I use Autopsy on Windows 10 Pro with US regional format because if i use polish format on version 4.15, there was no Installed Programs output from Recent Activity Module.
Today I tested version 4.16 with the same system settings and data source and there are missing artifacts:
Install Programs,
Operating System Information
Operating System User Account
USB Device Attached
Shell Bags
Where is the problem ?
Here are logs
https://1drv.ms/u/s!AmzkhsnuliYVzCDZqCx3kJg8_4WJ?e=jxFiXg
Looking at your log file for 4.16.0 it appears that there is an issue reading the SAM regripper plugin output. The file that is having the issues being parsed should be H:\recent_activity_4.16.0\ModuleOutput\RecentActivity\reg\SAM-regripper-126673-full.txt Is this a file that you can share? It is causing an error that is making the rest of the Recent Activity Ingest Module to be cancelled so no other artifacts can be created.
Indeed, there are missing RegRipper’s output files, I placed RecentActivity output folder under the link from first post.
But why this happens?
The code is the same in 4.15.0 as 4.16.0 where this happens so not sure why it is an issue now. There is a fix for it and should be in the next release of Autopsy. The PR for this fix is https://github.com/sleuthkit/autopsy/pull/6262.