Volatility plugin exception in Autopsy 4.8.0 on Ubuntu

[mrh1]

Here is the traceback:

Traceback (most recent call last): File "/home/sansforensics/.autopsy/dev/python_modules/Volatility/Volatility_Dump.py", line 120, in getIngestJobSettingsPanel return VolatilitySettingsWithUISettingsPanel(self.settings) File "/home/sansforensics/.autopsy/dev/python_modules/Volatility/Volatility_Dump.py", line 613, in init self.initComponents() File "/home/sansforensics/.autopsy/dev/python_modules/Volatility/Volatility_Dump.py", line 938, in initComponents self.Plugin_LB = JList( self.Plugin_list, valueChanged=self.onchange_plugins_lb) TypeError: javax.swing.JList(): 1st arg can't be coerced to java.util.Vector, java.lang.Object[], javax.swing.ListModel

at org.python.core.Py.TypeError(Py.java:259)
at org.python.core.PyReflectedFunction.throwError(PyReflectedFunction.java:209)
at org.python.core.PyReflectedFunction.throwBadArgError(PyReflectedFunction.java:312)
at org.python.core.PyReflectedFunction.throwError(PyReflectedFunction.java:321)
at org.python.core.PyReflectedConstructor.__call__(PyReflectedConstructor.java:177)
at org.python.core.PyObject.__call__(PyObject.java:419)
at org.python.core.PyMethod.instancemethod___call__(PyMethod.java:237)
at org.python.core.PyMethod.__call__(PyMethod.java:228)
at org.python.core.PyMethod.__call__(PyMethod.java:223)
at org.python.core.Deriveds.dispatch__init__(Deriveds.java:19)
at org.python.core.PyObjectDerived.dispatch__init__(PyObjectDerived.java:1112)
at org.python.core.PyType.type___call__(PyType.java:1713)
at org.python.core.PyType.__call__(PyType.java:1696)
at org.python.core.PyObject.__call__(PyObject.java:394)
at Volatility_Dump$py.initComponents$48(/home/sansforensics/.autopsy/dev/python_modules/Volatility/Volatility_Dump.py:1058)
at Volatility_Dump$py.call_function(/home/sansforensics/.autopsy/dev/python_modules/Volatility/Volatility_Dump.py)
at org.python.core.PyTableCode.call(PyTableCode.java:167)
at org.python.core.PyBaseCode.call(PyBaseCode.java:138)
at org.python.core.PyFunction.__call__(PyFunction.java:413)
at org.python.core.PyMethod.__call__(PyMethod.java:126)
at Volatility_Dump$py.__init__$37(/home/sansforensics/.autopsy/dev/python_modules/Volatility/Volatility_Dump.py:614)
at Volatility_Dump$py.call_function(/home/sansforensics/.autopsy/dev/python_modules/Volatility/Volatility_Dump.py)
at org.python.core.PyTableCode.call(PyTableCode.java:167)
at org.python.core.PyBaseCode.call(PyBaseCode.java:307)
at org.python.core.PyBaseCode.call(PyBaseCode.java:198)
at org.python.core.PyFunction.__call__(PyFunction.java:482)
at org.python.core.PyMethod.instancemethod___call__(PyMethod.java:237)
at org.python.core.PyMethod.__call__(PyMethod.java:228)
at org.python.core.PyMethod.__call__(PyMethod.java:223)
at org.python.core.Deriveds.dispatch__init__(Deriveds.java:19)
at org.python.core.PyObjectDerived.dispatch__init__(PyObjectDerived.java:1112)
at org.python.core.PyType.type___call__(PyType.java:1713)
at org.python.core.PyType.__call__(PyType.java:1696)
at org.python.core.PyObject.__call__(PyObject.java:461)
at org.python.core.PyObject.__call__(PyObject.java:465)
at Volatility_Dump$py.getIngestJobSettingsPanel$8(/home/sansforensics/.autopsy/dev/python_modules/Volatility/Volatility_Dump.py:120)
at Volatility_Dump$py.call_function(/home/sansforensics/.autopsy/dev/python_modules/Volatility/Volatility_Dump.py)
at org.python.core.PyTableCode.call(PyTableCode.java:167)
at org.python.core.PyBaseCode.call(PyBaseCode.java:307)
at org.python.core.PyBaseCode.call(PyBaseCode.java:198)
at org.python.core.PyFunction.__call__(PyFunction.java:482)
at org.python.core.PyMethod.instancemethod___call__(PyMethod.java:237)
at org.python.core.PyMethod.__call__(PyMethod.java:228)
at org.python.core.PyMethod.__call__(PyMethod.java:218)
at org.python.core.PyMethod.__call__(PyMethod.java:213)
at org.python.core.PyObject._jcallexc(PyObject.java:3626)
at org.python.core.PyObject._jcall(PyObject.java:3658)
at org.python.proxies.Volatility_Dump$VolatilityDumpIngestModuleFactory$6.getIngestJobSettingsPanel(Unknown Source)
at org.sleuthkit.autopsy.ingest.IngestModuleTemplate.getModuleSettingsPanel(IngestModuleTemplate.java:61)
at org.sleuthkit.autopsy.ingest.IngestJobSettingsPanel$IngestModuleModel.<init>(IngestJobSettingsPanel.java:531)
at org.sleuthkit.autopsy.ingest.IngestJobSettingsPanel.<init>(IngestJobSettingsPanel.java:84)
at org.sleuthkit.autopsy.casemodule.AddImageWizardIngestConfigPanel.<init>(AddImageWizardIngestConfigPanel.java:62)
at org.sleuthkit.autopsy.casemodule.AddImageWizardIterator.getPanels(AddImageWizardIterator.java:62)
at org.sleuthkit.autopsy.casemodule.AddImageWizardIterator.current(AddImageWizardIterator.java:132)
at org.sleuthkit.autopsy.casemodule.AddImageWizardIterator.current(AddImageWizardIterator.java:37)
at org.openide.WizardDescriptor.updateStateOpen(WizardDescriptor.java:844)
at org.openide.WizardDescriptor.updateState(WizardDescriptor.java:822)
at org.openide.WizardDescriptor._updateState(WizardDescriptor.java:800)
at org.openide.WizardDescriptor.initialize(WizardDescriptor.java:475)
at org.openide.NotifyDescriptor.getterCalled(NotifyDescriptor.java:304)
at org.openide.DialogDescriptor.isModal(DialogDescriptor.java:322)
at org.netbeans.core.windows.services.NbDialog.<init>(NbDialog.java:67)
at org.netbeans.core.windows.services.DialogDisplayerImpl$1.run(DialogDisplayerImpl.java:158)
at org.netbeans.core.windows.services.DialogDisplayerImpl$1.run(DialogDisplayerImpl.java:119)
at org.netbeans.modules.openide.util.NbMutexEventProvider$Event.doEventAccess(NbMutexEventProvider.java:138)
at org.netbeans.modules.openide.util.NbMutexEventProvider$Event.readAccess(NbMutexEventProvider.java:98)
at org.netbeans.modules.openide.util.LazyMutexImplementation.readAccess(LazyMutexImplementation.java:94)
at org.openide.util.Mutex.readAccess(Mutex.java:218)
at org.netbeans.core.windows.services.DialogDisplayerImpl.createDialog(DialogDisplayerImpl.java:119)
at org.netbeans.core.windows.services.DialogDisplayerImpl.createDialog(DialogDisplayerImpl.java:111)
at org.sleuthkit.autopsy.casemodule.AddImageAction.actionPerformed(AddImageAction.java:135)
at org.sleuthkit.autopsy.casemodule.NewCaseWizardAction$1.done(NewCaseWizardAction.java:120)
at javax.swing.SwingWorker$5.run(SwingWorker.java:737)
at javax.swing.SwingWorker$DoSubmitAccumulativeRunnable.run(SwingWorker.java:832)
at sun.swing.AccumulativeRunnable.run(AccumulativeRunnable.java:112)
at javax.swing.SwingWorker$DoSubmitAccumulativeRunnable.actionPerformed(SwingWorker.java:842)
at javax.swing.Timer.fireActionPerformed(Timer.java:313)
at javax.swing.Timer$DoPostEvent.run(Timer.java:245)
at java.awt.event.InvocationEvent.dispatch(InvocationEvent.java:311)
at java.awt.EventQueue.dispatchEventImpl(EventQueue.java:758)
at java.awt.EventQueue.access$500(EventQueue.java:97)
at java.awt.EventQueue$3.run(EventQueue.java:709)
at java.awt.EventQueue$3.run(EventQueue.java:703)
at java.security.AccessController.doPrivileged(Native Method)
at java.security.ProtectionDomain$JavaSecurityAccessImpl.doIntersectionPrivilege(ProtectionDomain.java:74)
at java.awt.EventQueue.dispatchEvent(EventQueue.java:728)
at org.netbeans.core.TimableEventQueue.dispatchEvent(TimableEventQueue.java:159)

[catch] at java.awt.EventDispatchThread.pumpOneEventForFilters(EventDispatchThread.java:205) at java.awt.EventDispatchThread.pumpEventsForFilter(EventDispatchThread.java:116) at java.awt.EventDispatchThread.pumpEventsForHierarchy(EventDispatchThread.java:105) at java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:101) at java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:93) at java.awt.EventDispatchThread.run(EventDispatchThread.java:82)

[markmckinnon]

what version of Ubuntu? What directions did you follow to create 4.8 of Autopsy? Going to try and recreate your environment so I can see what is going on.

[mrh1]

Oh, sorry, Ubuntu 16.04. The SANS SIFT workstation ova file (https://digital-forensics.sans.org/community/downloads).

I installed Autopsy as follows (pardon the large font, which was copied from a PowerPoint): •UpdateSIFT to Java 1.8: Follow instructions at-https://medium.com/coderscorner/installing-oracle-java-8-in-ubuntu-16-10-845507b13343 •Setthe JAVA_HOME environment variable-Editthe /etc/environment file »sudogedit/etc/environment-Insertthe java path on a new line at the bottom:◦JAVA_HOME="/usr/lib/jvm/java-8-oracle"-Addthe JAVA_HOME variable to your current shell (to avoid having to log out andback in)◦export JAVA_HOME="/usr/lib/jvm/java-8-oracle" •Downloadsleuthkit-java_4.6.2-1_amd64.debfrom-http://github.com/sleuthkit/sleuthkit/releases-CDto the Downloads directory; install sleuthkit java»cd~/Downloads»sudo aptinstall ./sleuthkit-java_4.6.2-1_amd64.deb•Downloadautopsy-4.8.0.zip from-https://github.com/sleuthkit/autopsy/releases/ •Unzipthe file, cd to the unzipped directory,and install»unzipautopsy-4.8.0.zip»cdautopsy-4.8.0»sh ./unix_setup.sh•Startautopsy with the command:»bin/autopsy Autopsy worked fine that way using the built-in plugins, and with one community-developed python plugin I tried (Chrome passwords identifier at https://github.com/tomvandermussele/autopsy-plugins).

-Mark From: Mark McKinnon notifications@github.com To: markmckinnon/Autopsy-Plugins Autopsy-Plugins@noreply.github.com Cc: mrh1 mrheckman@yahoo.com; Author author@noreply.github.com Sent: Tuesday, September 25, 2018 4:34 PM Subject: Re: [markmckinnon/Autopsy-Plugins] Volatility plugin exception in Autopsy 4.8.0 on Ubuntu (#13)

what version of Ubuntu? What directions did you follow to create 4.8 of Autopsy? Going to try and recreate your environment so I can see what is going on.— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub, or mute the thread.

[markmckinnon]

Try the plugin I uploaded to my google drive to see if it fixes the issue. If it does I will move it over. https://drive.google.com/open?id=1zb-vPOQksTaGoFxCv3uSE67VizTekjTU

[mrh1]

It doesn't hang Autopsy or crash on startup, so that's good.

When I want to read a memory image as a data source, what Data Source type should I choose: a Disk Image or VM File, a Local Disk, a set of Logical Files, or Unallocated Space Image File?

  From: Mark McKinnon <notifications@github.com>

To: markmckinnon/Autopsy-Plugins Autopsy-Plugins@noreply.github.com Cc: mrh1 mrheckman@yahoo.com; Author author@noreply.github.com Sent: Wednesday, September 26, 2018 2:31 PM Subject: Re: [markmckinnon/Autopsy-Plugins] Volatility plugin exception in Autopsy 4.8.0 on Ubuntu (#13)

Try the plugin I uploaded to my google drive to see if it fixes the issue. If it does I will move it over. https://drive.google.com/open?id=1zb-vPOQksTaGoFxCv3uSE67VizTekjTU— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub, or mute the thread.

[mrh1]

I specified the memory image as "unallocated", then unchecked all of the ingest modules except "Volatility Dump File Module", "Volatility Module", and "Volatility Convert Hiber/Crash Module". This is the result (missing "colatility File"):

  From: Mark McKinnon <notifications@github.com>

To: markmckinnon/Autopsy-Plugins Autopsy-Plugins@noreply.github.com Cc: mrh1 mrheckman@yahoo.com; Author author@noreply.github.com Sent: Wednesday, September 26, 2018 2:31 PM Subject: Re: [markmckinnon/Autopsy-Plugins] Volatility plugin exception in Autopsy 4.8.0 on Ubuntu (#13)

Try the plugin I uploaded to my google drive to see if it fixes the issue. If it does I will move it over. https://drive.google.com/open?id=1zb-vPOQksTaGoFxCv3uSE67VizTekjTU— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub, or mute the thread.

[markmckinnon]

You will have to add the memory dump as a local file.

[mrh1]

Do you mean as a Logical File?

I'm getting this now, by the way, whenever I try to add a new data source:

And the Volatility Ingest modules don't run anyway, with the error I sent you earlier:

  From: Mark McKinnon <notifications@github.com>

To: markmckinnon/Autopsy-Plugins Autopsy-Plugins@noreply.github.com Cc: mrh1 mrheckman@yahoo.com; Author author@noreply.github.com Sent: Wednesday, September 26, 2018 4:45 PM Subject: Re: [markmckinnon/Autopsy-Plugins] Volatility plugin exception in Autopsy 4.8.0 on Ubuntu (#13)

You will have to add the memory dump as a local file.— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub, or mute the thread.

[markmckinnon]

I have fixed the issues and you should not get this issue with the new version. I am closing this issue, please reopen if the issue persists.