search

sleuthkit / autopsy

Autopsy® is a digital forensics platform and graphical interface to The Sleuth Kit® and other digital forensics tools. It can be used by law enforcement, military, and corporate examiners to investigate what happened on a computer. You can even use it to recover photos from your camera's memory card.
http://www.sleuthkit.org/autopsy/
2.35k stars 586 forks source link

Error creating new case #2210

Open afik opened 8 years ago

afik commented 8 years ago

Hi, I've just build Autopsy 4.1.0 on my Ubuntu 12.04 by following steps from here. After successful build I run it using ant run and try to create new case. But I keep getting following error, even after try to restart and rebuild it again. Any suggestion?

First exception

[exec] Jun 05, 2016 6:37:15 PM org.sleuthkit.autopsy.coreutils.ImageUtils [exec] SEVERE: OpenCV Native code library failed to load [exec] java.lang.UnsatisfiedLinkError: no opencv_java248 in java.library.path [exec] at java.lang.ClassLoader.loadLibrary(ClassLoader.java:1867) [exec] at java.lang.Runtime.loadLibrary0(Runtime.java:870) [exec] at java.lang.System.loadLibrary(System.java:1122) [exec] at org.sleuthkit.autopsy.coreutils.ImageUtils.(ImageUtils.java:111) [exec] at org.sleuthkit.autopsy.corecomponents.MediaViewImagePanel.(MediaViewImagePanel.java:84) [exec] at org.sleuthkit.autopsy.corecomponents.DataContentViewerMedia.(DataContentViewerMedia.java:65) [exec] at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) [exec] at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62) [exec] at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45) [exec] at java.lang.reflect.Constructor.newInstance(Constructor.java:423) [exec] at java.lang.Class.newInstance(Class.java:442) [exec] at org.openide.util.lookup.implspi.SharedClassObjectBridge.newInstance(SharedClassObjectBridge.java:64) [exec] at org.openide.util.lookup.MetaInfServicesLookup$Item.getInstance(MetaInfServicesLookup.java:514) [exec] at org.openide.util.lookup.AbstractLookup$R.allInstances(AbstractLookup.java:1055) [exec] at org.openide.util.lookup.AbstractLookup$R.allInstances(AbstractLookup.java:1035) [exec] at org.openide.util.lookup.ProxyLookup$LazyCollection.computeSingleResult(ProxyLookup.java:1285) [exec] at org.openide.util.lookup.ProxyLookup$LazyCollection.computeDelegate(ProxyLookup.java:1123) [exec] at org.openide.util.lookup.ProxyLookup$LazyCollection.access$900(ProxyLookup.java:1051) [exec] at org.openide.util.lookup.ProxyLookup$LazyCollection$1.hasNext(ProxyLookup.java:1251) [exec] at org.sleuthkit.autopsy.corecomponents.DataContentPanel.(DataContentPanel.java:67) [exec] at org.sleuthkit.autopsy.corecomponents.DataContentTopComponent.(DataContentTopComponent.java:67) [exec] at org.sleuthkit.autopsy.corecomponents.DataContentTopComponent.getDefault(DataContentTopComponent.java:115) [exec] at org.sleuthkit.autopsy.corecomponents.DataContentTopComponent.findInstance(DataContentTopComponent.java:128) [exec] at org.sleuthkit.autopsy.menuactions.DataContentDynamicMenu.getMenuPresenters(DataContentDynamicMenu.java:48) [exec] at org.openide.awt.DynaMenuModel.loadSubmenu(DynaMenuModel.java:109) [exec] at org.openide.awt.MenuBar$LazyMenu$MenuFolder.createInstance(MenuBar.java:808) [exec] at org.openide.loaders.FolderInstance.defaultProcessObjectsFinal(FolderInstance.java:888) [exec] at org.openide.loaders.FolderInstance$1R.run(FolderInstance.java:730) [exec] at org.openide.util.Task.run(Task.java:257) [exec] at org.netbeans.modules.openide.loaders.AWTTask.run(AWTTask.java:79) [exec] at org.netbeans.modules.openide.loaders.AWTTask$Processor.run(AWTTask.java:172) [exec] at java.awt.event.InvocationEvent.dispatch(InvocationEvent.java:311) [exec] at java.awt.EventQueue.dispatchEventImpl(EventQueue.java:756) [exec] at java.awt.EventQueue.access$500(EventQueue.java:97) [exec] at java.awt.EventQueue$3.run(EventQueue.java:709) [exec] at java.awt.EventQueue$3.run(EventQueue.java:703) [exec] at java.security.AccessController.doPrivileged(Native Method) [exec] at java.security.ProtectionDomain$JavaSecurityAccessImpl.doIntersectionPrivilege(ProtectionDomain.java:76) [exec] at java.awt.EventQueue.dispatchEvent(EventQueue.java:726) [exec] at org.netbeans.core.TimableEventQueue.dispatchEvent(TimableEventQueue.java:159) [exec] at java.awt.EventDispatchThread.pumpOneEventForFilters(EventDispatchThread.java:201) [exec] at java.awt.EventDispatchThread.pumpEventsForFilter(EventDispatchThread.java:116) [exec] at java.awt.EventDispatchThread.pumpEventsForFilter(EventDispatchThread.java:109) [exec] at java.awt.WaitDispatchSupport$2.run(WaitDispatchSupport.java:184) [exec] at java.awt.WaitDispatchSupport$4.run(WaitDispatchSupport.java:229) [exec] at java.awt.WaitDispatchSupport$4.run(WaitDispatchSupport.java:227) [exec] at java.security.AccessController.doPrivileged(Native Method) [exec] at java.awt.WaitDispatchSupport.enter(WaitDispatchSupport.java:227) [exec] at java.awt.Dialog.show(Dialog.java:1084) [exec] at org.netbeans.core.windows.services.NbPresenter.superShow(NbPresenter.java:1065) [exec] at org.netbeans.core.windows.services.NbPresenter.doShow(NbPresenter.java:1115) [exec] at org.netbeans.core.windows.services.NbPresenter.run(NbPresenter.java:1087) [exec] at org.netbeans.core.windows.services.NbPresenter.run(NbPresenter.java:128) [exec] at org.netbeans.modules.openide.util.NbMutexEventProvider$Event.doEventAccess(NbMutexEventProvider.java:138) [exec] at org.netbeans.modules.openide.util.NbMutexEventProvider$Event.readAccess(NbMutexEventProvider.java:98) [exec] at org.netbeans.modules.openide.util.LazyMutexImplementation.readAccess(LazyMutexImplementation.java:94) [exec] at org.openide.util.Mutex.readAccess(Mutex.java:218) [exec] at org.netbeans.core.windows.services.NbPresenter.show(NbPresenter.java:1072) [exec] at java.awt.Component.show(Component.java:1673) [exec] at java.awt.Component.setVisible(Component.java:1625) [exec] at java.awt.Window.setVisible(Window.java:1014) [exec] at java.awt.Dialog.setVisible(Dialog.java:1005) [exec] at org.sleuthkit.autopsy.casemodule.NewCaseWizardAction.runNewCaseWizard(NewCaseWizardAction.java:93) [exec] at org.sleuthkit.autopsy.casemodule.NewCaseWizardAction.performAction(NewCaseWizardAction.java:85) [exec] at org.sleuthkit.autopsy.casemodule.CaseNewAction.actionPerformed(CaseNewAction.java:45)

Second exception

[exec] INFO: Found ingest module factory: name = Recent Activity, version = 4.1.0 [exec] WARNING [org.netbeans.core.startup.InstalledFileLocatorImpl]: no such module /home/tolep/Documents/TugasAwesome/autopsy/build/cluster/update_tracking/org-sleuthkit-autopsy-python.xml at org.sleuthkit.autopsy.python.JythonModuleLoader.getInterfaceImplementations(JythonModuleLoader.java:77) [exec] Jun 05, 2016 6:37:52 PM org.sleuthkit.autopsy.casemodule.NewCaseWizardAction$1 done [exec] SEVERE: Error creating case a [exec] java.lang.NullPointerException [exec] at org.sleuthkit.autopsy.modules.hashdatabase.HashLookupSettingsPanel.addPropertyChangeListener(HashLookupSettingsPanel.java:109) [exec] at javax.swing.plaf.synth.SynthPanelUI.installListeners(SynthPanelUI.java:83) [exec] at javax.swing.plaf.synth.SynthPanelUI.installUI(SynthPanelUI.java:63) [exec] at javax.swing.JComponent.setUI(JComponent.java:666) [exec] at javax.swing.JPanel.setUI(JPanel.java:153) [exec] at javax.swing.JPanel.updateUI(JPanel.java:126) [exec] at javax.swing.JPanel.(JPanel.java:86) [exec] at javax.swing.JPanel.(JPanel.java:109) [exec] at javax.swing.JPanel.(JPanel.java:117) [exec] at org.sleuthkit.autopsy.ingest.IngestModuleGlobalSettingsPanel.(IngestModuleGlobalSettingsPanel.java:26) [exec] at org.sleuthkit.autopsy.modules.hashdatabase.HashLookupSettingsPanel.(HashLookupSettingsPanel.java:67) [exec] at org.sleuthkit.autopsy.modules.hashdatabase.HashLookupModuleFactory.getGlobalSettingsPanel(HashLookupModuleFactory.java:103) [exec] at org.sleuthkit.autopsy.ingest.IngestModuleTemplate.getGlobalSettingsPanel(IngestModuleTemplate.java:69) [exec] at org.sleuthkit.autopsy.ingest.IngestJobSettingsPanel$IngestModuleModel.(IngestJobSettingsPanel.java:362) [exec] at org.sleuthkit.autopsy.ingest.IngestJobSettingsPanel.(IngestJobSettingsPanel.java:58) [exec] at org.sleuthkit.autopsy.casemodule.AddImageWizardIngestConfigPanel.(AddImageWizardIngestConfigPanel.java:81) [exec] at org.sleuthkit.autopsy.casemodule.AddImageWizardIterator.getPanels(AddImageWizardIterator.java:55) [exec] at org.sleuthkit.autopsy.casemodule.AddImageWizardIterator.current(AddImageWizardIterator.java:104) [exec] at org.openide.WizardDescriptor.updateStateOpen(WizardDescriptor.java:844) [exec] at org.openide.WizardDescriptor.updateState(WizardDescriptor.java:822) [exec] at org.openide.WizardDescriptor._updateState(WizardDescriptor.java:800) [exec] at org.openide.WizardDescriptor.initialize(WizardDescriptor.java:475) [exec] at org.openide.NotifyDescriptor.getterCalled(NotifyDescriptor.java:302) [exec] at org.openide.DialogDescriptor.isModal(DialogDescriptor.java:322) [exec] at org.netbeans.core.windows.services.NbDialog.(NbDialog.java:67) [exec] at org.netbeans.core.windows.services.DialogDisplayerImpl$1.run(DialogDisplayerImpl.java:158) [exec] at org.netbeans.core.windows.services.DialogDisplayerImpl$1.run(DialogDisplayerImpl.java:119) [exec] at org.netbeans.modules.openide.util.NbMutexEventProvider$Event.doEventAccess(NbMutexEventProvider.java:138) [exec] at org.netbeans.modules.openide.util.NbMutexEventProvider$Event.readAccess(NbMutexEventProvider.java:98) [exec] at org.netbeans.modules.openide.util.LazyMutexImplementation.readAccess(LazyMutexImplementation.java:94) [exec] at org.openide.util.Mutex.readAccess(Mutex.java:218) [exec] at org.netbeans.core.windows.services.DialogDisplayerImpl.createDialog(DialogDisplayerImpl.java:119) [exec] at org.netbeans.core.windows.services.DialogDisplayerImpl.createDialog(DialogDisplayerImpl.java:111) [exec] at org.sleuthkit.autopsy.casemodule.AddImageAction.actionPerformed(AddImageAction.java:130) [exec] at org.sleuthkit.autopsy.casemodule.NewCaseWizardAction$1.done(NewCaseWizardAction.java:113) .....

Thanks

rcordovano commented 8 years ago

Regarding the first exception, 64-bit Autopsy has a dependency on OpenCV for dealing with visual media files. 32-bit Autopsy uses gstreamer for the same purpose. I notice that the build instructions at https://forum.sleuthkit.org/viewtopic.php?f=5&t=106 include this line, but I did not see anything for OpenCV:

sudo apt-get install gstreamer1.0

Regarding the second exception, it looks like you are building either the release-4.1.0 or the develop branch, since I see that the version of the recent activity ingest module is 4.1.0. If this is true, looking at the code in org.sleuthkit.autopsy.modules.hashdatabase.HashLookupSettingsPanel where the NullPointerException occurred, I am at a loss to explain the NPE. In a nutshell, if my analysis is correct, it happened when the options panel controller for the hash lookup ingest module global settings panel added itself to the panel as a property change listener. The panel object and its PropertyChangeSupport would have to be correctly constructed at that point, so the reference to the PropertyChangeSupport object would not be null. Therefore my best guess is that something went wrong in the Java library code for java.beans.PropertyChangeSupport. I expect you would have seen a popup from the New Case wizard stating "Cannot create case", am I right? We seem to be in deep water here, but I am wondering if something is not quite right with the build.

afik commented 8 years ago

I build develop branch on 32-bit computer so it automatically compiled as 32-bit Autopsy isn't it? I've tried to reinstall gstreamer1.0 and first exception still occurred. But, from what I've observed the exception occurred before I try to create new case and even though it occurred there's no error messages showing in Autopsy window. So can I just ignore that exception or you have any other suggestion on what should I do? And for second exception, it happen in hashdatabase module isn't? Is there any way to unload that module? I want to build a new ingest module and I guess I don't need hashdatabase module. Thanks.

rcordovano commented 8 years ago

I have corrected information from another developer - the 32-bit version of Autopsy also uses OpenCV for some features, and gstreamer for video playback.

If you do not need the various media features of Autopsy, I think you can ignore the first exception.

Regarding disabling the hash lookup nmodule. are you getting to the point in the Add Data Source wizard where you can see a list of the available ingest modules? If so, remove the check from the check box for the hash look up module. If you cannot get to that screen, you could comment out the service provider annotation in org.sluehthkit.autopsy.modules.hashdatabase.HashLookupModuleFactory in the Autopsy-Core NetBeans Module:

/**

afik commented 8 years ago

I commented out service provider annotation in HashLookupModuleFactory but then I got same NullPointerException at FileTypeId module. I also commented out annotation in FileTypeId Factory but then i'm getting this exception.

[exec] Jun 08, 2016 12:45:09 AM org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader getIngestModuleFactories [exec] SEVERE: Core factory org.sleuthkit.autopsy.modules.hashdatabase.HashLookupModuleFactory not loaded [exec] Jun 08, 2016 12:45:09 AM org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader getIngestModuleFactories [exec] SEVERE: Core factory org.sleuthkit.autopsy.modules.filetypeid.FileTypeIdModuleFactory not loaded [exec] WARNING [org.netbeans.core.startup.InstalledFileLocatorImpl]: no such module /home/tolep/Documents/TugasAwesome/autopsy/build/cluster/update_tracking/org-sleuthkit-autopsy-python.xml at org.sleuthkit.autopsy.python.JythonModuleLoader.getInterfaceImplementations(JythonModuleLoader.java:77) [exec] Jun 08, 2016 12:45:19 AM org.sleuthkit.autopsy.ingest.IngestJobSettings load [exec] WARNING: Previously loaded File Type Identification module could not be found. [exec] Jun 08, 2016 12:45:24 AM org.sleuthkit.autopsy.casemodule.NewCaseWizardAction$1 done [exec] SEVERE: Error creating case a [exec] java.lang.NullPointerException [exec] at org.sleuthkit.autopsy.keywordsearch.KeywordSearchGlobalSettingsPanel.addPropertyChangeListener(KeywordSearchGlobalSettingsPanel.java:56) [exec] at javax.swing.plaf.synth.SynthPanelUI.installListeners(SynthPanelUI.java:83) [exec] at javax.swing.plaf.synth.SynthPanelUI.installUI(SynthPanelUI.java:63) [exec] at javax.swing.JComponent.setUI(JComponent.java:666) [exec] at javax.swing.JPanel.setUI(JPanel.java:153) [exec] at javax.swing.JPanel.updateUI(JPanel.java:126) [exec] at javax.swing.JPanel.(JPanel.java:86) [exec] at javax.swing.JPanel.(JPanel.java:109) [exec] at javax.swing.JPanel.(JPanel.java:117) [exec] at org.sleuthkit.autopsy.ingest.IngestModuleGlobalSettingsPanel.(IngestModuleGlobalSettingsPanel.java:26) [exec] at org.sleuthkit.autopsy.keywordsearch.KeywordSearchGlobalSettingsPanel.(KeywordSearchGlobalSettingsPanel.java:35) [exec] at org.sleuthkit.autopsy.keywordsearch.KeywordSearchModuleFactory.getGlobalSettingsPanel(KeywordSearchModuleFactory.java:105) [exec] at org.sleuthkit.autopsy.ingest.IngestModuleTemplate.getGlobalSettingsPanel(IngestModuleTemplate.java:69) [exec] at org.sleuthkit.autopsy.ingest.IngestJobSettingsPanel$IngestModuleModel.(IngestJobSettingsPanel.java:362) [exec] at org.sleuthkit.autopsy.ingest.IngestJobSettingsPanel.(IngestJobSettingsPanel.java:58) [exec] at org.sleuthkit.autopsy.casemodule.AddImageWizardIngestConfigPanel.(AddImageWizardIngestConfigPanel.java:81) [exec] at org.sleuthkit.autopsy.casemodule.AddImageWizardIterator.getPanels(AddImageWizardIterator.java:55) [exec] at org.sleuthkit.autopsy.casemodule.AddImageWizardIterator.current(AddImageWizardIterator.java:104) [exec] at org.openide.WizardDescriptor.updateStateOpen(WizardDescriptor.java:844) [exec] at org.openide.WizardDescriptor.updateState(WizardDescriptor.java:822) [exec] at org.openide.WizardDescriptor._updateState(WizardDescriptor.java:800) [exec] at org.openide.WizardDescriptor.initialize(WizardDescriptor.java:475) [exec] at org.openide.NotifyDescriptor.getterCalled(NotifyDescriptor.java:302) [exec] at org.openide.DialogDescriptor.isModal(DialogDescriptor.java:322) [exec] at org.netbeans.core.windows.services.NbDialog.(NbDialog.java:67) [exec] at org.netbeans.core.windows.services.DialogDisplayerImpl$1.run(DialogDisplayerImpl.java:158) [exec] at org.netbeans.core.windows.services.DialogDisplayerImpl$1.run(DialogDisplayerImpl.java:119) [exec] at org.netbeans.modules.openide.util.NbMutexEventProvider$Event.doEventAccess(NbMutexEventProvider.java:138) [exec] at org.netbeans.modules.openide.util.NbMutexEventProvider$Event.readAccess(NbMutexEventProvider.java:98) [exec] at org.netbeans.modules.openide.util.LazyMutexImplementation.readAccess(LazyMutexImplementation.java:94) [exec] at org.openide.util.Mutex.readAccess(Mutex.java:218) [exec] at org.netbeans.core.windows.services.DialogDisplayerImpl.createDialog(DialogDisplayerImpl.java:119) [exec] at org.netbeans.core.windows.services.DialogDisplayerImpl.createDialog(DialogDisplayerImpl.java:111) [exec] at org.sleuthkit.autopsy.casemodule.AddImageAction.actionPerformed(AddImageAction.java:130) [exec] at org.sleuthkit.autopsy.casemodule.NewCaseWizardAction$1.done(NewCaseWizardAction.java:113) [exec] at javax.swing.SwingWorker$5.run(SwingWorker.java:737) [exec] at javax.swing.SwingWorker$DoSubmitAccumulativeRunnable.run(SwingWorker.java:832) [exec] at sun.swing.AccumulativeRunnable.run(AccumulativeRunnable.java:112) [exec] at javax.swing.SwingWorker$DoSubmitAccumulativeRunnable.actionPerformed(SwingWorker.java:842) [exec] at javax.swing.Timer.fireActionPerformed(Timer.java:313) [exec] at javax.swing.Timer$DoPostEvent.run(Timer.java:245) [exec] at java.awt.event.InvocationEvent.dispatch(InvocationEvent.java:311) [exec] at java.awt.EventQueue.dispatchEventImpl(EventQueue.java:756) [exec] at java.awt.EventQueue.access$500(EventQueue.java:97) [exec] at java.awt.EventQueue$3.run(EventQueue.java:709) [exec] at java.awt.EventQueue$3.run(EventQueue.java:703) [exec] at java.security.AccessController.doPrivileged(Native Method) [exec] at java.security.ProtectionDomain$JavaSecurityAccessImpl.doIntersectionPrivilege(ProtectionDomain.java:76) [exec] at java.awt.EventQueue.dispatchEvent(EventQueue.java:726) [exec] at org.netbeans.core.TimableEventQueue.dispatchEvent(TimableEventQueue.java:159) [exec] at java.awt.EventDispatchThread.pumpOneEventForFilters(EventDispatchThread.java:201) [exec] at java.awt.EventDispatchThread.pumpEventsForFilter(EventDispatchThread.java:116) [exec] at java.awt.EventDispatchThread.pumpEventsForHierarchy(EventDispatchThread.java:105) [exec] at java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:101) [exec] at java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:93) [exec] at java.awt.EventDispatchThread.run(EventDispatchThread.java:82)

rcordovano commented 8 years ago

Digging into this a little deeper, I see that the class of the object that is adding itself as a property change listener to the global settings panels of the ingest modules is SynthPanelUI, documented here: https://docs.oracle.com/javase/7/docs/api/javax/swing/plaf/synth/SynthPanelUI.html. According to https://docs.oracle.com/javase/8/docs/api/javax/swing/plaf/synth/package-summary.html, "Synth is a skinnable look and feel in which all painting is delegated."

I don't see anything in the Autopsy code that looks like it could be null when addPropertyChangeListener is called - everything should be properly constructed. I am speculating, but it is almost as if SynthPanelUI is trying to hook up with the panels before construction is complete. I suggest restoring the service provider annotations and setting a breakpoint in org.sleuthkit.autopsy.modules.hashdatabase.HashLookupSettingsPanel.addPropertyChangeListener to see if you can learn anything more by stepping through the code.

afik commented 8 years ago

Sorry for long respond. After stepping through the code, i found out that pcs (PropertyChangeSupport) variable is null when addPropertyChangeListener being called by SynthPanelUI by super constructor of HashLookupSettingsPanel. And then after some googling i found out that instance variables aren't even initialized until a super() call has been made. I guess that's why the NPE occured. So, do you have any idea to fix it? and actually i confused why is it only happen to me?

rcordovano commented 8 years ago

Thank you, afik, the additional information is helpful. I am wondering if the HashLookupSettingsPanel and other classes like it in Autopsy are coded incorrectly. My hypothesis is that HashLookupSettingsPanel should not have a PropertyChangeSupport field and should not override addPropertyChangeListener and removePropertyChangeListener. Instead, the implementations provided by Container should be used, and JComponent.firePropertyChange should be called instead of PropertyChangeSupport.firePropertyChange. I will look into this as soon as time permits; if you have the time and inclination, you could test my hypothesis yourself.

My guess the reason this has not come up before is that we don't have other users using Synth or anything else that is installing itself as a property change listener during UI component creation.

marcurdy commented 8 years ago

Would love a fix for this. Getting the same after compiling and running with ant.

rcordovano commented 8 years ago

afik, marcurdy, I have someone here at Basis Technology working on this now. I will post here when the fix is in the develop branch. It would be much appreciated if the two of you will confirm the fix at that time.

By the way, I'm curious about your use cases, since I know a lot about Autopsy on Windows and not so much about Autopsy on Linux. Will Synth or something like it always be involved when running Autopsy on Linux, or is this more a matter of personal preference? Is the end goal just running Autopsy on Linux, or are you trying to do something bigger? I know of at least one other person who is actively working on building for Linux, and in fact has made a pull request (hoyt-harness, #2292) that updates BUILDING.txt with some Linux building tips and also updates build.xml for ant to handle three digit Java SDK version numbers.

marcurdy commented 8 years ago

I'd have to try again with the newest version to see if it exists, still. The use on Linux is currently not a requirement for me.

afik commented 8 years ago

rcordovano, actually i misread the documentation.......... I thought I need to build autopsy from scratch to develop module. Since I can't install libewf in my Windows, I moved to Linux. After re read the documentation I found out that I only need the build platform. Before realizing my mistake, I already tried to change firePropertyChange like your suggestion. NPE didn't occured but I didn't continue my experiment, so I don't know is there any problem after that.

About Synth, I don't know.... I only followed steps on sleuthkit forum I've mentioned above, and suddenly the NPE occurred. I already asked my friend trying to build Autopsy using same steps above on his own computer and there's no exception occurred.

Em, since I already finish my module should I close this issue?

rcordovano commented 8 years ago

afik, thanks for the clarification, and I'm glad to hear that you were able to move ahead with your module development. I'd like to keep this issue open until the fix is completed and tested. Thanks to you and marcurdy for bringing it to my attention.

wishdasher commented 7 years ago

We have changed the use of PropertyChangeSupport in the relevant files, and the changes are now reflected in the develop branch of autopsy. It should work now, but please let us know if something is still wrong.

alamark commented 7 years ago

Hi, I have the same problem opening a new case with Autopsy 4.3.0, built from the developer sources on the latest release of Kali Linux. Has anybody solved this issue and been able to correctly run Autopsy 4 on Linux? Thanks.

rcordovano commented 6 years ago

A quick analysis suggests to me that wishdasher's fix on Sept 12, 2016 missed a place where super class addPropertyChangeListener/removePropertyChangeListener methods need to be invoked, i.e., in KeywordSearchGlobalSettingsPanel and any child components that override addPropertyChangeListener/removePropertyChangeListener.

bcarrier commented 6 years ago

For future reference, those changes seem to have been in #2302, #2304, and #2305.

rcordovano commented 6 years ago

I have made a fix to the add/remove property change listener code of these two classes:

KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/GlobalListSettingsPanel.java KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchGlobalSettingsPanel.java

The fix is in a new release-4.5.1 branch (commit 67cab4672fa99ea3cb1fe72ca30087e5efdd58bb). Please let me know if the fix does not solve the problem.

slo-sleuth commented 5 years ago

I had been unable to run Autopsy v4.10.0 because of a wrong java version error. I didn't pursue or try to resolve the issue, other than determine that the version required was not available for Mac at that time.

Today I successfully ran and installed Autopsy v4.11.0

NOTE: After starting my first case, there was an Ingest Message error indicating that the gstreamer library was missing. I did not test, but should be fixed with $ brew install gstreamer before starting a case.

I hope this helps those who have been having issues on Mac.