# Missing artifacts version 4.16

**URL:** <https://sleuthkit.discourse.group/t/missing-artifacts-version-4-16/2147>\
**Category:** Autopsy Help\
**Created:** [September 13, 2020, 8:30pm UTC](https://sleuthkit.discourse.group/t/missing-artifacts-version-4-16/2147 "2020-09-13T20:30:51Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![grzesiug](https://avatars.discourse-cdn.com/v4/letter/g/839c29/32.png) [@grzesiug](https://sleuthkit.discourse.group/u/grzesiug)\
**Post date:** [September 13, 2020, 8:30pm UTC](https://sleuthkit.discourse.group/t/missing-artifacts-version-4-16/2147/1 "2020-09-13T20:30:51Z")

</div>

I use Autopsy on Windows 10 Pro with US regional format because if i use polish format on version 4.15, there was no Installed Programs output from Recent Activity Module.  
Today I tested version 4.16 with the same system settings and data source and there are missing artifacts:  
Install Programs,  
Operating System Information  
Operating System User Account  
USB Device Attached  
Shell Bags  
Where is the problem ?  
 ![recentActivity_4.15.0](https://global.discourse-cdn.com/free1/uploads/sleuthkit/original/2X/3/39a32d2e458b92f96dd8af3eae325d7b7e40a2e3.png)  
 ![recentActivity_4.16.0](https://global.discourse-cdn.com/free1/uploads/sleuthkit/original/2X/3/36dabec4afe66080d1cd1772ea93d3302b254c2d.png)

Here are logs  
[https://1drv.ms/u/s!AmzkhsnuliYVzCDZqCx3kJg8\_4WJ?e=jxFiXg](https://1drv.ms/u/s!AmzkhsnuliYVzCDZqCx3kJg8_4WJ?e=jxFiXg)

---

<div class="post-metadata">

**Author:** ![Mark\_McKinnon](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/mark_mckinnon/32/42_2.png) [@Mark\_McKinnon](https://sleuthkit.discourse.group/u/Mark_McKinnon)\
**Post date:** [September 13, 2020, 9:31pm UTC](https://sleuthkit.discourse.group/t/missing-artifacts-version-4-16/2147/2 "2020-09-13T21:31:33Z")

</div>

Looking at your log file for 4.16.0 it appears that there is an issue reading the SAM regripper plugin output. The file that is having the issues being parsed should be H:\recent\_activity\_4.16.0\ModuleOutput\RecentActivity\reg\SAM-regripper-126673-full.txt Is this a file that you can share? It is causing an error that is making the rest of the Recent Activity Ingest Module to be cancelled so no other artifacts can be created.

---

<div class="post-metadata">

**Author:** ![grzesiug](https://avatars.discourse-cdn.com/v4/letter/g/839c29/32.png) [@grzesiug](https://sleuthkit.discourse.group/u/grzesiug)\
**Post date:** [September 14, 2020, 5:16am UTC](https://sleuthkit.discourse.group/t/missing-artifacts-version-4-16/2147/3 "2020-09-14T05:16:56Z")

</div>

Indeed, there are missing RegRipper’s output files, I placed RecentActivity output folder under the link from first post.  
But why this happens?

---

<div class="post-metadata">

**Author:** ![Mark\_McKinnon](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/mark_mckinnon/32/42_2.png) [@Mark\_McKinnon](https://sleuthkit.discourse.group/u/Mark_McKinnon)\
**Post date:** [September 15, 2020, 1:40am UTC](https://sleuthkit.discourse.group/t/missing-artifacts-version-4-16/2147/4 "2020-09-15T01:40:59Z")

</div>

The code is the same in 4.15.0 as 4.16.0 where this happens so not sure why it is an issue now. There is a fix for it and should be in the next release of Autopsy. The PR for this fix is [https://github.com/sleuthkit/autopsy/pull/6262](https://github.com/sleuthkit/autopsy/pull/6262).