FileHistory plugin creating an empty SQLight database

[write-enabled]

The file_history table referenced in SQL_Statement in file Parse_FileHistory.py does not exist, so no artifacts can be extracted.

I'm using Autopsy 4.22.1 on Windows 11 (64 bit).

[write-enabled]

Interestingly, the file_history table and a populated SQLight database are created when using Autopsy 4.22.1 on Windows 10 (64 bit) if Catalog1.edb is also created using Windows 10. However, a "No artifact type found" error during the analysis stage prevents the display of the artifacts.

Even small Catalog1.edb files produced by Windows 11 File History backup cannot be converted to a populated SQLight database by the FileHistory plugin on Windows 10. This makes me suspect that Window File History backup has regressed in Windows 11.

autopsy.log

[markmckinnon]

Currently there is an issue with the Windows 11 Catalog1.edb ESEDB file that cannot be parsed. When I try and read the Catalog1.edb file I get an error that there is an invalid page. I will see what I can come up with for a solution.

[markmckinnon]

@write-enabled I have a solution I would like you to try. DM me, and we can see if the solution works.

[write-enabled]

Hi Matk, Thanks for your quick response. Windows File History backup has never worked properly for me since upgrading to Windows 11 last September. Your Autopsy File History plugins can help to make the configuration file more transparent so that problems are easier to identify. I’ve been working through the Autopsy tutorials and would be happy to try out your solution. Regards, David Baker WRITE-ENABLED LTD From: Mark McKinnon ***@***.***> Sent: 23 January 2026 19:10 To: markmckinnon/Autopsy-Plugins ***@***.***> Cc: write-enabled ***@***.***>; Mention ***@***.***> Subject: Re: [markmckinnon/Autopsy-Plugins] FileHistory plugin creating an empty SQLight database (Issue #57) markmckinnon left a comment (markmckinnon/Autopsy-Plugins#57) <#57 (comment)> @write-enabled <https://github.com/write-enabled> I have a solution I would like you to try. DM me, and we can see if the solution works. — Reply to this email directly, view it on GitHub <#57 (comment)> , or unsubscribe <https://github.com/notifications/unsubscribe-auth/B4XOKZVRHVY7KSHDE3JZAT34IJWYNAVCNFSM6AAAAACRSG65MSVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTOOJRHA3TKNBYHE> . You are receiving this because you were mentioned.Message ID: ***@***.***>