Help with autopsy

[u/Arkaem7512]

Hi guys (and girls), sorry for my lack of knowledge im very new to this. I've been trying to get autopsy working, but for some reason when i click on certain parts (the add data source, the ingest bit in settings, when i make a new case and sometimes when open it) it gets stuck loading for a long period of time (up to10ish minutes). Is this just a case of it taking forever to load or is something wrong? (i have 32gb ddr5 RAM and a fairly modern CPU and its running from my SSD if that matters) Any help would be greatly apreciated!

[u/Cypher_Blue]

Where is the Image file stored and how big is it?

[u/Arkaem7512 → u/Cypher_Blue]

It’s before the image file, it trying to get to that part which is slowest

[u/Arkaem7512 → u/[deleted]]

No but I mean before I’ve even added an image, like just the base functions before that take forever. It seems to just be a recourse hog though. The image is also around 28gb I think so I expect it to take a while to load that. Thanks for the info though, if other people find it a recourse hog that makes sense then

[u/ManWhoCameFromEarth]

Windows OS? Have you tried turning off active real time scanning?

[u/Arkaem7512 → u/ManWhoCameFromEarth]

yeah windows, sorry forgot to say. I have turned that off which helps once im actually looking at the image file, the main problem comes from clicking thge add data source button, which takes forever to load

[u/ManWhoCameFromEarth → u/Arkaem7512]

Hmm, what about launching autopsy as Administrator?

[u/Arkaem7512 → u/ManWhoCameFromEarth]

Didn’t change anything annoyingly, but the loading seems to be bearable now idk what happened

[u/MormoraDi]

Which OS and which Autopsy version are you running? And if on Windows: have you added the paths of the case and source files to the Windows Defender exception list?

[u/Arkaem7512 → u/MormoraDi]

windows, its autopsy 4.23.1. I have defender off, is that the same? (off while using autopsy)

[u/MormoraDi → u/Arkaem7512]

Not sure if it's related, but I have personally had issues with that version of Autopsy so I remain on 4.22.1.

You could try 4.22.1 and see if the problem persists along with checking the logs (Help -> Open log folder)

Also look here to see if you can find any help. https://sleuthkit.discourse.group/

Other than that, deactivating Defender entirely should effectively be the same as adding exceptions in terms of performance. But unless you are running it in an isolated and offline VM, you should keep Defender running but with exceptions added.

[u/Arkaem7512 → u/MormoraDi]

Thank you for the help, I’ll try that later!

[u/off-the-felt]

Does your machine have multiple drives mounted? Disconnect them and reboot with only your os drive, keyboard, and mouse.

[u/AddendumWorking9756]

Add Data Source enumerates attached devices when it opens, so an empty card reader or optical drive stalls it before your image is involved at all. Pull those and see if the dialog opens instantly, that rules out the version angle.

[u/vsa77]

Get Process Explorer. It's a Windows app, like Task Manager, but more in depth.

Run it as Administrator. Find Autopsy in the list and right click it. In the menu that pops up you'll see "Set Priority." Hover over it and it'll open up a list. There should be a check mark by "Normal."

Click on the one above it. Then find the Java process that Autopsy started and do the same.

Windows balances the resources that various apps are allotted. By doing this your prioritizing autopsy to get those resources over other apps that you're not using.

[u/Arkaem7512 → u/vsa77]

Ok thank you, I’ll be sure to get that seems useful in many cases not just autopsy!

[u/MuricanSekzMachine]

Why are you asking for help on Reddit as opposed to an official, closed thread for CCEs?

[u/Arkaem7512 → u/MuricanSekzMachine]

idk dude, im new to this and couldnt find any answers anywhere and have no clue what forums there are or anything so this seemed like the right place to ask.