OSF crashing

[plebe]

OSF crashes/closes automatically when scanning.

[David (PassMark)]

From the log it looks like you were running a User Activity scan in OSF V10 build 1014 on a live Win10 system and it stopped while collecting the Auto-run commands. Correct?

Was there also a crash dump file?

Can you confirm this module was the problematic one, by just running it by itself.

[plebe]

Tried downgrading and it still happens.

[plebe]

It just randomly closes/crash?
https://streamable.com/vc6rwq

[Simon (PassMark)]

Can you try running this build in debug mode with some extra debugging where we suspect the crash is occurring, reproduce the crash and send us the logs:
https://www.passmark.com/downloads/t...g_20230705.exe

[plebe]

Here is the logs using the exe that you gave me and I ran it on debug mode.

[Dimiter (PassMark)]

We've made a new release with changes designed to address the issue you describe above.

Please try this build of OSForensics (build 1015) and let us know whether it does.

https://www.osforensics.com/download.html

[dfir_guy01]

Hello,
I am having the same issue during a User Activity quick scan. The app just quietly crashes; no messages. I am running the latest version(1015).

Windows Application Event log data
---
Faulting application name: osf64.exe, version: 10.0.1015.0, time stamp: 0x64b76b29
Faulting module name: osf64.exe, version: 10.0.1015.0, time stamp: 0x64b76b29
Exception code: 0xc0000409
Fault offset: 0x0000000002d33150
Faulting process ID: 0x14a0
Faulting application start time: 0x01d9efbbc91edff8
Faulting application path: C:\Program Files\OSForensics\osf64.exe
Faulting module path: C:\Program Files\OSForensics\osf64.exe
Report ID: 5e6004ad-bbc8-4fe7-aa2b-03785fd66b4a
Faulting package full name:
Faulting package-relative application ID:
---

I cannot upload a debug log due to 1.9MB upload limit. My debug log is 3.5MB

[Richard (PassMark)]

I am having the same issue during a User Activity quick scan. The app just quietly crashes; no messages. I am running the latest version(1015).

...

I cannot upload a debug log due to 1.9MB upload limit. My debug log is 3.5MB

You can email in your debug log and if there is a crash dump generated (.dmp) you can Zip it and attach it as well to the email.

[dfir_guy01]

Hey. Thanks for the quick response!
What email should I use?

I have also narrowed it down. I disabled all of the scan options, enabled one at a time, then scanned, until it failed. It is only when you enable the "Event Logs" scan that everything crashes. All the other scan options work.

[Simon (PassMark)]

You can send your logs to: help@passmark.com
Can you run only the 'Event Logs' scan when generating the logs? Thanks

[dfir_guy01]

Hello,
The log file with just "Event Logs" check is much smaller, so I can upload that here.

[David (PassMark)]

Would it be possible to get a copy of this file.
\Windows\System32\winevt\Logs\System.evtx

Email details are here