New artifacts not displayed

Autopsy Development
21

Here are the relevant logs, concatenated accordingly:

~/.autopsy/dev/var/log$ cat autopsy.log.2 autopsy.log.1 autopsy.log.0
2021-10-05 17:19:00.184 org.sleuthkit.autopsy.core.Installer <init>
INFO: core installer created
2021-10-05 17:19:00.683 org.sleuthkit.autopsy.core.Installer validate
INFO: validate()
2021-10-05 17:19:00.683 org.sleuthkit.autopsy.core.Installer validate
INFO: org.sleuthkit.autopsy.coreutils.Installer validate()
2021-10-05 17:19:00.683 org.sleuthkit.autopsy.core.Installer validate
INFO: org.sleuthkit.autopsy.corecomponents.Installer validate()
2021-10-05 17:19:00.683 org.sleuthkit.autopsy.core.Installer validate
INFO: org.sleuthkit.autopsy.datamodel.Installer validate()
2021-10-05 17:19:00.706 org.sleuthkit.autopsy.core.Installer validate
INFO: org.sleuthkit.autopsy.ingest.Installer validate()
2021-10-05 17:19:00.706 org.sleuthkit.autopsy.core.Installer validate
INFO: org.sleuthkit.autopsy.centralrepository.eventlisteners.Installer validate()
2021-10-05 17:19:00.706 org.sleuthkit.autopsy.core.Installer validate
INFO: org.sleuthkit.autopsy.healthmonitor.Installer validate()
2021-10-05 17:19:00.706 org.sleuthkit.autopsy.core.Installer validate
INFO: org.sleuthkit.autopsy.casemodule.Installer validate()
2021-10-05 17:19:00.833 org.sleuthkit.autopsy.timeline.TimeLineModule onStart
INFO: Setting up TimeLine listeners
2021-10-05 17:19:00.977 org.sleuthkit.autopsy.core.Installer initializeSevenZip
INFO: 7zip-java bindings loaded
2021-10-05 17:19:00.977 org.sleuthkit.autopsy.coreutils.Installer restored
INFO: Default charset: UTF-8
2021-10-05 17:19:00.978 org.sleuthkit.autopsy.coreutils.Installer restored
INFO: Default file encoding: UTF-8
2021-10-05 17:19:00.978 org.sleuthkit.autopsy.coreutils.Installer restored
INFO: Java runtime version: 1.8.0_302-b08
2021-10-05 17:19:00.978 org.sleuthkit.autopsy.coreutils.Installer restored
INFO: Netbeans Platform build: 11.3-6b879cb782eaa4f13a731aff82eada11289a66f7
2021-10-05 17:19:00.978 org.sleuthkit.autopsy.coreutils.Installer restored
INFO: Application name: Autopsy, version: 4.19.2, build: RELEASE
2021-10-05 17:19:00.978 org.sleuthkit.autopsy.coreutils.Installer restored
INFO: os.name: Linux
2021-10-05 17:19:00.978 org.sleuthkit.autopsy.coreutils.Installer restored
INFO: os.arch: amd64
2021-10-05 17:19:00.983 org.sleuthkit.autopsy.coreutils.Installer restored
INFO: PID: 142203
2021-10-05 17:19:00.984 org.sleuthkit.autopsy.coreutils.Installer restored
INFO: Process Virtual Memory Used: 10192039936
2021-10-05 17:19:00.984 org.sleuthkit.autopsy.core.Installer restored
INFO: org.sleuthkit.autopsy.coreutils.Installer restore succeeded
2021-10-05 17:19:00.985 org.sleuthkit.autopsy.core.Installer restored
INFO: org.sleuthkit.autopsy.corecomponents.Installer restore succeeded
2021-10-05 17:19:00.985 org.sleuthkit.autopsy.core.Installer restored
INFO: org.sleuthkit.autopsy.datamodel.Installer restore succeeded
2021-10-05 17:19:00.985 org.sleuthkit.autopsy.core.Installer restored
INFO: org.sleuthkit.autopsy.ingest.Installer restore succeeded
2021-10-05 17:19:00.985 org.sleuthkit.autopsy.core.Installer restored
INFO: org.sleuthkit.autopsy.centralrepository.eventlisteners.Installer restore succeeded
2021-10-05 17:19:00.998 org.sleuthkit.autopsy.core.Installer restored
INFO: org.sleuthkit.autopsy.healthmonitor.Installer restore succeeded
2021-10-05 17:19:00.999 org.sleuthkit.autopsy.core.Installer restored
INFO: org.sleuthkit.autopsy.casemodule.Installer restore succeeded
2021-10-05 17:19:00.999 org.sleuthkit.autopsy.core.Installer restored
INFO: Autopsy Core restore completed
2021-10-05 17:19:01.432 org.sleuthkit.autopsy.texttranslation.translators.GoogleTranslator loadTranslator
INFO: No credentials file has been provided for Google Translator
2021-10-05 17:19:01.432 org.sleuthkit.autopsy.texttranslation.translators.GoogleTranslator loadTranslator
WARNING: Credentials were not successfully made, no translations will be available from the GoogleTranslator
2021-10-05 17:19:01.828 org.sleuthkit.autopsy.casemodule.StartupWindowProvider init
INFO: Will use the default startup window: org.sleuthkit.autopsy.casemodule.StartupWindow[dialog0,0,25,483x314,invalid,hidden,layout=java.awt.BorderLayout,APPLICATION_MODAL,title=Welcome,defaultCloseOperation=HIDE_ON_CLOSE,rootPane=javax.swing.JRootPane[,5,25,473x284,layout=javax.swing.JRootPane$RootLayout,alignmentX=0.0,alignmentY=0.0,border=,flags=16777673,maximumSize=,minimumSize=,preferredSize=],rootPaneCheckingEnabled=true]
2021-10-05 17:19:35.451 org.sleuthkit.autopsy.casemodule.Case openAsCurrentCase
INFO: Opening test (test_20210907_160040) in <redacted>/autopsy_case/test as the current case
2021-10-05 17:33:26.356 org.sleuthkit.autopsy.casemodule.Case closeCurrentCase
INFO: Closed current case test (test_20210907_160040) in <redacted>/autopsy_case/test
2021-10-05 17:33:29.582 org.sleuthkit.autopsy.casemodule.Case openAsCurrentCase
INFO: Opening test (test_20210907_160040) in <redacted>/autopsy_case/test as the current case
2021-10-05 17:33:33.256 org.sleuthkit.autopsy.casemodule.Case closeCurrentCase
INFO: Closed current case test (test_20210907_160040) in <redacted>/autopsy_case/test

I disabled the Recent Activity, Keyword Search, and Email Parser modules. I only ran my module.

22

Can you try running this sample module? Sample DS Module - Pastebin.com
Split it into SampleDSIngestModule and SampleDSIngestModuleFactory and adjust the package however makes it easiest for you to run. Then just run ingest with any data source and the module enabled.

All it does is create an artifact every half second and post them individually. We do have code in place to limit how often the tree refreshes so you won’t see the artifact count go up with every artifact. The progress bar should increment every half second.

Thanks for working with us to try to figure out if there’s a bug in the tree refreshing.

23

Ok, I’ve built the Sample DS module with Autopsy 4.19.2, made a new case with the same data source used throughout this topic, deactivated all other modules and run it. The three common log files (Log/autopsy.log.0, messages.log, and a concatenation of relevant .autopsy/dev/var/log/autopsy.log.*) can be found here.

I notice the progress bar updating, as well as the artifact tree. Everything works as it should. Looking over the sample code, I realized that I have been using org.sleuthkit.autopsy.ingest.DataSourceIngestModuleProgress.progress (int workUnits) erroneously up to this point. I thought the parameter was incremental, not cumulative. My apologies for reporting the progress bar not updating as an issue when the fault was mine.

24

Hi @amadan,

I’m glad to hear that sample module worked well and help pinpoint some issues. Do you have any questions or issues still or are you all set?

25

As far as I am concerned I’m good. I solved my issue when I switched from a data source module to a file ingest module, 6 days ago. If I helped you and the rest of the Autopsy developers confirm that the artifact tree refreshing works as intended, that’s great.
I have tried creating a new case with the same data source, with the original data source ingest module (modified to properly update the progress bar) and Autopsy 4.19.2. I can see that the progress bar updates as expected, but the tree is not populated until after reopening the case. I think that the root cause is me misusing some other part of the API, considering that the sample module ran flawlessly. Sorry to have wasted your time investigating this issue. :frowning:

26

Thank you for your time and patience in tracking down the source of issue. We really appreciate it. If there are any other issues that come up, please let us know.