search

sleuthkit / autopsy

Autopsy® is a digital forensics platform and graphical interface to The Sleuth Kit® and other digital forensics tools. It can be used by law enforcement, military, and corporate examiners to investigate what happened on a computer. You can even use it to recover photos from your camera's memory card.
http://www.sleuthkit.org/autopsy/
2.37k stars 592 forks source link

Web history not working well in Autopsy 4.21 #7893

Closed phy-development closed 5 months ago

phy-development commented 5 months ago

Hello, I have recently upgraded from Autopsy 4.19 to Autopsy 4.21. I am working with this disk image: http://perito.legal/traidor.img.zip Mirror for the case the previous one doesn't work: https://drive.google.com/file/d/1yBLsxCjMcO6iV2lvMloI64CLUizQouJ0/view (you must uncompress the file after downloading).

When I used Autopsy 4.19 and executed Recent Activity, I used to get 496 entries in Web History and 80 entries in web search as shown in this image. Autopsy4 19

However, when I execute the very same ingest module in Autopsy 4.21, I only get 201 entries in Web History and 44 in Web search, as shown in this picture: Autopsy 4 21

Especially, I noticed that am missing some navigations to flight companies in which the user tries to buy a flight, shown in the first picture. I know those searches and navigations should be there because I created the virtual machine and the forensic image. Many of my students are experiencing the same problem. Please help. Best regards, Phy

markmckinnon commented 5 months ago

Thank you for providing a sample image to use to debug this issue. You are correct that there is an issue and the problem is that the Opera Browser does not have any profiles and it is looking for profiles to determine where all the browsing history is. I am working on a fix for this.

markmckinnon commented 5 months ago

Fixed with PR https://github.com/sleuthkit/autopsy/pull/7895

markmckinnon commented 5 months ago

PR is now merged in. Closing this issue as resolved. If this is still an issue in the future please create a new issue or reopen this issue.