# Issue Running Autopsy, MacOSX (new)

**URL:** <https://sleuthkit.discourse.group/t/issue-running-autopsy-macosx-new/1100>\
**Category:** Autopsy on Linux / macOS\
**Created:** [April 21, 2020, 3:49pm UTC](https://sleuthkit.discourse.group/t/issue-running-autopsy-macosx-new/1100 "2020-04-21T15:49:36Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![kdow](https://avatars.discourse-cdn.com/v4/letter/k/a6a055/32.png) [@kdow](https://sleuthkit.discourse.group/u/kdow)\
**Post date:** [April 21, 2020, 3:49pm UTC](https://sleuthkit.discourse.group/t/issue-running-autopsy-macosx-new/1100/1 "2020-04-21T15:49:36Z")

</div>

Hi, this is my first time using a digital forensics tool and am encountering an error while running autopsy:

org.netbeans.InvalidException: StandardModule:org.sleuthkit.autopsy.core jarFile: /Users/Autopsy/autopsy-4.14.0/autopsy/modules/org-sleuthkit-autopsy-core.jar: java.lang.IllegalArgumentException: java.lang.reflect.InvocationTargetException

The docs say to check the version in the messages.log file (which I cannot find) but with a java -version command, this is my output:

openjdk version “1.8.0\_252”  
OpenJDK Runtime Environment (build 1.8.0\_252-b09)  
OpenJDK 64-Bit Server VM (build 25.252-b09, mixed mode)

It seems my version differs where “252-b09” should be “232-b10” and am unsure as to how to change versions.

Again, I’m very new to digital forensics and any help is appreciated.

---

<div class="post-metadata">

**Author:** ![downey](https://avatars.discourse-cdn.com/v4/letter/d/a87d85/32.png) [@downey](https://sleuthkit.discourse.group/u/downey)\
**Post date:** [April 21, 2020, 4:07pm UTC](https://sleuthkit.discourse.group/t/issue-running-autopsy-macosx-new/1100/2 "2020-04-21T16:07:29Z")

</div>

The InvocationTargetException is usually an indication that a later version of Java is being used.  
You should be able to find the messages.log file in ~/Library/Application Support/autopsy/dev/var/log.  
The first 20 lines or so of that log will tell you which version of Java is being used.

---

<div class="post-metadata">

**Author:** ![kdow](https://avatars.discourse-cdn.com/v4/letter/k/a6a055/32.png) [@kdow](https://sleuthkit.discourse.group/u/kdow)\
**Post date:** [April 21, 2020, 4:22pm UTC](https://sleuthkit.discourse.group/t/issue-running-autopsy-macosx-new/1100/3 "2020-04-21T16:22:20Z")

</div>

Thanks for your response!

Although I found that autopsy is not located in ‘Application Support’.

Assuming the version is newer (252), how would I go about downgrading to the required version (232)?

Again thank you, as I am a newbie to this.

---

<div class="post-metadata">

**Author:** ![downey](https://avatars.discourse-cdn.com/v4/letter/d/a87d85/32.png) [@downey](https://sleuthkit.discourse.group/u/downey)\
**Post date:** [April 21, 2020, 7:07pm UTC](https://sleuthkit.discourse.group/t/issue-running-autopsy-macosx-new/1100/4 "2020-04-21T19:07:33Z")

</div>

There should be no need to downgrade to 232. I’m running 252 on a Linux box just fine.  
What do the first ~20 lines of your messages.log file look like?

---

<div class="post-metadata">

**Author:** ![kdow](https://avatars.discourse-cdn.com/v4/letter/k/a6a055/32.png) [@kdow](https://sleuthkit.discourse.group/u/kdow)\
**Post date:** [April 21, 2020, 8:17pm UTC](https://sleuthkit.discourse.group/t/issue-running-autopsy-macosx-new/1100/5 "2020-04-21T20:17:54Z")

</div>

I do not see a folder named ‘autopsy’ under ‘Application Support’ and therefore cannot find messages.log.

---

<div class="post-metadata">

**Author:** ![John\_Lehr](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/john_lehr/32/45_2.png) [@John\_Lehr](https://sleuthkit.discourse.group/u/John_Lehr)\
**Post date:** [April 22, 2020, 2:35pm UTC](https://sleuthkit.discourse.group/t/issue-running-autopsy-macosx-new/1100/6 "2020-04-22T14:35:31Z")

</div>

If you try to use the brew sleuthkit package, you will receive the error. Despite the installation instructions for Mac, you need to build sleuthkit from source.

---

<div class="post-metadata">

**Author:** ![kdow](https://avatars.discourse-cdn.com/v4/letter/k/a6a055/32.png) [@kdow](https://sleuthkit.discourse.group/u/kdow)\
**Post date:** [April 22, 2020, 3:18pm UTC](https://sleuthkit.discourse.group/t/issue-running-autopsy-macosx-new/1100/7 "2020-04-22T15:18:20Z")

</div>

Ok, I believe I read that from another thread but am unsure **how to build sleuthkit from source vs using brew**.

I’m on Mac OS **Catalina** 10.15.4 using **zsh** shell (can change to **bash** if it helps).

Thanks for response, I am new to this.

---

<div class="post-metadata">

**Author:** ![kdow](https://avatars.discourse-cdn.com/v4/letter/k/a6a055/32.png) [@kdow](https://sleuthkit.discourse.group/u/kdow)\
**Post date:** [April 27, 2020, 2:13pm UTC](https://sleuthkit.discourse.group/t/issue-running-autopsy-macosx-new/1100/8 "2020-04-27T14:13:38Z")

</div>

I solved the issue by using the new docs you posted for Mac found in another thread:  
[https://slo-sleuth.github.io/tools/InstallingAutopsyOnMacOS.html](https://slo-sleuth.github.io/tools/InstallingAutopsyOnMacOS.html)

Thanks!!!
