Keyword search stuck (Autopsy 4.12)

Three of four threads stuck on keyword search.
Files with which is problem have size 0 and less.
What is problem with ?


I’ll see if I can replicate it. Do you have OCR enabled in Keyword Search?

Also, do you know how you ended up with negative file sizes? Do you know what file system these were on?

OCR disabled, ingest was running on dd image with NTFS file system.

Thanks. Was it a single user case or multi user?

It was single user case.

I re-ran ingest of this image, and i have the same issue.
Is any way to kill this stucked threads ?

Files that cause problem are packed into a .bin file.

There’s no way to kill the individual threads without stopping keyword search entirely. One thing you could try is to load your case database in something like SQLite browser and manually change the negative sizes to zero and then re-run ingest.

It seems like there must be a bug in the code that extracted the files. We at least need to add a check in there to stop negative sizes from being put in the database.