diff --git a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractRegistry.java b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractRegistry.java index 6f40e20af9a8533d2cd8260cb94d0c8155800f04..7045ce6811a54b3f8cc2a3453340ffadc371f8ec 100644 --- a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractRegistry.java +++ b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractRegistry.java @@ -416,6 +416,14 @@ private void analyzeRegistryFiles(long ingestJobId) { // delete the hive regFileNameLocalFile.delete(); } + + // RA can be run on non-window images. We are going to assume that + // the data source was from windows if there was registry files. + // Therefore we will only create the OSInfo object if there are + // registry files. + if(allRegistryFiles.size() > 0) { + osInfo.createOSInfo(); + } try { if (logFile != null) { @@ -1976,8 +1984,6 @@ public void process(Content dataSource, DataSourceIngestModuleProgress progressB progressBar.progress(Bundle.Progress_Message_Analyze_Registry()); analyzeRegistryFiles(context.getJobId()); - - osInfo.createOSInfo(); } /**