Im trying to use some automation on Autopsy.
I’ve created a new case and now its saying its analysing files.
I want to know how I can know that the project is loaded 100 %? Is there any file I can check that says that the project is finished loading? Example log file that I can read that says “100 %”?
I don’t know of any file that will tell you the case is 100% loaded. The status of each ingest job is recorded in the case data base in the ingest_jobs table and a value of 2 in the status_id column for a job will indicate it is complete.
However I want to mention that depending on what your reasons for for automation are that if they are just to create multiple cases each with their own ingested data sources, or to ingest multiple data sources into one case in a serial manner, that the Auto Ingest feature may provide what you are looking for. I realize there are other reasons you may want to automate so you may have already looked at that and determined it was not helpful, just thought I would mention it.
The ingest and analysis of the data source is complete when there are no more progress bars/messages displayed in the lower right hand corner of the application.
You can invoke the Data Sources Summary via the Case menu, open the Ingest History tab, and look at the Ingest Status column for the selected data source.
You can get more detailed status for an ingest in progress by selecting Help, Get Ingest Progress Snapshot. This may be at a greater level of detail than you need.
You can also navigate to the application log folder via the Help menu, open the autopsy.log.N files in a text editor, and look for a message of the form “INFO: Ingest job N completed” and assorted “analysis finished” log messages.
Thanks for the feedback.
I found that the best way was the “Case -> Data Sources Summary”.
I can program my automated machine to hit CTRL+C every 5 minute and check if the string contains “Completed”. If it contains completed then I can start doing automated tasks.