Open kefir- opened 10 years ago
Was ingest going on when this happened? We have seen that the UI is now less responsive because the multiple background threads are all locking up the DB. We've tried some things to mitigate this, but they haven't helped yet. We're thinking we need to change the internal design a bit so that modules can get blackboard contents and such directly from memory so that they are not going to the DB so much (and therefore the UI has easier access to the DB).
Yes, "E01 Verifier" and "Analyzing files" were running. I'll let you know if it happens again when I'm not running ingest. As I understand you've already been working on, I think it's important to get the UI stable (and responsive) while ingest is running so that an investigator can start looking at the system before ingest is done.
The code to enable/disable the Thumbnail tab in the view area of the Autopsy window was doing expensive per file tests for the selection in the Autopsy tree on the event dispatch thread. Looking at the screenshot supplied, it appears that Web History with 62,301 results was selected at the time the GUI locked up. I believe mouse clicks while the expensive tests were being done would be queued and eventually processed, a possible explanation for some erratic GUI behavior. We have tentatively chosen to have the Thumbnail tab always enabled, eliminating the expensive checks.
The Autopsy GUI was locked as it was loading a view, and I clicked a couple of places in the Tree View while it was working. As a consequence, the "Installed Programs" entry is selected in the Tree View, but the Web History details is what is actually shown in the table view. Here's a screenshot.
The GUI was not locked when I acquired this screenshot, and I tried clicking "Installed Programs" again (without clicking something else first), and nothing changed.
It was all pretty clear that something was wrong with the entries I've selected, but in other cases this could result in confusion and misunderstanding.