Previously Loaded Plaso Module could not be found
Tami-M22 opened this issue · 3 comments
Trying to run Project vic hash ingest module and receive the message above. I tried repairing the Autopsy install, reloaded the Autopsy Python Plugins, redownloaded and copied files to Plaso folder, moving the Json and local db folder in Project vic options. nothing is working. Do I need to install a previous version of something?
One thing to try is to go into the following directory, I will use my directory as an example, you can change the user to yours
C:\Users\markm\AppData\Roaming\autopsy\config\IngestModuleSettings
You may have multiple directories here for example I have org.sleuthkit.autopsy.casemodule.AddImageWizardIngestConfigPanel and org.sleuthkit.autopsy.ingest.RunIngestModulesDialog
You will need to go into both directories and delete the following file org.python.proxies.Plaso* or something similar as it will have the module name in it and I do not recall what it should actually be. If you want to delete all the org.python.proxies that is fine to as they will just be recreated next time you run Autopsy. Let me know if you have any issues with this.
I deleted all org.python.proxies in the config file for the ingest modules, but got the same result after restarting the program. I also turned off windows defender as it seemed to be trying to prevent certain files from executing or being accessed. Any other thoughts?
It also appears that it's not parsing the Project Vic hash databases and gives the following error: java.lang.illegalStateException: Expected a name but was BEGIN-ARRAY at line 2 column 115
Are these two errors related?
@Tami-M22 let us know if you are still having issues with the latest version of Autopsy.