Going through the online training for Autopsy (4.140) and have run into a bit of a snag. The keyword search ingest module is “running home to mama” whenever I attempt to run it in conjunction with the lab exercise.
The keyword list has been created and whenever I run the ingest module, it throws the following error(s):
Here are the contents of the log file that was generated:
2020-02-02 07:39:24.438 org.sleuthkit.autopsy.keywordsearch.Server isRunning
INFO: Solr server is running
2020-02-02 07:39:24.443 org.sleuthkit.autopsy.casemodule.Case openAppServiceCaseResources
SEVERE: Solr Keyword Search Service failed to open case resources for case1
java.util.concurrent.ExecutionException: org.sleuthkit.autopsy.appservices.AutopsyService$AutopsyServiceException: Failed to open or create core for C:\Users\RTGho\Desktop\Shortcuts\Autopsy_Lab\case1
java.util.concurrent.FutureTask.report(FutureTask.java:122)
java.util.concurrent.FutureTask.get(FutureTask.java:192)
org.sleuthkit.autopsy.casemodule.Case.openAppServiceCaseResources(Case.java:2403)
org.sleuthkit.autopsy.casemodule.Case.open(Case.java:1979)
org.sleuthkit.autopsy.casemodule.Case.lambda$doOpenCaseAction$6(Case.java:1847)
java.util.concurrent.FutureTask.run(FutureTask.java:266)
java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
java.lang.Thread.run(Thread.java:748)
org.sleuthkit.autopsy.appservices.AutopsyService$AutopsyServiceException: Failed to open or create core for C:\Users\RTGho\Desktop\Shortcuts\Autopsy_Lab\case1
java.util.concurrent.FutureTask.report(FutureTask.java:122)
java.util.concurrent.FutureTask.get(FutureTask.java:192)
org.sleuthkit.autopsy.casemodule.Case.openAppServiceCaseResources(Case.java:2403)
org.sleuthkit.autopsy.casemodule.Case.open(Case.java:1979)
org.sleuthkit.autopsy.casemodule.Case.lambda$doOpenCaseAction$6(Case.java:1847)
java.util.concurrent.FutureTask.run(FutureTask.java:266)
java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
java.lang.Thread.run(Thread.java:748)
org.sleuthkit.autopsy.keywordsearch.KeywordSearchModuleException: Could not create or open index
java.util.concurrent.FutureTask.report(FutureTask.java:122)
java.util.concurrent.FutureTask.get(FutureTask.java:192)
org.sleuthkit.autopsy.casemodule.Case.openAppServiceCaseResources(Case.java:2403)
org.sleuthkit.autopsy.casemodule.Case.open(Case.java:1979)
org.sleuthkit.autopsy.casemodule.Case.lambda$doOpenCaseAction$6(Case.java:1847)
java.util.concurrent.FutureTask.run(FutureTask.java:266)
java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
java.lang.Thread.run(Thread.java:748)
org.sleuthkit.autopsy.keywordsearch.KeywordSearchModuleException: Index directory could not be created or is missing
java.util.concurrent.FutureTask.report(FutureTask.java:122)
java.util.concurrent.FutureTask.get(FutureTask.java:192)
org.sleuthkit.autopsy.casemodule.Case.openAppServiceCaseResources(Case.java:2403)
org.sleuthkit.autopsy.casemodule.Case.open(Case.java:1979)
org.sleuthkit.autopsy.casemodule.Case.lambda$doOpenCaseAction$6(Case.java:1847)
java.util.concurrent.FutureTask.run(FutureTask.java:266)
java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
java.lang.Thread.run(Thread.java:748)
2020-02-02 07:39:24.449 org.sleuthkit.autopsy.imagegallery.datamodel.DrawableDB setPragmas
INFO: sqlite-jdbc version 3.25.2 loaded in native mode
2020-02-02 07:39:24.464 org.sleuthkit.autopsy.casemodule.Case openAsCurrentCase
INFO: Opened case1 (case1_20200131_090630) in C:\Users\RTGho\Desktop\Shortcuts\Autopsy_Lab\case1 as the current case
2020-02-02 07:39:24.473 org.sleuthkit.autopsy.ingest.IngestMonitor$MonitorTimerAction logMonitoredRootDirectory
INFO: Monitoring disk space of C:
2020-02-02 07:42:40.096 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = Correlation Engine, version = 4.14.0
2020-02-02 07:42:40.096 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = Data Source Integrity, version = 4.14.0
2020-02-02 07:42:40.096 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = Embedded File Extractor, version = 4.14.0
2020-02-02 07:42:40.096 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = Encryption Detection, version = 4.14.0
2020-02-02 07:42:40.096 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = Exif Parser, version = 4.14.0
2020-02-02 07:42:40.096 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = Extension Mismatch Detector, version = 4.14.0
2020-02-02 07:42:40.096 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = File Type Identification, version = 4.14.0
2020-02-02 07:42:40.096 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = Hash Lookup, version = 4.14.0
2020-02-02 07:42:40.096 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = Interesting Files Identifier, version = 4.14.0
2020-02-02 07:42:40.096 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = PhotoRec Carver, version = 7.0
2020-02-02 07:42:40.096 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = Plaso, version = 4.14.0
2020-02-02 07:42:40.096 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = Virtual Machine Extractor, version = 4.14.0
2020-02-02 07:42:40.097 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = Keyword Search, version = 4.14.0
2020-02-02 07:42:40.097 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = Email Parser, version = 4.14.0
2020-02-02 07:42:40.097 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = Recent Activity, version = 4.14.0
2020-02-02 07:42:40.355 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader getIngestModuleFactories
INFO: Found ingest module factory: name = Android Analyzer, version = 4.14.0
2020-02-02 07:42:40.456 org.sleuthkit.autopsy.keywordsearch.KeywordSearchGlobalSearchSettingsPanel customizeComponents
WARNING: Could not get number of indexed files/chunks
2020-02-02 07:42:44.984 org.sleuthkit.autopsy.ingest.IngestManager startIngestJob
INFO: Starting ingest job 1
2020-02-02 07:42:44.985 org.sleuthkit.autopsy.keywordsearch.KeywordSearchIngestModule shutDown
INFO: Keyword search ingest module instance 2 shutting down
2020-02-02 07:42:44.985 org.sleuthkit.autopsy.ingest.IngestManager startIngestJob
SEVERE: Error starting Keyword Search ingest module for job 1
org.sleuthkit.autopsy.ingest.IngestModule$IngestModuleException: The index could not be opened or does not exist.
org.sleuthkit.autopsy.keywordsearch.KeywordSearchIngestModule.startUp(KeywordSearchIngestModule.java:215)
org.sleuthkit.autopsy.ingest.FileIngestPipeline$PipelineModule.startUp(FileIngestPipeline.java:225)
org.sleuthkit.autopsy.ingest.FileIngestPipeline.startUp(FileIngestPipeline.java:106)
org.sleuthkit.autopsy.ingest.DataSourceIngestJob.startUpIngestPipelines(DataSourceIngestJob.java:460)
org.sleuthkit.autopsy.ingest.DataSourceIngestJob.start(DataSourceIngestJob.java:420)
org.sleuthkit.autopsy.ingest.IngestJob.start(IngestJob.java:158)
org.sleuthkit.autopsy.ingest.IngestManager.startIngestJob(IngestManager.java:407)
org.sleuthkit.autopsy.ingest.IngestManager.access$600(IngestManager.java:111)
org.sleuthkit.autopsy.ingest.IngestManager$StartIngestJobTask.call(IngestManager.java:895)
org.sleuthkit.autopsy.ingest.IngestManager$StartIngestJobTask.call(IngestManager.java:858)
java.util.concurrent.FutureTask.run(FutureTask.java:266)
java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
java.lang.Thread.run(Thread.java:748)
2020-02-02 07:42:44.985 org.sleuthkit.autopsy.ingest.IngestManager startIngestJob
SEVERE: Ingest job 1 could not be started
2020-02-02 07:45:21.081 org.sleuthkit.autopsy.keywordsearch.KeywordSearchGlobalSearchSettingsPanel customizeComponents
WARNING: Could not get number of indexed files/chunks
2020-02-02 07:45:52.636 org.sleuthkit.autopsy.texttranslation.translators.GoogleTranslator loadTranslator
INFO: No credentials file has been provided for Google Translator
2020-02-02 07:45:52.637 org.sleuthkit.autopsy.texttranslation.translators.GoogleTranslator loadTranslator
WARNING: Credentials were not successfully made, no translations will be available from the GoogleTranslator
Any suggestions and/or thoughts are greatly appreciated. I also posted a Discussion board comment in the training for that module and will update it with the solution if we can determine what the issue is.
Well, I think I see the issue :
org.sleuthkit.autopsy.keywordsearch.KeywordSearchModuleException: Could not create or open index
java.util.concurrent.FutureTask.report(FutureTask.java:122)
Just not sure how to rectify it.
Thanks!