Autopsy Portable under WinFE

Autopsy Help
#1

Hello Everyone,
Very Happy New Year

I am trying to run Autopsy Portable under WinFE environment (Home of the Windows Forensic Environment 10) .

Until now I am able to run following apps without any issue.

  1. FTK Imager
  2. Encase Imager
  3. X Ways Winhex
  4. KAPE (Collection)
  5. Nirsoft Packages 64bit

When I run autopsy portable I get a fatal error, this error comes at case selection window.
See below Pictures

1. Autopsy Loading
1. Autopsy Loading874×499 99.8 KB
2. Autopsy GUI
2. Autopsy GUI1128×569 66.1 KB
3. Autopsy Error
3. Autopsy Error1132×539 133 KB

I found WinFE very useful and if Autopsy portable can run under it then it would help a lot in triage work.

Thanks in Advance
Regards

#2

I cannot speak to this specific error, but Autopsy needs to write to the install medium. It stores file system data in a database, extracts zip files to recurse into them, etc. It simply won’t work in a read-only environment.

You could install Autopsy portable to an external device. Then boot WinFE, mount the external device read/write, and run Autopsy from there.

#3

Hi
We are using Autopsy portable from a read/write partition.
I have a log file , but the upload option is not allowing text files.
Any idea how to attach a log file.
Thanks in advance
Regards

#4

I’ve seen this issue before. I issue WinFE to my students. I was using Autopsy ver 3.1.3 and it works fine.
When I updated the USB to a newer version of Autopsy, it will not run in the WinFE environment.
Keep in mind that WinFE is a Very stripped down version of Windows. There are too many dependencies in newer version of Autopsy. So, the short answer is: Go back to ver 3.1.3.
Cheers,
Dan

#5

Thanks for update,

I understand it is very minimal OS, when I was trying to run FTK imager then also I had to push few DLLs in system 32 folder of boot image.

If some can list the dependencies then I may try to get some work arround,

I am now even able to run , liberoffice portable, vlc portable, portable pdf viewer under WinFE

I was more interested to run latest autopsy as it now support more artifact’s than 3.1 .

I have a log file but am unable to post it in this forum.

Can someone guide how to attach a text log file generated as the autopsy crash, it may help to understand what it is not able to find to run properly.

Upload option is taking pictures only.

Thanks in advance

Regards