Pré-visualização do WhatsApp Chat indisponível

[dafeol]

Realizamos uma indexação, porém após finalizada percebemos que ao clicar em qualquer um dos chats de whatsapp, não é exibida a pré-visualização do iPed, sendo necessário executar o arquivo para que seja aberto no navegador, o que nos impossibilita de clicar em arquivos de mídia para a visualização deste dado no contexto do diálogo. Diante disto gostaria de saber se o erro pode ter sido gerado em alguma configuração errada antes de realizar a indexação ou é por falta de algum plugin ou atualização do próprio computador que está executando a indexação

[wladimirleite]

Hi @dafeol!
If you are able to open the chat visualization with a double-click (in the browser), it means that processing was fine.
Probably there is an exception in the analysis application log (IPED-SearchApp.log) that should help identifying what is causing the issue.
Take a look at the log file or attach it here (remove any sensible information before sharing it).

[wladimirleite]

No, I meant to delete (or rename) the log in the case folder, so we have a minimal but complete log.

[dafeol]

The most complete version I could find, removing sensitive information. See if analysis is now possible:

IPED-SearchApp.log

[wladimirleite]

It seems that the relevant stack trace is:

java.lang.NullPointerException
	at iped.engine.lucene.DocValuesUtil.getOrd(DocValuesUtil.java:41)
	at iped.app.ui.viewers.AttachmentSearcherImpl.lambda$updateSelectionCache$0(AttachmentSearcherImpl.java:140)
	at java.base/java.util.stream.ForEachOps$ForEachOp$OfInt.accept(Unknown Source)
	at java.base/java.util.stream.IntPipeline$4$1.accept(Unknown Source)
	at java.base/java.util.BitSet$1BitSetSpliterator.forEachRemaining(Unknown Source)
	at java.base/java.util.Spliterator$OfInt.forEachRemaining(Unknown Source)
	at java.base/java.util.stream.AbstractPipeline.copyInto(Unknown Source)
	at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(Unknown Source)
	at java.base/java.util.stream.ForEachOps$ForEachOp.evaluateSequential(Unknown Source)
	at java.base/java.util.stream.ForEachOps$ForEachOp$OfInt.evaluateSequential(Unknown Source)
	at java.base/java.util.stream.AbstractPipeline.evaluate(Unknown Source)
	at java.base/java.util.stream.IntPipeline.forEach(Unknown Source)
	at iped.app.ui.viewers.AttachmentSearcherImpl.updateSelectionCache(AttachmentSearcherImpl.java:137)
	at iped.viewers.HtmlLinkViewer.loadFile(HtmlLinkViewer.java:136)
	at iped.viewers.api.AbstractViewer.loadFile(AbstractViewer.java:112)
	at iped.viewers.MultiViewer.loadFile(MultiViewer.java:108)
	at iped.app.ui.ViewerController.loadInViewer(ViewerController.java:328)
	at iped.app.ui.ViewerController.updateViewer(ViewerController.java:294)
	at iped.app.ui.ViewerController.loadFile(ViewerController.java:257)
	at iped.app.ui.FileProcessor.process(FileProcessor.java:180)
	at iped.app.ui.FileProcessor.doInBackground(FileProcessor.java:133)
	at iped.app.ui.FileProcessor.doInBackground(FileProcessor.java:51)
	at java.desktop/javax.swing.SwingWorker$1.call(Unknown Source)
	at java.base/java.util.concurrent.FutureTask.run(Unknown Source)
	at java.desktop/javax.swing.SwingWorker.run(Unknown Source)
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
	at java.base/java.lang.Thread.run(Unknown Source)

Looking at the code, it seems sdv = App.get().appCase.getAtomicReader().getSortedDocValues(BasicProps.HASH) is null.
Not sure how can this happen.
Did you use any non-standard configuration?

Is there any checked items in the case?
If there are, you may try to add the to a temporary bookmark (if you want to check them again later), clear all check items, reopen the analysis application and see if it makes any difference (i.e. if WhatsApp chats can be viewed and if there are any errors in the end of the log).

[lfcnassif]

Not sure how can this happen.
Did you use any non-standard configuration?

Maybe hash computation was disabled before processing?

[dafeol]

Is it possible that the error occurred because the indexing was performed without enabling the SHA256 HASH calculation option? Because the error message included:

2025-10-30 15:29:51 [WARN] [parsers.mail.OutlookDBXParser] DBX parser not found, DBX mailboxes will NOT be expanded.

2025-10-30 15:29:51 [ERROR] [parsers.whatsapp.WhatsAppParser] SHA-256 is disabled. WhatsAppParser needs it to link attachments to chats!

2025-10-30 16:12:03 [ERROR] [parsers.whatsapp.WhatsAppParser] Error parsing WhatsApp: Item: nuvem/1835796-BACKUP-28872904.zip>>22274706871/1835796/[email protected]/backup/D_c975cc5bc6ead99d3b111512dcc63e06171b5912/S_FD5856DA-2233-4831-8C26-1DE346C77A6A/F_1D1C81E6-6B32-4CD9-9873-10224588C652_WZyxyItv6pOF18RMumc6hLY59fQ=_35449_bz__w>>F_1D1C81E6-6B32-4CD9-9873-10224588C652_WZyxyItv6pOF18RMumc6hLY59fQ=_35449_bz__w type: sqlite size: 143360 org.apache.commons.io.TaggedIOException: Stream closed at org.apache.commons.io.input.TaggedInputStream.handleIOException(TaggedInputStream.java:93) ~[commons-io-2.16.1.jar:2.16.1] at org.apache.commons.io.input.ProxyInputStream.read(ProxyInputStream.java:224) ~[commons-io-2.16.1.jar:2.16.1] at java.io.InputStream.transferTo(Unknown Source) ~[?:?] at java.nio.file.Files.copy(Unknown Source) ~[?:?] at org.apache.tika.io.TikaInputStream.getPath(TikaInputStream.java:682) ~[tika-core-2.4.0-p1.jar:2.4.0] at org.apache.tika.io.TikaInputStream.getPath(TikaInputStream.java:655) ~[tika-core-2.4.0-p1.jar:2.4.0] at org.apache.tika.io.TikaInputStream.getFile(TikaInputStream.java:716) ~[tika-core-2.4.0-p1.jar:2.4.0] at iped.parsers.whatsapp.WhatsAppParser.parseWhatsAppContacts(WhatsAppParser.java:1218) ~[iped-parsers-impl-4.2.2.jar:?] at iped.parsers.whatsapp.WhatsAppParser.parse(WhatsAppParser.java:263) [iped-parsers-impl-4.2.2.jar:?] at org.apache.tika.parser.CompositeParser.parse(CompositeParser.java:298) [tika-core-2.4.0-p1.jar:2.4.0] at iped.parsers.standard.StandardParser.parse(StandardParser.java:245) [iped-parsers-impl-4.2.2.jar:?] at iped.engine.io.ParsingReader$BackgroundParsing.run(ParsingReader.java:247) [iped-engine-4.2.2.jar:?] at java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source) [?:?] at java.util.concurrent.FutureTask.run(Unknown Source) [?:?] at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) [?:?] at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) [?:?] at java.lang.Thread.run(Unknown Source) [?:?] Caused by: java.io.IOException: Stream closed at java.io.BufferedInputStream.getBufIfOpen(Unknown Source) ~[?:?] at java.io.BufferedInputStream.read(Unknown Source) ~[?:?] at org.apache.commons.io.input.ProxyInputStream.read(ProxyInputStream.java:220) ~[commons-io-2.16.1.jar:2.16.1] ... 15 more 2025-10-30 16:12:03 [WARN] [engine.task.ParsingTask] ParsingThread-1 SAX error while extracting subitem nuvem/1835796-BACKUP-28872904.zip>>22274706871/1835796/[email protected]/backup/D_c975cc5bc6ead99d3b111512dcc63e06171b5912/S_FD5856DA-2233-4831-8C26-1DE346C77A6A/F_1D1C81E6-6B32-4CD9-9873-10224588C652_3etyztCFulmftNnOYkddd4jLDpI=_70709_atte>>F_1D1C81E6-6B32-4CD9-9873-10224588C652_3etyztCFulmftNnOYkddd4jLDpI=_70709_atte>>ABPersonFullTextSearch_segments org.apache.tika.sax.TaggedSAXException: Error writing: ABPersonFullTextSearch_segments org.xml.sax.SAXException: Error writing: ABPersonFullTextSearch_segments java.io.IOException: Pipe closed