Recent Documents module stuck at 18% for days

Autopsy Help
1

Hello fellow autopsy community !

I’m currently facing an issue with autopsy 4.22.1 / Sleuth Kit 4.14.0 with the Recent Documents ingest module. On two different cases I’m working on; Recent Documents ingest stalls at 18% for days and doesn’t proceed further. It always stall at the files registry analysis part.

image
image712×209 19.4 KB

I’ve tested the issue with both a Windows 10 64 bits & Linux versions on two different cases; both have the same issue at the same point, but on different files. When this happens, the process is taking 100% CPU while not doing anything. I’ve attached the process on linux for Java & perl; and it just stall:

xxxx@riaillebox:~/autopsy/autopsy-4.22.1/bin$ sudo strace -p 14973
strace: Process 14973 attached
futex(0x77feeefff990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 15025, NULL, FUTEX_BITSET_MATCH_ANY

Or:

xxxx@riaillebox:~/autopsy/autopsy-4.22.1/bin$ sudo strace -p 40200
strace: Process 40200 attached
wait4(-1,

Autopsy logfile just give the following:

2026-01-20 21:28:35.373 org.sleuthkit.autopsy.coreutils.ImageUtils$ReadImageTaskBase lambda$readImage$0
WARNING: ImageIO could not read /img_dm-0/Users/XXXXXXX/AppData/Roaming/Microsoft/Windows/Recent/Skeppsbron 3 _ Översikt.lnk. It may be unsupported or corrupt: javax.imageio.IIOException: Error reading PNG metadata

And then no further progress.

So it seems the analysis of a simple file is blocking the whole process. Do you know if the process is going to timeout at some point and go through the next file or will it stall forever ? Autopsy is stuck on that file since 13h already…

Is there any workaround/solution for this ?

Thank you !

2

I would take a guess and say that there is a registry file that is hanging running in RegRipper. If you take the registry hives and run them thru RegRipper do any of them take a long time to run or never finish?

3

Same problem here in most cases.

I have to run recent module on autposy 4.21 and then continue with 4.22.1.