[Tool] Autopsy 3.1 Released - Parallel Pipelines and Android

Did you adjust the number of pipelines by any chance? We suggest 2 less than the theoretical maximum for your hardware (this is the default). Otherwise, the UI can have difficulty accessing resources to do its updates (this is fine if you set it and forget it, but not ideal if you are trying to do interactive analysis). We've seen some behavior similar to what you describe if we have the pipelines turned up too high for our hardware.

Is there any DBX ingest module for Autopsy? Or is any development regarding one in the works? I'm writing a little tool to unpack MBOX/DBX/PST and since the DBX extraction is pretty easy I was considering porting it.

Not to our knowledge - but as long as you are writing a module, check out the development contest we are sponsoring for OSDFCon 2014 http//www.basistech.com/osdfcon-contest/

Not to our knowledge - but as long as you are writing a module, check out the development contest we are sponsoring for OSDFCon 2014 http//www.basistech.com/osdfcon-contest/

Thanks but I think I'll start looking into it after the contest is over just to be sure nobody else is working on it.

I was giving a quick look at the mail parser sources and saw that it also support PST parsing through libpst, is it a new 3.1 feature or is it still a work in progress?

Hi, yes, that is a new add-on for 3.1 so now MBOX and PST are supported

Hi, yes, that is a new add-on for 3.1 so now MBOX and PST are supported

That's for many the one most important feature ever added in the history of all features (it also supports OST files I think, though I didn't look deep into that), it's pretty unexpected that it wasn't mentioned anywhere. Most PSTs are permutative-encoded so their strings couldn't be easily found unless you decode all the bytes of the disk image (I think Encase has a special "codepage" for that).

Honestly, its been hanging around in develop for so long, it was an oversight that it wasn't mentioned on actual release. Our website has been updated now 😉

I've been trying to use it for the past year or so, but always receive this error

JVM Creation Failed

Anyone else have this problem? Their wiki solution did not work.

Hi Marc - just wanted to let you know there is a support forum and users list on sleuthkit where the user community can help answer these questions. http//forum.sleuthkit.org/

It probably makes sense to get some more details on your environment in order to help you, but I would suggest continuing the conversation on the dedicated forum for Autopsy support.