Issue with Email Parser

Autopsy Help
1

Hello,

I just started using Autopsy for my forensic work. I have had no problems with hard drives and home catalogs etc, but I have had some issues with the email parser and reading PST files. When using the Email Parser together with Keyword Search I get the error “java lang stack overflow”. I do not get the email view as shown in the Autopsy User Documentation. Any suggestions on what has caused this?

Regards

2

If you only run Email Parser and don’t run Keyword Search, do the emails display correctly?

Can you include more of your logs? Go to Help->Open log folder and look for severe errors and/or stack traces.

3

I tried with the Email Parser only as well to no success. I’ll check the logs tomorrow and see if it gives any hints there. Similar thing happened just before Christmas when I tried it. Any idea what could cause it? Should I set up the settings in anyway prior to loading the pst file or similar?

Thanks

4

No there are no settings for the email parser. Is there anything in the tree under Results->E-Mail Messages?

5

No, nothing there.

The log says "logErrorMessage
SEVERE: Email Parser experienced an error during analysis (data source = LogicalFileSet1, objId = 1, jobId = 0)
java.lang.StackOverflowError
java.util.Collection.stream(Collection.java:581)
org.sleuthkit.autopsy.thunderbirdparser.EmailMessageThreader$EmailContainer.isChild(EmailMessageThreader.java:695)
org.sleuthkit.autopsy.thunderbirdparser.EmailMessageThreader$EmailContainer.lambda$isChild$0(EmailMessageThreader.java:695)
java.util.stream.MatchOps$1MatchSink.accept(MatchOps.java:90)
java.util.HashMap$KeySpliterator.tryAdvance(HashMap.java:1574)
java.util.stream.ReferencePipeline.forEachWithCancel(ReferencePipeline.java:126
"

6

Ah that bug. It’s fixed in 4.14, which should be out soon.

7

So basically no possibility to fix it until then? Any ETA when 4.14 is out?

8

It should be pretty soon - we’re done with code changes for it. The other option would be to go back to I believe Autopsy 4.11, before we added message threading. You’ll be able to upgrade your case to 4.14 when it comes out (but not to 4.13 due to another annoying bug).

1 Like