I have been having problems getting this autopsy module to work and have contacted the developer to no avail… Any ideas why it doesn’t work? Tried on the latest version of autopsy.
It shows the tab for the copy move detector, but is disabled.
I’m not sure what “tab” you’re talking about. Regardless, it looks like the module is broken. I’ve got it installed:
But there’s an error every time it tries to report a result:
2020-04-20 07:17:36.841 de.fau.copymoveforgerydetection.modules.ingestModule.CopyMoveIngestModule process
SEVERE: Error processing file (id = 18)
java.lang.IllegalArgumentException: Value types do not match
org.sleuthkit.datamodel.BlackboardAttribute.<init>(BlackboardAttribute.java:312)
org.sleuthkit.datamodel.BlackboardAttribute.<init>(BlackboardAttribute.java:1687)
de.fau.copymoveforgerydetection.modules.ingestModule.CopyMoveIngestModule.submitResult(CopyMoveIngestModule.java:158)
de.fau.copymoveforgerydetection.modules.ingestModule.CopyMoveIngestModule.processCore(CopyMoveIngestModule.java:137)
de.fau.copymoveforgerydetection.modules.ingestModule.CopyMoveIngestModule.process(CopyMoveIngestModule.java:86)
It looks like the code is just wrong.
> private void submitResult(AbstractFile file, BufferedImage originalImage, BufferedImage resultImage) throws TskCoreException, IOException {
> byte[] resultImageBytes = this.convertImageToByteArray(resultImage, ImageFileParser.findImageType((AbstractFile)file));
> ArrayList<BlackboardAttribute> attributes = new ArrayList<BlackboardAttribute>();
> attributes.add(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_VALUE.getTypeID(), CopyMoveIngestModuleFactory.getModuleName(), resultImageBytes));
TSK_VALUE has type STRING so this will throw an error since it’s trying to store a byte array. It appears that this module was built on a fairly old version of Autopsy which may not have had the check on the attribute type.