it
Inviato: Martedì 19 Giugno 2012 18:36
Oggetto: Re: [autopsy] Fatal error v3.0b3 (#53)

Hi Fabiano,
what is roughly the size of the Win XP image ? We have an FTP site
we
could use if it fits, what's your email I can use (need to send you
the
creds).
Thanks,
Adam

On Mon, Jun 18, 2012 at 5:31 PM, Adam Malinowski
amalinowski@basistech.comwrote:

Thanks, Fabiano,

Yes, it'd be very useful. We'll see if we can find a (secure) way
for
you
to upload them and get back to you.

Adam

On Mon, Jun 18, 2012 at 5:28 PM, FabianoQ <
reply@reply.github.com

wrote:

Hi Adam, thanks for your lightning-fast response.

My pc environment is Windows 7 Ultimate SP1 x64;
about the "not (re)compiled" stuff, i'm using Autopsy
from the installer not from the source and i tried 3
or 4 hd images and just one produced the error.

If we can think of a method to deal with the size of them
(and you think it's useful) i can provide the .e01 images.

Regards

Fabiano Querceto

Da: adam reply@reply.github.com
A: FabianoQ fabiano.querceto@yahoo.it
Inviato: Lunedì 18 Giugno 2012 23:13
Oggetto: Re: [autopsy] Fatal error v3.0b3 (#53)

Hi Fabiono,

It looks like you have not (re)compiled the Java bindings - the
error
is
usually an indication of that.
Please add the sleuthkit/bindings/java project to netbeans and
rebuild
the
project (or, alternatively, use ant from command line).

With regards to the missing activity problem, are you running your
Autopsy
build on Linux ?
Unfortunately, on Linux recent activity module is unsupported (we
need
to
handle this better), because it currently relies on some
windows-only
tools
(maybe we could get them to run with wine, but it's slightly
hackish).

Thanks,
Adam (Autopsy team)

On Mon, Jun 18, 2012 at 5:01 PM, FabianoQ <
reply@reply.github.com

wrote:

While ingesting an EWF hd image (Windows XP inside) i received
the
following error
"Fatal error during ingest.
Caused by: java.lang.NoSuchMethodError:
org.sleuthkit.datamodel.TskCoreException: method ()V not
found"
after answering OK Autopsy closed.

I can provide the hd image.

Reply to this email directly or view it on GitHub:
#53

Reply to this email directly or view it on GitHub:

#53 (comment)

Reply to this email directly or view it on GitHub:

#53 (comment)

Reply to this email directly or view it on GitHub:
#53 (comment)

Reply to this email directly or view it on GitHub:
#53 (comment)

Reply to this email directly or view it on GitHub:
#53 (comment)

Reply to this email directly or view it on GitHub:
#53 (comment)

Reply to this email directly or view it on GitHub:
#53 (comment)

Reply to this email directly or view it on GitHub:
#53 (comment)

FabianoQ · 2012-07-07T15:38:28Z

Hi Adam

here is the link for the archive: https://dl.dropbox.com/u/42442949/.autopsy.rar
the archive has a password (qwerty) i had to put the password because yahoo mailer
kept saying tha it had a virus ?!?!?!? and in the end the mail was not delivered
because of the size (just 4mb) so take it from my drop box.

let me know if i can help ..

regards

Fabiano Querceto

Da: adam reply@reply.github.com
A: FabianoQ fabiano.querceto@yahoo.it
Inviato: Venerdì 6 Luglio 2012 15:19
Oggetto: Re: [autopsy] Fatal error v3.0b3 (#53)

Hi Fabiano,
Thanks for the useful analysis.
Could you please send the zipped username\appdata\roaming.autopsy
directory with the log file after these issues were encountered ? No need
for turning on verbose log for now.

Thanks,
Adam

On Thu, Jul 5, 2012 at 5:48 PM, FabianoQ <
reply@reply.github.com

wrote:

Hi Adam

i had a go with 3b4 and the crash did not happened :-)

the recent activity module made it job too :-)

.. but ...

no internet history was found while before it worked :-(
all the hd images i have are made by Tableau TD1 in EWF format
split in 2gb chunks (some programs report them as being made by encase
v3.22g ... )
now this happens:

when i start a new case and add the first hd image everything works fine
(the image is correctly recognized as EWF format and so on ..)
if i add a second (or third) image to the case it is mistaken as a plain
dd image the size of just the first chunk and consequently nothing is
extracted
from the image;

if i start a new case and add the image that didn't worked as the first
image
in the case it works fine 8still no internet history, no connected devices

:-(

let me know if i can do anything to help address this issue.

Thanks

Fabiano Querceto

Da: adam reply@reply.github.com
A: FabianoQ fabiano.querceto@yahoo.it
Inviato: Mercoledì 4 Luglio 2012 0:11
Oggetto: Re: [autopsy] Fatal error v3.0b3 (#53)

Fabiano.

We just released a new version that fixes some bugs and adds better error
handing.

http://sourceforge.net/projects/autopsy/files/autopsy/3.0.0%20beta/

Could you try to reproduce the issue with the image using 3b4 ?
If it still fails to add the image, it should at least provide a better
error log.

Thanks,
Adam

On Tue, Jun 26, 2012 at 5:14 PM, Adam Malinowski
amalinowski@basistech.comwrote:

Thanks very much!
Adam

On Tue, Jun 26, 2012 at 4:53 PM, FabianoQ <
reply@reply.github.com

wrote:

The tsk_loaddb.txt file is about 2gb (89 mb compressed)
here is the link to my dropbox
https://dl.dropbox.com/u/42442949/tsk_loaddb.rar

Let me know ...

Fabiano Querceto
339-3032968
348-4707739

Da: adam reply@reply.github.com
A: FabianoQ fabiano.querceto@yahoo.it
Inviato: Lunedì 25 Giugno 2012 18:16
Oggetto: Re: [autopsy] Fatal error v3.0b3 (#53)

Hi Fabiano,

Uploading 100GB file may be quite difficult. However, we may be able to
trace the issue other ways.
Would you be mind to run a sleuthkit command on the image and send us a
log
?

Steps:

download latest beta sleuthkit build from

http://sourceforge.net/projects/sleuthkit/files/sleuthkit/4.0.0/sleuthkit-win32-4.0.0b1.zip/download

unzip it

execute command from windows shell, like:

sleuthkit-win32-4.0.0b1\bin\tsk_loaddb.exe -v YOUR_IMAGE.E01 >
tsk_loaddb.txt 2>&1

it will generate a huge log file, tsk_loaddb.txt

zip the tsk_loaddb.txt file and email to us. If it's too large, we
can
setup FTP.

Thanks,
Adam

On Fri, Jun 22, 2012 at 2:05 PM, Adam Malinowski
amalinowski@basistech.comwrote:

Hi Fabiano,

We will release another beta next week that likely fixes the linking
error
you experienced.
We can then see if the image can be added to Autopsy or not. If not,
we
can then decide how further to debug issue with the image (100GB
upload
is
huge, but not impossible).

Thanks,
Adam

On Wed, Jun 20, 2012 at 4:44 PM, FabianoQ <
reply@reply.github.com

wrote:

Hi Adam

all the images i tested are over 100gb (compressed)let me know ...

Fabiano Querceto
339-3032968
348-4707739

Da: adam reply@reply.github.com
A: FabianoQ fabiano.querceto@yahoo.it
Inviato: Martedì 19 Giugno 2012 18:36
Oggetto: Re: [autopsy] Fatal error v3.0b3 (#53)

Hi Fabiano,
what is roughly the size of the Win XP image ? We have an FTP site
we
could use if it fits, what's your email I can use (need to send you
the
creds).
Thanks,
Adam

On Mon, Jun 18, 2012 at 5:31 PM, Adam Malinowski
amalinowski@basistech.comwrote:

Thanks, Fabiano,

Yes, it'd be very useful. We'll see if we can find a (secure) way
for
you
to upload them and get back to you.

Adam

On Mon, Jun 18, 2012 at 5:28 PM, FabianoQ <
reply@reply.github.com

wrote:

Hi Adam, thanks for your lightning-fast response.

My pc environment is Windows 7 Ultimate SP1 x64;
about the "not (re)compiled" stuff, i'm using Autopsy
from the installer not from the source and i tried 3
or 4 hd images and just one produced the error.

If we can think of a method to deal with the size of them
(and you think it's useful) i can provide the .e01 images.

Regards

Fabiano Querceto

Da: adam reply@reply.github.com
A: FabianoQ fabiano.querceto@yahoo.it
Inviato: Lunedì 18 Giugno 2012 23:13
Oggetto: Re: [autopsy] Fatal error v3.0b3 (#53)

Hi Fabiono,

It looks like you have not (re)compiled the Java bindings - the
error
is
usually an indication of that.
Please add the sleuthkit/bindings/java project to netbeans and
rebuild
the
project (or, alternatively, use ant from command line).

With regards to the missing activity problem, are you running your
Autopsy
build on Linux ?
Unfortunately, on Linux recent activity module is unsupported (we
need
to
handle this better), because it currently relies on some
windows-only
tools
(maybe we could get them to run with wine, but it's slightly
hackish).

Thanks,
Adam (Autopsy team)

On Mon, Jun 18, 2012 at 5:01 PM, FabianoQ <
reply@reply.github.com

wrote:

While ingesting an EWF hd image (Windows XP inside) i received
the
following error
"Fatal error during ingest.
Caused by: java.lang.NoSuchMethodError:
org.sleuthkit.datamodel.TskCoreException: method ()V not
found"
after answering OK Autopsy closed.

I can provide the hd image.

Reply to this email directly or view it on GitHub:
#53

Reply to this email directly or view it on GitHub:

#53 (comment)

Reply to this email directly or view it on GitHub:

#53 (comment)

Reply to this email directly or view it on GitHub:
#53 (comment)

Reply to this email directly or view it on GitHub:
#53 (comment)

Reply to this email directly or view it on GitHub:
#53 (comment)

Reply to this email directly or view it on GitHub:
#53 (comment)

Reply to this email directly or view it on GitHub:
#53 (comment)

Reply to this email directly or view it on GitHub:
#53 (comment)

Reply to this email directly or view it on GitHub:
#53 (comment)

adam-m · 2012-07-10T21:18:33Z

Hi Fabiano,

Is it possible that your image:

F:\CTU04_Hitachi_HDP725025GLA380_GEK231RB14B6ZA\CTU04.E01

has no file systems in it ? I see that there are 3 partitions that have no
filesystems. Perhaps there is no other partition with a filesystem.

We are currently not handling "no filesystems" case well, but plan to.

You could also send the verbose log (as earlier) to help us find out, if
you are unsure.

Also, are there additional image chunks such
as CTU04.E02, CTU04.E03, CTU04.E04, .... ?
If so, they all need to be in the same directory for the image to be opened
properly.

Thanks,
Adam

FabianoQ · 2012-07-10T22:19:11Z

It's a normal Windows XP Installation with two ntfs partitions and some extra unpartitioned space;
the image is regularly opened by FTK Imager 3 and ProDiscover Basic;
all the chunks are in the same dir with the first one;

If F:\CTU04_Hitachi_HDP725025GLA380_GEK231RB14B6ZA\CTU04.E01 is the FIRST
image i add to a new case everything works as expected;

if i add it as the second (or third ...) image of a case the error occurs;
every image i have WORKS if added as FIRST image, DOESN'T WORK if added as
second image of the case

Fabiano Querceto
339-3032968
348-4707739

Da: adam reply@reply.github.com
A: FabianoQ fabiano.querceto@yahoo.it
Inviato: Martedì 10 Luglio 2012 23:18
Oggetto: Re: [autopsy] Fatal error v3.0b3 (#53)

Hi Fabiano,

Is it possible that your image:

F:\CTU04_Hitachi_HDP725025GLA380_GEK231RB14B6ZA\CTU04.E01

has no file systems in it ? I see that there are 3 partitions that have no
filesystems. Perhaps there is no other partition with a filesystem.

We are currently not handling "no filesystems" case well, but plan to.

You could also send the verbose log (as earlier) to help us find out, if
you are unsure.

Also, are there additional image chunks such
as CTU04.E02, CTU04.E03, CTU04.E04, .... ?
If so, they all need to be in the same directory for the image to be opened
properly.

Thanks,
Adam

Reply to this email directly or view it on GitHub:
#53 (comment)

adam-m · 2012-08-01T20:32:16Z

Hi Fabiano,
Would you be able to also collect and upload the verbose log showing 2
images being added.

Thanks,
Adam

On Tue, Jul 10, 2012 at 6:19 PM, FabianoQ <
reply@reply.github.com

wrote:

It's a normal Windows XP Installation with two ntfs partitions and some
extra unpartitioned space;
the image is regularly opened by FTK Imager 3 and ProDiscover Basic;
all the chunks are in the same dir with the first one;

If F:\CTU04_Hitachi_HDP725025GLA380_GEK231RB14B6ZA\CTU04.E01 is the FIRST
image i add to a new case everything works as expected;

if i add it as the second (or third ...) image of a case the error occurs;
every image i have WORKS if added as FIRST image, DOESN'T WORK if added as
second image of the case

Fabiano Querceto
339-3032968
348-4707739

Da: adam reply@reply.github.com
A: FabianoQ fabiano.querceto@yahoo.it
Inviato: Martedì 10 Luglio 2012 23:18
Oggetto: Re: [autopsy] Fatal error v3.0b3 (#53)

Hi Fabiano,

Is it possible that your image:

F:\CTU04_Hitachi_HDP725025GLA380_GEK231RB14B6ZA\CTU04.E01

has no file systems in it ? I see that there are 3 partitions that have no
filesystems. Perhaps there is no other partition with a filesystem.

We are currently not handling "no filesystems" case well, but plan to.

You could also send the verbose log (as earlier) to help us find out, if
you are unsure.

Also, are there additional image chunks such
as CTU04.E02, CTU04.E03, CTU04.E04, .... ?
If so, they all need to be in the same directory for the image to be opened
properly.

Thanks,
Adam

Reply to this email directly or view it on GitHub:
#53 (comment)

Reply to this email directly or view it on GitHub:
#53 (comment)

adam-m · 2012-10-17T13:53:10Z

Hi Fabiano,
We just released Autopsy 3.0.0, could you see if you are still having issues adding your multiple EWF images ?
http://sourceforge.net/projects/autopsy/files/autopsy/3.0.0/

Thanks,
Adam

FabianoQ · 2012-10-18T17:00:45Z

I only did a quick test with to small (pendrive) images
and everything worked as expected.
Thanks

Fabiano Querceto
339-3032968
348-4707739

Da: adam notifications@github.com
A: sleuthkit/autopsy autopsy@noreply.github.com
Cc: FabianoQ fabiano.querceto@yahoo.it
Inviato: Mercoledì 17 Ottobre 2012 15:53
Oggetto: Re: [autopsy] Fatal error v3.0b3 (#53)

Hi Fabiano,
We just released Autopsy 3.0.0, could you see if you are still having issues adding your multiple EWF images ?
http://sourceforge.net/projects/autopsy/files/autopsy/3.0.0/
Thanks,
Adam
—
Reply to this email directly or view it on GitHub.

adam-m · 2012-10-18T17:41:55Z

Thanks, Fabiano, I will close the issue, feel free to reopen if you
re-encounter the issue with other images.

Adam

On Thu, Oct 18, 2012 at 1:00 PM, FabianoQ notifications@github.com wrote:

I only did a quick test with to small (pendrive) images
and everything worked as expected.
Thanks

Fabiano Querceto
339-3032968
348-4707739

Da: adam notifications@github.com
A: sleuthkit/autopsy autopsy@noreply.github.com
Cc: FabianoQ fabiano.querceto@yahoo.it
Inviato: Mercoledì 17 Ottobre 2012 15:53
Oggetto: Re: [autopsy] Fatal error v3.0b3 (#53)

Hi Fabiano,
We just released Autopsy 3.0.0, could you see if you are still having
issues adding your multiple EWF images ?
http://sourceforge.net/projects/autopsy/files/autopsy/3.0.0/
Thanks,
Adam
—
Reply to this email directly or view it on GitHub.

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/53#issuecomment-9572184.

ghost assigned adam-m Oct 17, 2012

adam-m closed this as completed Oct 18, 2012

bcarrier mentioned this issue Jun 13, 2018

Couldn't add data source #2001

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fatal error v3.0b3 (multiple EWF images) #53

Fatal error v3.0b3 (multiple EWF images) #53

FabianoQ commented Jun 18, 2012

adam-m commented Jun 18, 2012

FabianoQ commented Jun 18, 2012

adam-m commented Jun 18, 2012

adam-m commented Jun 19, 2012

FabianoQ commented Jun 20, 2012

adam-m commented Jun 22, 2012

adam-m commented Jun 25, 2012

FabianoQ commented Jun 26, 2012

FabianoQ commented Jun 26, 2012

adam-m commented Jun 26, 2012

adam-m commented Jul 3, 2012

FabianoQ commented Jul 4, 2012

FabianoQ commented Jul 5, 2012

adam-m commented Jul 6, 2012

FabianoQ commented Jul 7, 2012

adam-m commented Jul 10, 2012

FabianoQ commented Jul 10, 2012

adam-m commented Aug 1, 2012

adam-m commented Oct 17, 2012

FabianoQ commented Oct 18, 2012

adam-m commented Oct 18, 2012

Fatal error v3.0b3 (multiple EWF images) #53

Fatal error v3.0b3 (multiple EWF images) #53

Comments

FabianoQ commented Jun 18, 2012

adam-m commented Jun 18, 2012

FabianoQ commented Jun 18, 2012

adam-m commented Jun 18, 2012

adam-m commented Jun 19, 2012

FabianoQ commented Jun 20, 2012

adam-m commented Jun 22, 2012

adam-m commented Jun 25, 2012

FabianoQ commented Jun 26, 2012

FabianoQ commented Jun 26, 2012

adam-m commented Jun 26, 2012

adam-m commented Jul 3, 2012

FabianoQ commented Jul 4, 2012

FabianoQ commented Jul 5, 2012

adam-m commented Jul 6, 2012

FabianoQ commented Jul 7, 2012

adam-m commented Jul 10, 2012

FabianoQ commented Jul 10, 2012

adam-m commented Aug 1, 2012

adam-m commented Oct 17, 2012

FabianoQ commented Oct 18, 2012

adam-m commented Oct 18, 2012