Has anyone been able to get Autopsy to work on the new Mac M2 chip ARM architecture? I tried following the steps here https://slo-sleuth.github.io/tools/InstallingAutopsyOnMacOS.html with some differences like accounting for the upgrade to Java 17 but have been unsuccessful. Has anyone had luck with this?
Did you make any progress?
The link you gave looks helpful, but I’m stuck too, with TSK (13) too I get …
Features:
Java/JNI support: no
Multithreading: yes
So cannot get Autopsy to function. Any ideas?
Thought it might be a JAVA_HOME issue, but not solved it yet.
I have just created a new script that I was able to get working for installing Autopsy on macOS Tahoe. I would love for users to test it out and provide feedback on how it works and if there are changes that need to be made to it. You can download the script from here install_macos_autopsy_aarch64.sh. All you need to do is chmod it to execute it and then execute it. It will install all the prereq’s for Autopsy and then download Autopsy and put it in the applications folder so that you can then run Autopsy from the there. Please let me know any feedback.
Has anyone tested this out yet and any feedback?
@Mark_McKinnon Your script did manage to install autopsy for me, although I needed to manually run the steps starting at “Linking Libraries”
Running autopsy gives a few errors
aLEAPP, iLEAPP and YARA only work on windows → expected
Could there be solutions to these? PhotoRec is installed, I verified via cli so I think autopsy is looking in the wrong place
Embedded FileExtractor: Unable to initialize 7Zip libraries
PhotoRec Carver: Unable to locate PhotoRec executable
Update:
env PATH=“/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin” open -a Autopsy opening Autopsy this way fixed the PhotoRec ingest module error
Apparently GUI apps in macos don’t automatically get access to PATH variables?
@coder54321 I can take a look at why Photorec is not working. As for the 7zip issue, until they update the library there is nothing that can be sone about it. At some point aLeapp and iLeapp can be updated so that it works on macOS. Will have to look at Yara to see what would be needed to build it. If there is anything else that has issues please let me know.
Mark
I’m new to these commands. What do I have to do in this step exactly?
From the terminal type the following command. chmod 755 install_macos_autopsy_aarch64.sh
After that just run the script.
Hi @Mark_McKinnon ! I successfully installed autopsy with your script, thanks! however, the Timeline is disabled… Is there a way to fix that?
What version of Java do you have installed? How did you install Java, ie: what commands. That error could mean that JavaFX is not installed.
Hi! thanks for answering so quickly.
I first tried installing autopsy with the official instructions for macOS (using their scripts, which call brew, to install openjdk@17) but after some unsuccesfull attempts, i uninstalled al those packages and ran your script. I now have:
$ /usr/libexec/java_home -v 17
/Library/Java/JavaVirtualMachines/liberica-jdk-17-full.jdk/Contents/Home
I went back and looked at my notes, and something is going on that disables Timeline. In the minimal testing I did to get this script to work, here is what I found that does not work or needs to be looked into:
- Embedded File Extractor - 7 zip bindings need to support Apple Silicon and they do not yet
- Bitlocker - Will not work, only windows
- Plaso - Will not work
- Object Detection, only windows feature
- iLeapp - Just need to compile version of Apple Silicon and then add some code to module
- aLeapp - Just need to compile version of Apple Silicon and then add some code to module
- Yara - Just need to compile version of Apple Silicon and then add some code to module
- Recent Activity - WebHistory - Will not process Webcache file as it uses nirsofts esedb viewer program to process it and it only runs on windows. Might be able to substitute this, will have to test.
- Recent Activity - WebCookies - Will not process Webcache file as it uses nirsofts esedb viewer program to process it and it only runs on windows. Might be able to substitute this, will have to test.
- Portable Case - Will not be able to compress it as it is Windows only feature
- Recent Activity - Recycle Bin Analyzer - NPE - Need to investigate it
- Timeline has some issue that disables it.
- GPS Ingest module does not report the correct number of artifacts - Need to investigate this.
- Metadata Artifact does not have the correct counts - Need to investigate this.
- Extension mismatch counts are off - Need to investigate this.
- EXIF Metadata counts are off. Need to investigate this
- Supported Types Drop down box does not show VHD as it does in Windows, need to investigate this.
Kind regards.
Mark