Autopsy Core unable to activate after installation in Linux

Autopsy Help
#1

Hi Everyone,

I am receiving an error when trying to activate Autopsy-Core (after install).

The situation is this:
1 - Install instructions followed for Linux - I am running Running Mint
2 - ./bin/autopsy starts and presents the User Interface but no functionality
3 - Goto Plugins menu option and attempt to activate the Autopsy-Core module.

Get the error:
Activation failed: StandardModule.org.sleuthkit.autopsy.core jarfile: /home/xxxx/autopsy-4.14.0/autopsy/modules/org-sleuthkit-autopsy-core.jar: java.lang.UnsatisfiedLinkError: /tmp/libtsk_jni_xxxx.so: libvmdk.so.1: cannot open shared object file: No such file or directory

Output of About:
Product Version: Autopsy 4.14.0
Java: 1.8.0_252; OpenJDK 64-Bit Server VM 25.252-b09
Runtime: OpenJDK Runtime Environment 1.8.0_252-b09
System: Linux version 4.15.0-55-generic running on amd64; UTF-8; en_GB (autopsy)
User directory: /home/XXXX/.autopsy/dev
Cache directory: /home/xxxx/.autopsy/dev/var/cache

also

$JAVA_HOME: /usr/lib/jvm/bellsoft-java8-full-amd64
(xxxx = user home dir & username)

Any help or pointers greatly appreciated :slight_smile:

Shamus

#2

Try deleting the /home/xxxx/.autopsy folder and starting Autopsy again.

1 Like
#3

Thanks Downey - I tried this and the startup process hung giving me the following notificatiom:

org.netbeans.InvalidException: StandardModule:org.sleuthkit.autopsy.core jarFile: /home/xxxx/autopsy-4.14.0/autopsy/modules/org-sleuthkit-autopsy-core.jar: java.lang.UnsatisfiedLinkError: /tmp/libtsk_jni_xxxx.so: libvmdk.so.1: cannot open shared object file: No such file or directory

Is there anything else I could try at all?

Many thanks,

Shamus

#4

Looks like it might be missing libvmdk???
What do you see when you run the following commands?

apt-cache depends sleuthkit-java
apt -qq list vmdk

#5

Dear Downey,

Thank you for continued help -
apt-cache depends sleuthkit-java returns
E: No packages found

I couldn’t get the second command to execute so did this:

xxxx@ht-Compaq-15-Notebook-PC ~ $ apt list --installed | grep vmdk

WARNING: apt does not have a stable CLI interface. Use with caution in scripts.

libvmdk-dbg/xenial,now 20160119-2 amd64 [installed]
libvmdk-dev/xenial,now 20160119-2 amd64 [installed]
libvmdk-utils/xenial,now 20160119-2 amd64 [installed]
libvmdk1/xenial,now 20160119-2 amd64 [installed,automatic]
python-libvmdk/xenial,now 20160119-2 amd64 [installed]
xxxx@ht-Compaq-15-Notebook-PC ~ $

I have tried, given your suggestion to install libvmdk with synaptic. I also deleted the .autopsy file before attempting to run Autopsy again. I get exactly the same error.

Best,

Shamus

#6

I don’t have Linux Mint so I’m somewhat winging it here…
I find it odd that the apt-cache command returns “No packages found” for “sleuthkit-java”. Below is a screenshot of what I get when I run the same command on Ubuntu.
In the second command that you ran (i.e. apt list) what do you get if you replace “vmdk” with “sleuthkit”?

image

#7

Dear Downey,

I am not sure if this helps but now, whenever I start a terminal within the Cinnamon Desktop I get this line just before the bash prompt:

bash: /usr/libexec/java_home: No such file or directory

In terms of your last question I get:

bash: /usr/libexec/java_home: No such file or directory
xxxx@ht-Compaq-15-Notebook-PC ~ $ apt list --installed | grep sleuthkit

WARNING: apt does not have a stable CLI interface. Use with caution in scripts.

sleuthkit/xenial,now 4.2.0-3 amd64 [installed,automatic]

As always I am grateful for your help

Shamus

#8
  1. If there is no /usr/lib/exec/java_home on your platform you will need to use a different mechanism to set the JAVA_HOME environment variable. e.g. export JAVA_HOME=/usr/lib/jvm/bellsoft-java8-full-amd64
  2. You don’t appear to have the Sleuthkit Java bindings installed. Did you follow these steps from Running_OSX_Linux.txt?
  • Install The Sleuth Kit Java Bindings *

Autopsy depends on a specific version of The Sleuth Kit. You need the Java libraries of The Sleuth Kit installed, which is not part of all packages.

  • Linux: Install the sleuthkit-java.deb file that you can download from github.com/sleuthkit/sleuthkit/releases. This will install libewf, etc. For example:
    – % sudo apt install ./sleuthkit-java_4.8.0-1_amd64.deb
#9

@downey, hopefully you got everything figured out. I’m not sure if sometimes the version of Linux may affect whether it works or not or how to properly remediate, but feel free to yell out if things don’t continue to work or troubleshooting has varying results.