autopsy crashes on analyzing 500GB harddrive

Autopsy Help
1

Hi,
I am using autopsy on my linux notebook. It has a debian type distribution installed and has KDE as an integrated desktop environment.
I want to analyze a harddrive that used to be internal SATA drive that I have mounted in external case and that uses USB for connecing to PC.
I can start autopsy, create a new case and also add the drive for analysis.
BUT:
After approx. 1hr. of reading in all data stored on drive autopsy crashes. It leaves a lenghty log report in its app folder and returns a short error message in command line:

root@pucki:/home/lw/autopsy/autopsy-4.21.0/bin# ./autopsy
Detected KDE; adding awt.useSystemAAFontSettings=on
WARNING: Unknown module: javafx.base specified to --add-exports
WARNING: Unknown module: javafx.controls specified to --add-exports
WARNING: Unknown module: javafx.controls specified to --add-opens
Temp Folder for Libraries: /tmp
SleuthkitJNI: loaded libtsk_jni
WARNING: A terminally deprecated method in java.lang.System has been called
WARNING: System::setSecurityManager has been called by org.netbeans.TopSecurityManager (file:/home/lw/autopsy/autopsy-4.21.0/platform/lib/boot.jar)
WARNING: Please consider reporting this to the maintainers of org.netbeans.TopSecurityManager
WARNING: System::setSecurityManager will be removed in a future release
java: fatfs_utils.c:271: fatfs_utf16_inode_str_2_utf8: Zusicherung »a_src_len > 0« nicht erfüllt.
./…/platform/lib/nbexec: Zeile 434: 30690 Abgebrochen (Speicherabzug geschrieben) “/usr/lib/jvm/java-1.17.0-openjdk-amd64/bin/java” -Djdk.home=“/usr/lib/jvm/java-1.17.0-openjdk-amd64” -classpath “/home/lw/autopsy/autopsy-4.21.0/platform/lib/boot.jar:/home/lw/autopsy/autopsy-4.21.0/platform/lib/org-openide-modules.jar:/home/lw/autopsy/autopsy-4.21.0/platform/lib/org-openide-util.jar:/home/lw/autopsy/autopsy-4.21.0/platform/lib/org-openide-util-lookup.jar:/home/lw/autopsy/autopsy-4.21.0/platform/lib/org-openide-util-ui.jar” -Dnetbeans.running.environment=kde -Dnetbeans.dirs=“/home/lw/autopsy/autopsy-4.21.0/autopsy:/home/lw/autopsy/autopsy-4.21.0/CoreTestLibs:/home/lw/autopsy/autopsy-4.21.0/harness:/home/lw/autopsy/autopsy-4.21.0/java:” -Dnetbeans.home=“/home/lw/autopsy/autopsy-4.21.0/platform” ‘-Dawt.useSystemAAFontSettings=on’ ‘-Xms24m’ ‘-Xmx4G’ ‘-XX:+UseStringDeduplication’ ‘-Dprism.order=sw’ ‘–add-opens=java.base/java.lang=ALL-UNNAMED’ ‘–add-opens=java.base/java.net=ALL-UNNAMED’ ‘–add-opens=java.desktop/javax.swing=ALL-UNNAMED’ ‘–add-opens=javafx.controls/javafx.scene.control.skin=ALL-UNNAMED’ ‘–add-exports=java.desktop/sun.awt=ALL-UNNAMED’ ‘–add-exports=javafx.controls/com.sun.javafx.scene.control.inputmap=ALL-UNNAMED’ ‘–add-exports=javafx.base/com.sun.javafx.event=ALL-UNNAMED’ -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=“/root/.autopsy/dev/var/log/heapdump.hprof” -Djava.security.manager=allow org.netbeans.Main --cachedir “/root/.cache/autopsy/dev” --userdir “/root/.autopsy/dev” “–branding” “autopsy” 0<&0

I have no idea what to do. Can you see error?

Thanks and many regards

2

Can you post the log file from the case itself. It should be in the case folder\Log\autopsy.log.0.

3

Here is the log:

2025-01-28 23:03:04.521 org.sleuthkit.autopsy.centralrepository.datamodel.RdbmsCentralRepo upgradeSchema
INFO: Central Repository is up to date
2025-01-28 23:03:31.827 org.sleuthkit.autopsy.keywordsearch.Server startLocalSolr
WARNING: Local Solr server failed to respond to status requests.
2025-01-28 23:03:31.827 org.sleuthkit.autopsy.keywordsearch.Server startLocalSolr
INFO: Starting local Solr SOLR8 server
2025-01-28 23:03:31.828 org.sleuthkit.autopsy.keywordsearch.Server startLocalSolr
INFO: Port [23.232] available, starting Solr
2025-01-28 23:03:31.828 org.sleuthkit.autopsy.keywordsearch.Server startLocalSolr
INFO: Starting Solr 8 server
2025-01-28 23:03:31.828 org.sleuthkit.autopsy.keywordsearch.Server runLocalSolr8ControlCommand
INFO: Setting Solr 8 directory: /home/lw/autopsy/autopsy-4.21.0/autopsy/solr
2025-01-28 23:03:31.829 org.sleuthkit.autopsy.keywordsearch.Server runLocalSolr8ControlCommand
INFO: Running Solr 8 command: [/home/lw/autopsy/autopsy-4.21.0/autopsy/solr/bin/autopsy-solr, start, -p, 23232] from /home/lw/autopsy/autopsy-4.21.0/autopsy/solr
2025-01-28 23:03:31.83 org.sleuthkit.autopsy.keywordsearch.Server runLocalSolr8ControlCommand
INFO: Finished running Solr 8 command
2025-01-28 23:04:31.835 org.sleuthkit.autopsy.keywordsearch.Server startLocalSolr
WARNING: Local Solr server failed to respond to status requests.
2025-01-28 23:04:31.836 org.sleuthkit.autopsy.keywordsearch.Server configureSolrConnection
SEVERE: Local Solr server is not running
2025-01-28 23:04:31.836 org.sleuthkit.autopsy.casemodule.Case openAppServiceCaseResources
SEVERE: Solr Keyword Search Service failed to open case resources for 500GBDisk1
java.util.concurrent.ExecutionException: org.sleuthkit.autopsy.appservices.AutopsyService$AutopsyServiceException: Failed to open or create core for /home/lw/Öffentlich/500GBDisk1
	java.base/java.util.concurrent.FutureTask.report(FutureTask.java:122)
	java.base/java.util.concurrent.FutureTask.get(FutureTask.java:191)
	org.sleuthkit.autopsy.casemodule.Case.openAppServiceCaseResources(Case.java:2897)
	org.sleuthkit.autopsy.casemodule.Case.create(Case.java:2243)
	org.sleuthkit.autopsy.casemodule.Case.lambda$doOpenCaseAction$6(Case.java:2160)
	java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
	java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
	java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
	java.base/java.lang.Thread.run(Thread.java:840)
org.sleuthkit.autopsy.appservices.AutopsyService$AutopsyServiceException: Failed to open or create core for /home/lw/Öffentlich/500GBDisk1
	java.base/java.util.concurrent.FutureTask.report(FutureTask.java:122)
	java.base/java.util.concurrent.FutureTask.get(FutureTask.java:191)
	org.sleuthkit.autopsy.casemodule.Case.openAppServiceCaseResources(Case.java:2897)
	org.sleuthkit.autopsy.casemodule.Case.create(Case.java:2243)
	org.sleuthkit.autopsy.casemodule.Case.lambda$doOpenCaseAction$6(Case.java:2160)
	java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
	java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
	java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
	java.base/java.lang.Thread.run(Thread.java:840)
org.sleuthkit.autopsy.keywordsearch.KeywordSearchModuleException: Unable to connect to Solr server Local keyword search service not yet running
	java.base/java.util.concurrent.FutureTask.report(FutureTask.java:122)
	java.base/java.util.concurrent.FutureTask.get(FutureTask.java:191)
	org.sleuthkit.autopsy.casemodule.Case.openAppServiceCaseResources(Case.java:2897)
	org.sleuthkit.autopsy.casemodule.Case.create(Case.java:2243)
	org.sleuthkit.autopsy.casemodule.Case.lambda$doOpenCaseAction$6(Case.java:2160)
	java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
	java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
	java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
	java.base/java.lang.Thread.run(Thread.java:840)
org.sleuthkit.autopsy.keywordsearch.KeywordSearchModuleException: Local keyword search service not yet running
	java.base/java.util.concurrent.FutureTask.report(FutureTask.java:122)
	java.base/java.util.concurrent.FutureTask.get(FutureTask.java:191)
	org.sleuthkit.autopsy.casemodule.Case.openAppServiceCaseResources(Case.java:2897)
	org.sleuthkit.autopsy.casemodule.Case.create(Case.java:2243)
	org.sleuthkit.autopsy.casemodule.Case.lambda$doOpenCaseAction$6(Case.java:2160)
	java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
	java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
	java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
	java.base/java.lang.Thread.run(Thread.java:840)
2025-01-28 23:04:31.918 org.sleuthkit.autopsy.imagegallery.PerCaseProperties getConfigSetting
INFO: File did not exist. Created file [Image Gallery.properties]
2025-01-28 23:04:32.058 org.sleuthkit.autopsy.imagegallery.datamodel.DrawableDB setPragmas
INFO: sqlite-jdbc version 3.42.0.0 loaded in native mode
2025-01-28 23:04:32.132 org.sleuthkit.autopsy.casemodule.Case openAsCurrentCase
INFO: Opened 500GBDisk1 (500gbdisk1_20250128_230303) in /home/lw/Öffentlich/500GBDisk1 as the current case
2025-01-28 23:04:32.663 org.sleuthkit.autopsy.corecomponents.DataContentViewerHex <init>
INFO: Created HexView instance: org.sleuthkit.autopsy.corecomponents.DataContentViewerHex[,0,0,0x0,invalid,layout=javax.swing.GroupLayout,alignmentX=0.0,alignmentY=0.0,border=,flags=9,maximumSize=,minimumSize=,preferredSize=java.awt.Dimension[width=100,height=58]]
2025-01-28 23:04:33.015 org.sleuthkit.autopsy.contentviewers.MediaFileViewer <init>
INFO: Created MediaView instance: org.sleuthkit.autopsy.contentviewers.MediaFileViewer[,0,0,0x0,invalid,layout=java.awt.CardLayout,alignmentX=0.0,alignmentY=0.0,border=,flags=9,maximumSize=,minimumSize=,preferredSize=]
2025-01-28 23:04:34.463 org.sleuthkit.autopsy.contentviewers.FileViewer <init>
INFO: Created ApplicationContentViewer instance: org.sleuthkit.autopsy.contentviewers.FileViewer[,0,0,0x0,invalid,layout=javax.swing.OverlayLayout,alignmentX=0.0,alignmentY=0.0,border=,flags=9,maximumSize=,minimumSize=,preferredSize=]
2025-01-28 23:04:34.829 org.sleuthkit.autopsy.corecomponents.DataContentTopComponent <init>
INFO: Created DataContentTopComponent instance: org.sleuthkit.autopsy.corecomponents.DataContentTopComponent[Data Content,0,0,0x0,invalid,layout=javax.swing.BoxLayout,alignmentX=0.0,alignmentY=0.0,border=,flags=256,maximumSize=,minimumSize=,preferredSize=]
2025-01-28 23:04:35.05 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = Cyber Triage Malware Scanner, version = 1.0.0
2025-01-28 23:04:35.091 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = Central Repository, version = 4.21.0
2025-01-28 23:04:35.146 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = Data Source Integrity, version = 4.21.0
2025-01-28 23:04:35.189 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = DJI Drone Analyzer, version = 4.21.0
2025-01-28 23:04:35.23 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = Embedded File Extractor, version = 4.21.0
2025-01-28 23:04:35.231 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = Encryption Detection, version = 4.21.0
2025-01-28 23:04:35.297 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = Extension Mismatch Detector, version = 4.21.0
2025-01-28 23:04:35.36 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = File Type Identification, version = 4.21.0
2025-01-28 23:04:35.401 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = Hash Lookup, version = 4.21.0
2025-01-28 23:04:35.401 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = Interesting Files Identifier, version = 4.21.0
2025-01-28 23:04:35.441 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = Android Analyzer (aLEAPP), version = 4.21.0
2025-01-28 23:04:35.441 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = iOS Analyzer (iLEAPP), version = 4.21.0
2025-01-28 23:04:35.483 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = PhotoRec Carver, version = 7.0
2025-01-28 23:04:35.523 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = Picture Analyzer, version = 4.21.0
2025-01-28 23:04:35.566 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = Plaso, version = 4.21.0
2025-01-28 23:04:35.606 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = Virtual Machine Extractor, version = 4.21.0
2025-01-28 23:04:35.645 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = YARA Analyzer, version = 4.21.0
2025-01-28 23:04:35.646 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = Keyword Search, version = 4.21.0
2025-01-28 23:04:35.649 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = Email Parser, version = 4.21.0
2025-01-28 23:04:35.651 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = Recent Activity, version = 4.21.0
2025-01-28 23:04:35.695 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader getIngestModuleFactories
INFO: Found ingest module factory: name = GPX Parser, version = 1.2
2025-01-28 23:04:35.696 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader getIngestModuleFactories
INFO: Found ingest module factory: name = Android Analyzer, version = 4.21.0
2025-01-28 23:04:35.785 org.sleuthkit.autopsy.keywordsearch.KeywordSearchGlobalSearchSettingsPanel customizeComponents
WARNING: Could not get number of indexed files/chunks
2025-01-28 23:04:37.088 com.basistech.df.cybertriage.autopsy.ctapi.CTCloudHttpClient createSSLContext
INFO: Creating custom SSL context
2025-01-28 23:04:37.089 com.basistech.df.cybertriage.autopsy.ctapi.CTCloudHttpClient getKeyManagers
INFO: Using default algorithm to create trust store: SunX509
2025-01-28 23:04:37.089 com.basistech.df.cybertriage.autopsy.ctapi.CTCloudHttpClient getTrustManagers
INFO: Using default algorithm to create trust store: PKIX
2025-01-28 23:04:37.231 com.basistech.df.cybertriage.autopsy.incidentoptions.CTSettings getAppDataLocalDirectory
INFO: Non-windows Application Data Path: /root/.cybertriage
4

There is nothing in that log file that I see, are there any other log files in that directory? Maybe the largest log file.

5

Hi,

at which exact location can I look for alternative log?

6

Hi, first af all, you’d better use a disk image instead of a direct disk. It reduces the risk of a crash due to the disk itself. And it is more forensic or appropriate BTW.