search

sleuthkit / autopsy

Autopsy® is a digital forensics platform and graphical interface to The Sleuth Kit® and other digital forensics tools. It can be used by law enforcement, military, and corporate examiners to investigate what happened on a computer. You can even use it to recover photos from your camera's memory card.
http://www.sleuthkit.org/autopsy/
2.41k stars 597 forks source link

Autopsy 3.1.0Beta GUI confused while locked #821

Open kefir- opened 10 years ago

kefir- commented 10 years ago

The Autopsy GUI was locked as it was loading a view, and I clicked a couple of places in the Tree View while it was working. As a consequence, the "Installed Programs" entry is selected in the Tree View, but the Web History details is what is actually shown in the table view. Here's a screenshot.

autopsy-gui-confused

The GUI was not locked when I acquired this screenshot, and I tried clicking "Installed Programs" again (without clicking something else first), and nothing changed.

It was all pretty clear that something was wrong with the entries I've selected, but in other cases this could result in confusion and misunderstanding.

bcarrier commented 10 years ago

Was ingest going on when this happened? We have seen that the UI is now less responsive because the multiple background threads are all locking up the DB. We've tried some things to mitigate this, but they haven't helped yet. We're thinking we need to change the internal design a bit so that modules can get blackboard contents and such directly from memory so that they are not going to the DB so much (and therefore the UI has easier access to the DB).

kefir- commented 10 years ago

Yes, "E01 Verifier" and "Analyzing files" were running. I'll let you know if it happens again when I'm not running ingest. As I understand you've already been working on, I think it's important to get the UI stable (and responsive) while ingest is running so that an investigator can start looking at the system before ingest is done.

rcordovano commented 10 years ago

The code to enable/disable the Thumbnail tab in the view area of the Autopsy window was doing expensive per file tests for the selection in the Autopsy tree on the event dispatch thread. Looking at the screenshot supplied, it appears that Web History with 62,301 results was selected at the time the GUI locked up. I believe mouse clicks while the expensive tests were being done would be queued and eventually processed, a possible explanation for some erratic GUI behavior. We have tentatively chosen to have the Thumbnail tab always enabled, eliminating the expensive checks.