shannaniggans
commented
2 years ago Please reopen if still experiencing the issue in autopsy 4.13.9 or later
Closed 40417256 closed 2 years ago
shannaniggans
commented
2 years ago Please reopen if still experiencing the issue in autopsy 4.13.9 or later
On my system Windows server 2019, Autopsy 4.12 when I try to ingest modules with settings (AM cache,
EVTX...) in the UI, the module will not run and I found this error to be more or less generic
if self.local_settings.getSetting('associateFileEntries') =='true': seem to be the culprit
SEVERE: Error starting Parse Amcache ingest module for job 3 Traceback (most recent call last): File "C:\Users\Administrator\AppData\Roaming\autopsy\python_modules\Process_Amcache\ParseAmcache.py", line 157, in startUp if self.local_settings.getSetting('associateFileEntries') =='true': AttributeError: 'NoneType' object has no attribute 'getSetting'
org.python.core.Py.AttributeError(Py.java:205) org.python.core.PyObject.noAttributeError(PyObject.java:1013) org.python.core.PyObject.__getattr__(PyObject.java:1008) ParseAmcache$py.startUp$14(C:\Users\Administrator\AppData\Roaming\autopsy\python_modules\Process_Amcache\ParseAmcache.py:170) ParseAmcache$py.call_function(C:\Users\Administrator\AppData\Roaming\autopsy\python_modules\Process_Amcache\ParseAmcache.py) org.python.core.PyTableCode.call(PyTableCode.java:167) org.python.core.PyBaseCode.call(PyBaseCode.java:307) org.python.core.PyBaseCode.call(PyBaseCode.java:198) org.python.core.PyFunction.__call__(PyFunction.java:482) org.python.core.PyMethod.instancemethod___call__(PyMethod.java:237) org.python.core.PyMethod.__call__(PyMethod.java:228) org.python.core.PyMethod.__call__(PyMethod.java:218) org.python.core.PyMethod.__call__(PyMethod.java:213) org.python.core.PyObject._jcallexc(PyObject.java:3626) org.python.proxies.ParseAmcache$ParseAmcacheIngestModule$1580.startUp(Unknown Source) org.sleuthkit.autopsy.ingest.DataSourceIngestPipeline$PipelineModule.startUp(DataSourceIngestPipeline.java:200) org.sleuthkit.autopsy.ingest.DataSourceIngestPipeline.startUp(DataSourceIngestPipeline.java:83) org.sleuthkit.autopsy.ingest.DataSourceIngestJob.startUpIngestPipelines(DataSourceIngestJob.java:449) org.sleuthkit.autopsy.ingest.DataSourceIngestJob.start(DataSourceIngestJob.java:419) org.sleuthkit.autopsy.ingest.IngestJob.start(IngestJob.java:158) org.sleuthkit.autopsy.ingest.IngestManager.startIngestJob(IngestManager.java:407) org.sleuthkit.autopsy.ingest.IngestManager.access$600(IngestManager.java:111) org.sleuthkit.autopsy.ingest.IngestManager$StartIngestJobTask.call(IngestManager.java:849) org.sleuthkit.autopsy.ingest.IngestManager$StartIngestJobTask.call(IngestManager.java:812) java.util.concurrent.FutureTask.run(FutureTask.java:266) java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) java.lang.Thread.run(Thread.java:748) 2020-03-14 13:31:24.411 org.sleuthkit.autopsy.ingest.IngestManager startIngestJob SEVERE: Ingest job 3 could not be startedIt looks like the values are undefined when the code gets there, and if I manually edit the code like commenting out the code to select the options I would like to run, the module works
if self.local_settings.getSetting('associateFileEntries') =='true': self.List_Of_tables.append('associated_file_entries') if self.local_settings.getSetting('programEntries') == 'true': self.List_Of_tables.append('program_entries') if self.local_settings.getSetting('unassociatePrograms') == 'true': self.List_Of_tables.append('unassociated_programs')