search

sepinf-inc / IPED

IPED Digital Forensic Tool. It is an open source software that can be used to process and analyze digital evidence, often seized at crime scenes by law enforcement or in a corporate investigation by private examiners.
Other
884 stars 209 forks source link

Exception when using "--nogui" in a never used Windows machine #2196

Closed wladimirleite closed 1 month ago

wladimirleite commented 1 month ago

When setting up new Windows server machines to use an automation system that runs IPED, an user got an exception related to the initialization of DocThumbTask. It relies on LibreOffice, but it is not present in "C:\Users\\AppData\Local\iped" as the machine was never used to run IPED and the automatic extraction fails if --nogui is used, which is the case.

2024-05-03 20:10:45     [MSG]   [processing.ui.ProgressConsole]         Inicializando DocThumbTask
2024-05-03 20:10:45     [ERROR] [app.processing.Main]                   Processing Error:
java.io.IOException: Cannot run program "null/program/soffice.bin": CreateProcess error=2, O sistema não pode encontrar o arquivo especificado
        at java.lang.ProcessBuilder.start(Unknown Source) ~[?:?]
        at java.lang.ProcessBuilder.start(Unknown Source) ~[?:?]
        at iped.engine.task.DocThumbTask.init(DocThumbTask.java:131) ~[iped-engine-4.2-snapshot.jar:?]
        at iped.engine.core.Worker.initTasks(Worker.java:128) ~[iped-engine-4.2-snapshot.jar:?]
        at iped.engine.core.Worker.<init>(Worker.java:110) ~[iped-engine-4.2-snapshot.jar:?]
        at iped.engine.core.Manager.initWorkers(Manager.java:561) ~[iped-engine-4.2-snapshot.jar:?]
        at iped.engine.core.Manager.process(Manager.java:283) ~[iped-engine-4.2-snapshot.jar:?]
        at iped.app.processing.Main.startManager(Main.java:179) [iped.jar:?]
        at iped.app.processing.Main.execute(Main.java:242) [iped.jar:?]
        at iped.app.processing.Main.main(Main.java:310) [iped.jar:?]
Caused by: java.io.IOException: CreateProcess error=2, O sistema não pode encontrar o arquivo especificado
        at java.lang.ProcessImpl.create(Native Method) ~[?:?]
        at java.lang.ProcessImpl.<init>(Unknown Source) ~[?:?]
        at java.lang.ProcessImpl.start(Unknown Source) ~[?:?]
        ... 10 more
ERROR!!!

A possible workaround is to manually copy libreoffice to the expected folder from another machine in which IPED was used without --nogui. However it is not very practical when working with several machines (and possibly different users in each machine).