iped-seach with wine

[paulobreim]

Today I did the following test:
I took the folder of an indexed case in windows, along with the image and copied it to a folder in Linux.
I ran the IPED-SearchApp with wine and it worked perfectly,
I still need to improve the resolution, which must be some configuration in wine.

[patrickdalla]

iped should already be able to run in linux without wine. Even if the case was indexed on windows Em qua., 12 de jul. de 2023 14:41, Paulo Cesar Breim (PCB) < ***@***.***> escreveu:

…

Today I did the following test: I took the folder of an indexed case in windows, along with the image and copied it to a folder in Linux. I ran the IPED-SearchApp with wine and it worked perfectly, I still need to improve the resolution, which must be some configuration in wine. — Reply to this email directly, view it on GitHub <#1766>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AG247S2EAYD2EURZ37VGCH3XP3VTZANCNFSM6AAAAAA2H4IPJQ> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

[paulobreim]

But needs compatible java, right?
Mine I got
Error: A JNI error has occurred, please check your installation and try again
Exception in thread "main" java.lang.UnsupportedClassVersionError: iped/app/bootstrap/BootstrapUI has been compiled by a more recent version of the Java Runtime (class file version 55.0), this version of the Java Runtime only recognizes class file versions up to 52.0

I never know what version needs to use because each app want a different java.

Available Java environments:
java-11-graalvm-ee
java-11-graalvm-ee.old
java-11-openjdk
java-20-jdk
java-20-openjdk
java-7-openjdk
java-7-openjdk.old
java-8-graalvm
java-8-openjdk (default)

I tried with 11 which seems more compatible, but it complained the must set tskJarPath in LocalConfig.txt!

[patrickdalla]

it is embedded with the correct jre version. you have to call java from there $CASE_PATH/iped/jre/java Em qua., 12 de jul. de 2023 21:36, Paulo Cesar Breim (PCB) < ***@***.***> escreveu:

…

But needs compatible java, right? Mine I got Error: A JNI error has occurred, please check your installation and try again Exception in thread "main" java.lang.UnsupportedClassVersionError: iped/app/bootstrap/BootstrapUI has been compiled by a more recent version of the Java Runtime (class file version 55.0), this version of the Java Runtime only recognizes class file versions up to 52.0 I never know what version needs to use because each app want a different java. — Reply to this email directly, view it on GitHub <#1766 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AG247S7OYLN3JVZBJ6KMXVDXP5GI3ANCNFSM6AAAAAA2H4IPJQ> . You are receiving this because you commented.Message ID: ***@***.***>

[paulobreim]

Good! Thank you. I changed the path and now we have one step more.

Can you help me?

tks

[thiagofuer]

Another option to run iped on linux is to use the Docker
https://github.com/sepinf-inc/IPED/wiki/Linux#iped-docker

[paulobreim]

Tks, I will try it.

[paulobreim]

@thiagofuer success. now it is working well.

There is only one other problem but it is not related to javafx.
pdf, ppt, docx files, when selected, do not appear in preview, but sofficebin is called and opens a window showing.
The .eml files do not appear in the preview and double-clicking does not open them either.
I still need to research why this is happening.

But thanks a lot for the help.

[lfcnassif]

There is a solution for embedding LibreOffice viewer in https://github.com/sepinf-inc/IPED/wiki/Linux

About EML files, if HEX viewer shows nothing, probably you lost the reference to the processed evidence.

[paulobreim]

Well, javafx was solved with the installation of liberica JDK.
I thought that sleuthkit questions were only needed for indexing, I didn't realize that search also used them.

But see what a curious thing.

1 - When I run iped-search on linux, the resulting search files are shown (pdf, ppt, doc, xlsx, eml, etc) in the center screen result, normally.

2 - When I click on a pdf it appears in preview, and double clicking my pdf viewer opens the file normally, this is the expected behavior.

3 - When I click on an office file (ppt, doc, xlsx) , the preview panel does not show the document, the screen is blank, but HEX, TEXT, METADATA are correct. It also automatically opens soffice.bin and shows the document, if I click twice it opens libreoffice. I also noticed that the console displays the message LibreOffice viewer may not work properly. Set environment var SAL_USE_VCLPLUGIN='gen'

4 - Regarding the eml, the behavior is similar, it does not appear in the preview, but HEX, TEXT, METADATA are correct. If I click twice, nothing happens.
But if the eml is an attachment of another eml (which does not open) it shows normally and if I click twice it opens my thunderbird.
Files in .msg format appear in preview normally.

5 - Finally I did the following test:
I accessed windows through virtual box, mapped the linux folder with the case inside it.
Then I ran the iped-search.exe and everything works normally.

paulo

[paulobreim]

I did one test more using iped docker, and still I can´t see eml files when run iped-search. If I export this file, the size is zero.
This occurs only with eml, if the file has the station .msg, the email shows well.

[lfcnassif]

Hi @paulobreim. EML not working while MSG (or HTML) is working makes no sense to me. Please apply "Container Subitems"/"Subitens de Conteineres" filter and try to view some EML file. If it works, EML viewer is fine. After that, apply "Actual Files"/"Arquivos Ativos" filter and try to view any other file type, like MSG or HTML. If it does not work and Hex Viewer is empty, seems the issue is the original source evidence not being found, as I said before.

[lfcnassif]

If it's the case, the analysis UI should ask for the new evidence location, maybe that's not working on Linux. If so, your case IPED-SearchApp.log would help.

[paulobreim]

Hi @lfcnassif, using "Container Subitems"/"Subitens de Conteineres" I can view EML files, but with filter "Actual Files"/"Arquivos Ativos", no.
And you are right, the analysis UI asked for the new evidence location and even providing the new location, it doesn't find the .eml. BUT that happened because I was using the result of an indexing done in windows and copied to linux.

To be sure.
I tested everything again by processing the indexing in windows and copied it to Linux.
I need to change 2 things to search start:
1 - Inform the path in tskJarPath in LocalConfig.txt
2 - Put something in phone-region, for example pt, in the GraphConfig.json file

Running ipedsearch (inside doker) it asks where the image file is, I provide the new location.
The search can´t shows .eml files.

Conclusion
if the process is indexed on windows, a search cannot be used by copying these files to linux.

I can do more tests because the environment is preserved and the suspect file is a mass with emails, it doesn't have dd and the like, it takes 2 minutes to index.

Finally indexing on linux search works correctly.

[lfcnassif]

if the process is indexed on windows, a search cannot be used by copying these files to linux.

Although this seems an uncommon use case to me, this seems a bug we could try to fix. Maybe it is related to different file separators on those systems.

[lfcnassif]

@arisjr does your team have this use case sometimes and had this issue happened to you guys?

[arisjr]

We only use linux container to {windows,linux}

We don't have this scenario here, but indeed, since graph adoption on IPED, we adjust GraphConfig before executing the container, because "auto" doesn't work on linux.

[paulobreim]

It's really not a common usage. I can help with compatibility testing.
In this specific case, I wanted to do research on my computer, which is a Manjaro, but the two machines I use to index (Two Dell T630) with Windows, and the "suspect" was just emails, so and 2 minutes it indexed everything.

tks
paulo