Hi,
I'm trying to use the Autopsy plugin, but I'm having trouble to get it to work.
OS: Arch Linux
Autopsy version: 4.22.1
What I have tried so far:
- Copied the files
ubift_autopsy.py and ubift_autopsy$py.class to the user's python_modules directory (~/.autopsy/dev^M/python_modules).
- Used pyinstaller as suggested in the README using the following command: `pyinstaller ubift.py'
- Copied the content of the
dist/ubift/ directory generated by pyinstaller to user's python_modules directory
- Started Autopsy and tried to read a copy of a mtd file containing a ubi file system.
- The file system is not recognized by Autopsy and the import fails.
For completeness the content of the user's python_modules directory looks like this:
drwxr-xr-x 5 user user 4096 14 apr 17:26 _internal
-rwxr-xr-x 1 user user 2114632 14 apr 17:26 ubift
-rw------- 1 user user 24195 14 apr 17:26 'ubift_autopsy$py.class'
-rw-r--r-- 1 user user 14535 14 apr 17:26 ubift_autopsy.py
The _internal directory contains many compiled Python libraries generated by pyinstaller.
I've noticed the user's python_modules directory looks a bit weird with the ^M in the file name. So far I have not been able to find where this is coming from. I tried renaming the directory without the ^M in the directory name, but without success. If I completely remove the ~/.autopsy directory it get's recreated with the ^M in the directory name again, so my suspicion is that it is coming from somewhere in the config or code.
I also read that the class file should be regenerated when restarting Autopsy when not present. I tried this, suspecting the Java version may be too old, but it is not regenerated after a restart.
Btw, the copy of the mtd block device can be read with the python ubift script without issues, so I know the image is not the problem.
Do you have any suggestions what I'm doing wrong and how I can get the plugin to work?
Hi,
I'm trying to use the Autopsy plugin, but I'm having trouble to get it to work.
OS: Arch Linux
Autopsy version: 4.22.1
What I have tried so far:
ubift_autopsy.pyandubift_autopsy$py.classto the user's python_modules directory (~/.autopsy/dev^M/python_modules).dist/ubift/directory generated by pyinstaller to user's python_modules directoryFor completeness the content of the user's python_modules directory looks like this:
The
_internaldirectory contains many compiled Python libraries generated by pyinstaller.I've noticed the user's python_modules directory looks a bit weird with the ^M in the file name. So far I have not been able to find where this is coming from. I tried renaming the directory without the ^M in the directory name, but without success. If I completely remove the ~/.autopsy directory it get's recreated with the ^M in the directory name again, so my suspicion is that it is coming from somewhere in the config or code.
I also read that the class file should be regenerated when restarting Autopsy when not present. I tried this, suspecting the Java version may be too old, but it is not regenerated after a restart.
Btw, the copy of the mtd block device can be read with the python ubift script without issues, so I know the image is not the problem.
Do you have any suggestions what I'm doing wrong and how I can get the plugin to work?