Autopsy 4.14.0 Missing Results Issues

Online Training
1

Many users are experiencing a lack of certain results after running ingest modules, i.e., USB Device Attached, Hash Set Hits, etc. Restarting Autopsy after the ingest modules complete seems to fix.

My suggestion is to first try to refresh the view first by altering the Global View Settings (the gear wheel above the left pane) by checking/unchecking “Group by Data Source”.

Screen Shot 2020-04-15 at 8.52.53 AM
Screen Shot 2020-04-15 at 8.52.53 AM1256×986 75.7 KB

I am interested to know if this refreshes the results view without the need to restart. I have not been able to reproduce the problem on my systems to check for myself.

Though this is a better topic for the develop topic, I’m posting here because their is a large pool of new users experiencing the problem during the online training.

Please respond if this suggestion helps you so information can be forwarded to the developers.

2

It should always be enough to just close and open the case to see any missing results (without restarting Autopsy), but grouping by data source also forces a tree refresh. It seems like we might have some modules that aren’t sending update events after they make artifacts.

3

Thanks for the confirmation, Ann. I don’t know why–it musty be my advanced A.G.E disease–but simply reopening the case escaped me!

4

In my case, refreshing the view this way has not solved the problem. However, the lack of USB devices persists after closing and opening the case and after restarting Autopsy.
I’m working on a machine with Ubuntu 18.04.