Hello everyone,
When starting my first case in Autopsy, I wasn’t able to add any data source. When clicking on the “Add Data Source”-Button, I only get the buffer circle without any further reaction.
Since the task manager doesn’t show any resource as overloaded while the buffer circle is shown, I assume that that’s not where it fails.
Instead, I assume that the issue is caused by the error displayed in the screenshot:
I tried uninstalling and reinstalling Autopsy, but it didn’t help.
Details that might matter: I’m using Win10 and tried it with the last 4.17.x-version of Autopsy before reinstalling the 4.18.0-version and trying again. The program itself is in the program directory and the case files are put into a subfolder in the user directory.
Could you help me here?
If you need any further info, please let me know.
Thanks in advance
If you could check the log for the complete error that would help. Go to your case folder, then “log”, and then look at the autopsy.log.n files to try to find the stack trace associated with the error. See Autopsy User Documentation: Troubleshooting
1 Like
So I did a basic run (opening program, opening case, closing program) and looked at the log but I didn’t find any error there, only info-texts (see below).
The only thing I noticed as problematic is that I don’t have solr installed so far, but since no one else from a group I worked with on the weekend did it either without it hindering their performance, I don’t think that it’s obligatory, is it?
2021-06-28 18:35:28.744 org.sleuthkit.autopsy.centralrepository.datamodel.RdbmsCentralRepo upgradeSchema
INFO: Central Repository is up to date
2021-06-28 18:35:28.933 org.sleuthkit.autopsy.keywordsearch.Server startLocalSolr
INFO: Starting local Solr SOLR4 server
2021-06-28 18:35:28.951 org.sleuthkit.autopsy.keywordsearch.Server isLocalSolrRunning
INFO: Solr server is running
2021-06-28 18:35:28.951 org.sleuthkit.autopsy.keywordsearch.Server stopLocalSolr
INFO: Stopping Solr 8 server
2021-06-28 18:35:28.952 org.sleuthkit.autopsy.keywordsearch.Server runLocalSolr8ControlCommand
INFO: Setting Solr 8 directory: C:\Program Files\Autopsy-4.18.0\autopsy\solr
2021-06-28 18:35:29.003 org.sleuthkit.autopsy.keywordsearch.Server runLocalSolr8ControlCommand
INFO: Running Solr 8 command: [C:\Program Files\Autopsy-4.18.0\autopsy\solr\bin\autopsy-solr.cmd, stop, -k, jjk#09s, -p, 23232] from C:\Program Files\Autopsy-4.18.0\autopsy\solr
2021-06-28 18:35:29.03 org.sleuthkit.autopsy.keywordsearch.Server runLocalSolr8ControlCommand
INFO: Finished running Solr 8 command
2021-06-28 18:35:29.031 org.sleuthkit.autopsy.keywordsearch.Server stopLocalSolr
INFO: Waiting for Solr server to stop
2021-06-28 18:35:31.499 org.sleuthkit.autopsy.keywordsearch.Server stopLocalSolr
INFO: Finished stopping Solr server
2021-06-28 18:35:31.5 org.sleuthkit.autopsy.keywordsearch.Server startLocalSolr
INFO: Port [23.232] available, starting Solr
2021-06-28 18:35:31.5 org.sleuthkit.autopsy.keywordsearch.Server startLocalSolr
INFO: Starting Solr 4 server
2021-06-28 18:35:31.501 org.sleuthkit.autopsy.keywordsearch.Server runLocalSolr4ControlCommand
INFO: Running Solr 4 command: [C:\Program Files\Autopsy-4.18.0\jre\bin\java, -Xmx2048m, -DSTOP.PORT=34343, -Djetty.port=23232, -DSTOP.KEY=jjk#09s, -jar, start.jar, -Dbootstrap_confdir=../solr/configsets/AutopsyConfig/conf, -Dcollection.configName=AutopsyConfig]
2021-06-28 18:35:31.518 org.sleuthkit.autopsy.keywordsearch.Server runLocalSolr4ControlCommand
INFO: Finished running Solr 4 command
2021-06-28 18:35:51.693 org.sleuthkit.autopsy.keywordsearch.Server isLocalSolrRunning
INFO: Solr server is running
2021-06-28 18:35:52.486 org.sleuthkit.autopsy.keywordsearch.Server startLocalSolr
INFO: New Solr process PID: [16148]
2021-06-28 18:35:52.49 org.sleuthkit.autopsy.keywordsearch.Server isLocalSolrRunning
INFO: Solr server is running
2021-06-28 18:35:54.205 org.sleuthkit.autopsy.keywordsearch.Server$Collection <init>
INFO: Using Solr document queue size = 30
2021-06-28 18:35:54.698 org.sleuthkit.autopsy.imagegallery.datamodel.DrawableDB setPragmas
INFO: sqlite-jdbc version 3.25.2 loaded in native mode
2021-06-28 18:35:54.895 org.sleuthkit.autopsy.casemodule.Case openAsCurrentCase
INFO: Opened malware_pw (malware_pw_20210626_135348) in C:\Users\nikos\ApkProjects\malware_pw as the current case
2021-06-28 18:35:54.905 org.sleuthkit.autopsy.progress.LoggingProgressIndicator progress
INFO: Retrieving images for case: autopsy.db...
2021-06-28 19:03:11.754 org.sleuthkit.autopsy.keywordsearch.Server stopLocalSolr
INFO: Stopping Solr 4 server
2021-06-28 19:03:11.756 org.sleuthkit.autopsy.keywordsearch.Server runLocalSolr4ControlCommand
INFO: Running Solr 4 command: [C:\Program Files\Autopsy-4.18.0\jre\bin\java, -Xmx2048m, -DSTOP.PORT=34343, -Djetty.port=23232, -DSTOP.KEY=jjk#09s, -jar, start.jar, --stop]
2021-06-28 19:03:12.012 org.sleuthkit.autopsy.keywordsearch.Server runLocalSolr4ControlCommand
INFO: Finished running Solr 4 command
2021-06-28 19:03:12.013 org.sleuthkit.autopsy.keywordsearch.Server stopLocalSolr
INFO: Waiting for Solr server to stop
2021-06-28 19:03:15.208 org.sleuthkit.autopsy.keywordsearch.Server stopLocalSolr
INFO: Finished stopping Solr server
2021-06-28 19:03:15.209 org.sleuthkit.autopsy.core.Installer <init>
INFO: core installer created
2021-06-28 19:03:15.304 org.sleuthkit.autopsy.casemodule.Case closeCurrentCase
INFO: Closing current case malware_pw (malware_pw_20210626_135348) in C:\Users\nikos\ApkProjects\malware_pw
2021-06-28 19:03:17.395 org.sleuthkit.autopsy.imagegallery.ImageGalleryController shutDown
INFO: Shutting down image gallery controller for case malware_pw (malware_pw_20210626_135348)
2021-06-28 19:03:17.407 org.sleuthkit.autopsy.imagegallery.datamodel.DrawableDB close
INFO: Closing the drawable.db
2021-06-28 19:03:17.409 org.sleuthkit.autopsy.imagegallery.ImageGalleryController shutDown
INFO: Completed shut down of image gallery controller for case malware_pw (malware_pw_20210626_135348)
You don’t need to install solr - there’s a version that comes with Autopsy.
Did you see the error message when you generated that log file?
1 Like
The error message exists independently of whether I open a case or not. And before opening/starting a case, Autopsy doesn’t create a log, does it?
But now I noticed that the error message disappears once I click on it and when I open a case afterwards and try to add a data source, another error message appears, so I guess this is the persistent and more specifically relevant one:
java.lang.ClassCastException: org.sleuthkit.autopsy.modules.interestingitems.FilesSet$Rule$CaseInsensitiveStringComparisionMatcher cannot be cast to java.io.ObjectStreamClass
at java.io.ObjectInputStream.readClassDesc(ObjectInputStream.java:1744)
at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:2041)
at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1572)
at java.io.ObjectInputStream.readObject(ObjectInputStream.java:430)
at java.util.ArrayList.readObject(ArrayList.java:797)
at sun.reflect.GeneratedMethodAccessor4.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at java.io.ObjectStreamClass.invokeReadObject(ObjectStreamClass.java:1170)
at java.io.ObjectInputStream.readSerialData(ObjectInputStream.java:2177)
at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:2068)
at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1572)
at java.io.ObjectInputStream.defaultReadFields(ObjectInputStream.java:2286)
at java.io.ObjectInputStream.readSerialData(ObjectInputStream.java:2210)
at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:2068)
at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1572)
at java.io.ObjectInputStream.readObject(ObjectInputStream.java:430)
at java.util.HashMap.readObject(HashMap.java:1412)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at java.io.ObjectStreamClass.invokeReadObject(ObjectStreamClass.java:1170)
at java.io.ObjectInputStream.readSerialData(ObjectInputStream.java:2177)
at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:2068)
at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1572)
at java.io.ObjectInputStream.defaultReadFields(ObjectInputStream.java:2286)
at java.io.ObjectInputStream.readSerialData(ObjectInputStream.java:2210)
at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:2068)
at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1572)
at java.io.ObjectInputStream.readObject(ObjectInputStream.java:430)
at java.util.HashMap.readObject(HashMap.java:1412)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at java.io.ObjectStreamClass.invokeReadObject(ObjectStreamClass.java:1170)
at java.io.ObjectInputStream.readSerialData(ObjectInputStream.java:2177)
at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:2068)
at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1572)
at java.io.ObjectInputStream.defaultReadFields(ObjectInputStream.java:2286)
at java.io.ObjectInputStream.readSerialData(ObjectInputStream.java:2210)
at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:2068)
at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1572)
at java.io.ObjectInputStream.readObject(ObjectInputStream.java:430)
at org.sleuthkit.autopsy.modules.interestingitems.InterestingItemsFilesSetSettings.readSerializedDefinitions(InterestingItemsFilesSetSettings.java:137)
at org.sleuthkit.autopsy.modules.interestingitems.InterestingItemsFilesSetSettings.readDefinitionsFile(InterestingItemsFilesSetSettings.java:505)
at org.sleuthkit.autopsy.modules.interestingitems.FilesSetsManager.getInterestingFilesSets(FilesSetsManager.java:152)
at org.sleuthkit.autopsy.modules.interestingitems.InterestingItemsIngestModuleFactory.getDefaultIngestJobSettings(InterestingItemsIngestModuleFactory.java:86)
at org.sleuthkit.autopsy.ingest.IngestJobSettings.loadModuleSettings(IngestJobSettings.java:538)
at org.sleuthkit.autopsy.ingest.IngestJobSettings.load(IngestJobSettings.java:392)
at org.sleuthkit.autopsy.ingest.IngestJobSettings.<init>(IngestJobSettings.java:119)
at org.sleuthkit.autopsy.ingest.IngestJobSettings.<init>(IngestJobSettings.java:94)
at org.sleuthkit.autopsy.casemodule.AddImageWizardIngestConfigPanel.<init>(AddImageWizardIngestConfigPanel.java:58)
at org.sleuthkit.autopsy.casemodule.AddImageWizardIterator.getPanels(AddImageWizardIterator.java:63)
at org.sleuthkit.autopsy.casemodule.AddImageWizardIterator.current(AddImageWizardIterator.java:134)
at org.sleuthkit.autopsy.casemodule.AddImageWizardIterator.current(AddImageWizardIterator.java:37)
at org.openide.WizardDescriptor.updateStateOpen(WizardDescriptor.java:820)
at org.openide.WizardDescriptor.updateState(WizardDescriptor.java:797)
at org.openide.WizardDescriptor._updateState(WizardDescriptor.java:775)
at org.openide.WizardDescriptor.initialize(WizardDescriptor.java:450)
at org.openide.NotifyDescriptor.getterCalled(NotifyDescriptor.java:279)
at org.openide.DialogDescriptor.isModal(DialogDescriptor.java:297)
at org.netbeans.core.windows.services.NbDialog.<init>(NbDialog.java:42)
at org.netbeans.core.windows.services.DialogDisplayerImpl$1.run(DialogDisplayerImpl.java:133)
at org.netbeans.core.windows.services.DialogDisplayerImpl$1.run(DialogDisplayerImpl.java:94)
at org.netbeans.modules.openide.util.NbMutexEventProvider$Event.doEventAccess(NbMutexEventProvider.java:115)
at org.netbeans.modules.openide.util.NbMutexEventProvider$Event.readAccess(NbMutexEventProvider.java:75)
at org.netbeans.modules.openide.util.LazyMutexImplementation.readAccess(LazyMutexImplementation.java:71)
at org.openide.util.Mutex.readAccess(Mutex.java:193)
at org.netbeans.core.windows.services.DialogDisplayerImpl.createDialog(DialogDisplayerImpl.java:94)
at org.netbeans.core.windows.services.DialogDisplayerImpl.createDialog(DialogDisplayerImpl.java:86)
at org.sleuthkit.autopsy.casemodule.AddImageAction.actionPerformed(AddImageAction.java:135)
at org.sleuthkit.autopsy.casemodule.AddImageAction$1.actionPerformed(AddImageAction.java:106)
at javax.swing.AbstractButton.fireActionPerformed(AbstractButton.java:2022)
at javax.swing.AbstractButton$Handler.actionPerformed(AbstractButton.java:2348)
at javax.swing.DefaultButtonModel.fireActionPerformed(DefaultButtonModel.java:402)
at javax.swing.DefaultButtonModel.setPressed(DefaultButtonModel.java:259)
at javax.swing.plaf.basic.BasicButtonListener.mouseReleased(BasicButtonListener.java:252)
at java.awt.AWTEventMulticaster.mouseReleased(AWTEventMulticaster.java:289)
at java.awt.Component.processMouseEvent(Component.java:6539)
at javax.swing.JComponent.processMouseEvent(JComponent.java:3324)
at java.awt.Component.processEvent(Component.java:6304)
at java.awt.Container.processEvent(Container.java:2239)
at java.awt.Component.dispatchEventImpl(Component.java:4889)
at java.awt.Container.dispatchEventImpl(Container.java:2297)
at java.awt.Component.dispatchEvent(Component.java:4711)
at java.awt.LightweightDispatcher.retargetMouseEvent(Container.java:4904)
at java.awt.LightweightDispatcher.processMouseEvent(Container.java:4535)
at java.awt.LightweightDispatcher.dispatchEvent(Container.java:4476)
at java.awt.Container.dispatchEventImpl(Container.java:2283)
at java.awt.Window.dispatchEventImpl(Window.java:2746)
at java.awt.Component.dispatchEvent(Component.java:4711)
at java.awt.EventQueue.dispatchEventImpl(EventQueue.java:760)
at java.awt.EventQueue.access$500(EventQueue.java:97)
at java.awt.EventQueue$3.run(EventQueue.java:709)
at java.awt.EventQueue$3.run(EventQueue.java:703)
at java.security.AccessController.doPrivileged(Native Method)
at java.security.ProtectionDomain$JavaSecurityAccessImpl.doIntersectionPrivilege(ProtectionDomain.java:74)
at java.security.ProtectionDomain$JavaSecurityAccessImpl.doIntersectionPrivilege(ProtectionDomain.java:84)
at java.awt.EventQueue$4.run(EventQueue.java:733)
at java.awt.EventQueue$4.run(EventQueue.java:731)
at java.security.AccessController.doPrivileged(Native Method)
at java.security.ProtectionDomain$JavaSecurityAccessImpl.doIntersectionPrivilege(ProtectionDomain.java:74)
at java.awt.EventQueue.dispatchEvent(EventQueue.java:730)
at org.netbeans.core.TimableEventQueue.dispatchEvent(TimableEventQueue.java:136)
[catch] at java.awt.EventDispatchThread.pumpOneEventForFilters(EventDispatchThread.java:205)
at java.awt.EventDispatchThread.pumpEventsForFilter(EventDispatchThread.java:116)
at java.awt.EventDispatchThread.pumpEventsForHierarchy(EventDispatchThread.java:105)
at java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:101)
at java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:93)
at java.awt.EventDispatchThread.run(EventDispatchThread.java:82)