Skip to content

Issues getting the Autopsy plugin to work #3

@stoked-security

Description

@stoked-security

Hi,
I'm trying to use the Autopsy plugin, but I'm having trouble to get it to work.

OS: Arch Linux
Autopsy version: 4.22.1

What I have tried so far:

  1. Copied the files ubift_autopsy.py and ubift_autopsy$py.class to the user's python_modules directory (~/.autopsy/dev^M/python_modules).
  2. Used pyinstaller as suggested in the README using the following command: `pyinstaller ubift.py'
  3. Copied the content of the dist/ubift/ directory generated by pyinstaller to user's python_modules directory
  4. Started Autopsy and tried to read a copy of a mtd file containing a ubi file system.
  5. The file system is not recognized by Autopsy and the import fails.

For completeness the content of the user's python_modules directory looks like this:

drwxr-xr-x 5 user user    4096 14 apr 17:26  _internal
-rwxr-xr-x 1 user user 2114632 14 apr 17:26  ubift
-rw------- 1 user user   24195 14 apr 17:26 'ubift_autopsy$py.class'
-rw-r--r-- 1 user user   14535 14 apr 17:26  ubift_autopsy.py

The _internal directory contains many compiled Python libraries generated by pyinstaller.

I've noticed the user's python_modules directory looks a bit weird with the ^M in the file name. So far I have not been able to find where this is coming from. I tried renaming the directory without the ^M in the directory name, but without success. If I completely remove the ~/.autopsy directory it get's recreated with the ^M in the directory name again, so my suspicion is that it is coming from somewhere in the config or code.

I also read that the class file should be regenerated when restarting Autopsy when not present. I tried this, suspecting the Java version may be too old, but it is not regenerated after a restart.

Btw, the copy of the mtd block device can be read with the python ubift script without issues, so I know the image is not the problem.

Do you have any suggestions what I'm doing wrong and how I can get the plugin to work?

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions