How to run a downloaded Data Source Ingest Module in Autopsy?

Autopsy Help
1

I am novice so apologies for all ignorance (I attempted to post this earlier but lacked points I think so apologies also if this ends up duplicated). I am having difficulty in running downloaded Data Source Ingest Modules. I have been working through the development tutorials. I can develop and run File Ingest Modules in Autopsy with relative ease. However, after I install a .nbm with a Data Source Ingest, the module does not show in Autopsy. I receive no errors through installation. The log files do not seem to indicate anything. The module shows as installed through ‘Plugins’. In particular, I am attempting to run the iTunes_Backup module created by Mark McKinnon on a iPhone 6S backup file I added as a logical image to Autopsy. Am I misunderstanding the method by which the data source reference is passed to a DSI module? How is this done in the Autopsy GUI? I had assumed the module would show under ‘Run Ingest Modules’ like the File Ingest Modules I have downloaded. My attempts with the Data Source Ingest module development tutorial (#2) come with a similar result. A side issue which may be related concerns the Python Plugins. I have to package the .py files in NetBeans and download them from the .nbm file in order for them to show in Autopsy.

2

The python plugins need to be stored in a directory in the python_modules directory in your Autopsy configuration directory which should be located in c:\Users<Username>\AppData\Roaming\autopsy\python_modules. For example take the iTunes_Backup module and create a directory call iTunes_Backup in the python_modules directory and then save the files associated with the plugin into that directory. You should then see that plugin when you start your next ingest run.

3

Thank you, Mark. I had done what you suggested following the documentation, but they were not showing for whatever reason. Now all of the Python Modules are showing and, of course, did so soon after I submitted this topic! :man_facepalming: I also had a brief issue with the Python Modules only showing when I added a new Data Source, and did not show under ‘Run Ingest Modules’ after the datasource had been added to the case. This resolved suddenly as well :joy: