Unable to get autopsy to start on MAC v 10.14.6

Jeff · April 23, 2020, 6:44am

Last week I installed autopsy and everything went well until I tried launching it. The program came up but had the following error:

org.netbeans.InvalidException: StandardModule:org.sleuthkit.autopsy.core jarFile: /Users/jeffreyschwartz/Downloads/autopsy-4.14.0/autopsy/modules/org-sleuthkit-autopsy-core.jar: java.lang.UnsupportedClassVersionError: org/sleuthkit/datamodel/SleuthkitJNI has been compiled by a more recent version of the Java Runtime (class file version 57.0), this version of the Java Runtime only recognizes class file versions up to 52.0

I clicked OK or something, I do not remember what, and the program loaded except that there was no words inside of the window. After that, the window opened but no text.

Using my motto, a little bit of knowledge is dangerous, researched, and tried to fix the issue basically by downloading Sluthkit from the source. Now when I try to start the program it starts, I see the logo and then a blank white box which crashes and disappears.

Below is everything from the initial install.

jeffreyschwartz@jeffreys-MacBook-Pro:~$ java -version
openjdk version “1.8.0_242”
OpenJDK Runtime Environment (build 1.8.0_242-b07)
OpenJDK 64-Bit Server VM (build 25.242-b07, mixed mode)

Install of programs

jeffreyschwartz@jeffreys-MacBook-Pro:~ brew install testdisk Warning: testdisk 7.1 is already installed and up-to-date To reinstall 7.1, run `brew reinstall testdisk` jeffreyschwartz@jeffreys-MacBook-Pro:~ brew tap bell-sw/liberica
==> Tapping bell-sw/liberica
Cloning into ‘/usr/local/Homebrew/Library/Taps/bell-sw/homebrew-liberica’…
remote: Enumerating objects: 201, done.
remote: Counting objects: 100% (201/201), done.
remote: Compressing objects: 100% (129/129), done.
remote: Total 201 (delta 108), reused 139 (delta 66), pack-reused 0
Receiving objects: 100% (201/201), 31.22 KiB | 1.49 MiB/s, done.
Resolving deltas: 100% (108/108), done.
Tapped 19 casks and 11 formulae (56 files, 83KB).
jeffreyschwartz@jeffreys-MacBook-Pro:~ brew cask install liberica-jdk8 ==> Downloading https://download.bell-sw.com/java/8u242%2B7/bellsoft-jdk8u242%2B7-macos-amd64.pkg ######################################################################## 100.0% ==> Verifying SHA-256 checksum for Cask 'liberica-jdk8'. ==> Installing Cask liberica-jdk8 ==> Running installer for liberica-jdk8; your password may be necessary. ==> Package installers may write to any location; options such as --appdir are ignored. Password: installer: Package name is Liberica JDK 8u242+7 installer: Installing at base path / installer: The install was successful. 🍺 liberica-jdk8 was successfully installed! jeffreyschwartz@jeffreys-MacBook-Pro:~ export JAVA_HOME=(/usr/libexec/java_home -v 1.8) jeffreyschwartz@jeffreys-MacBook-Pro:~ brew install sleuthkit
==> Installing dependencies for sleuthkit: openssl@1.1, gdbm, readline, sqlite, xz, python@3.8, afflib, libewf, krb5, libpq and openjdk
==> Installing sleuthkit dependency: openssl@1.1
==> Downloading https://homebrew.bintray.com/bottles/openssl@1.1-1.1.1f.mojave.bottle.tar.gz
==> Downloading from https://akamai.bintray.com/25/25ab844d2f14fc85c7f52958b4b89bdd2965bbd9c557445829eff6473f238744?gda=exp=
######################################################################## 100.0%
==> Pouring openssl@1.1-1.1.1f.mojave.bottle.tar.gz
==> Caveats
A CA file has been bootstrapped using certificates from the system
keychain. To add additional certificates, place .pem files in
/usr/local/etc/openssl@1.1/certs

and run
/usr/local/opt/openssl@1.1/bin/c_rehash

openssl@1.1 is keg-only, which means it was not symlinked into /usr/local,
because macOS provides LibreSSL.

If you need to have openssl@1.1 first in your PATH run:
echo ‘export PATH="/usr/local/opt/openssl@1.1/bin:$PATH"’ >> ~/.bash_profile

For compilers to find openssl@1.1 you may need to set:
export LDFLAGS="-L/usr/local/opt/openssl@1.1/lib"
export CPPFLAGS="-I/usr/local/opt/openssl@1.1/include"

==> Summary
/usr/local/Cellar/openssl@1.1/1.1.1f: 8,057 files, 18MB
==> Installing sleuthkit dependency: gdbm
==> Downloading https://homebrew.bintray.com/bottles/gdbm-1.18.1.mojave.bottle.1.tar.gz
######################################################################## 100.0%
==> Pouring gdbm-1.18.1.mojave.bottle.1.tar.gz
/usr/local/Cellar/gdbm/1.18.1: 20 files, 586.8KB
==> Installing sleuthkit dependency: readline
==> Downloading https://homebrew.bintray.com/bottles/readline-8.0.4.mojave.bottle.tar.gz
==> Downloading from https://akamai.bintray.com/29/29f7102a730ab39c8312cad1e7e439f6da2a67c452ce2b3380581eb185a5d8e8?gda=exp=
######################################################################## 100.0%
==> Pouring readline-8.0.4.mojave.bottle.tar.gz
==> Caveats
readline is keg-only, which means it was not symlinked into /usr/local,
because macOS provides BSD libedit.

For compilers to find readline you may need to set:
export LDFLAGS="-L/usr/local/opt/readline/lib"
export CPPFLAGS="-I/usr/local/opt/readline/include"

==> Summary
/usr/local/Cellar/readline/8.0.4: 48 files, 1.5MB
==> Installing sleuthkit dependency: sqlite
==> Downloading https://homebrew.bintray.com/bottles/sqlite-3.31.1.mojave.bottle.tar.gz
==> Downloading from https://akamai.bintray.com/db/db7e3a6498bfdb4b4ceb8e8416020e2ad70de14975437f2e2a027485daeb2202?gda=exp=
######################################################################## 100.0%
==> Pouring sqlite-3.31.1.mojave.bottle.tar.gz
==> Caveats
sqlite is keg-only, which means it was not symlinked into /usr/local,
because macOS already provides this software and installing another version in
parallel can cause all kinds of trouble.

If you need to have sqlite first in your PATH run:
echo ‘export PATH="/usr/local/opt/sqlite/bin:$PATH"’ >> ~/.bash_profile

For compilers to find sqlite you may need to set:
export LDFLAGS="-L/usr/local/opt/sqlite/lib"
export CPPFLAGS="-I/usr/local/opt/sqlite/include"

==> Summary
/usr/local/Cellar/sqlite/3.31.1: 11 files, 4MB
==> Installing sleuthkit dependency: xz
==> Downloading https://homebrew.bintray.com/bottles/xz-5.2.5.mojave.bottle.tar.gz
==> Downloading from https://akamai.bintray.com/44/44483961b5d2b535b0ece1936c9d40b4bc7d9c7281646cca0fb476291ab9d4dc?gda=exp=
######################################################################## 100.0%
==> Pouring xz-5.2.5.mojave.bottle.tar.gz
/usr/local/Cellar/xz/5.2.5: 92 files, 1.1MB
==> Installing sleuthkit dependency: python@3.8
==> Downloading https://homebrew.bintray.com/bottles/python@3.8-3.8.2.mojave.bottle.tar.gz
==> Downloading from https://akamai.bintray.com/51/511b4f2c3993f000516938ed0700936c8a7d8c054b5171fa733ac7d344291c30?gda=exp=
######################################################################## 100.0%
==> Pouring python@3.8-3.8.2.mojave.bottle.tar.gz
==> /usr/local/Cellar/python@3.8/3.8.2/bin/python3 -s setup.py --no-user-cfg install --force --verbose --install-scripts=/usr/lo
==> /usr/local/Cellar/python@3.8/3.8.2/bin/python3 -s setup.py --no-user-cfg install --force --verbose --install-scripts=/usr/lo
==> /usr/local/Cellar/python@3.8/3.8.2/bin/python3 -s setup.py --no-user-cfg install --force --verbose --install-scripts=/usr/lo
==> Caveats
Python has been installed as
/usr/local/opt/python@3.8/bin/python3

You can install Python packages with
/usr/local/opt/python@3.8/bin/pip3 install
They will install into the site-package directory
/usr/local/opt/python@3.8/Frameworks/Python.framework/Versions/3.8/lib/python3.8/site-packages

See: https://docs.brew.sh/Homebrew-and-Python

python@3.8 is keg-only, which means it was not symlinked into /usr/local,
because this is an alternate version of another formula.

If you need to have python@3.8 first in your PATH run:
echo ‘export PATH="/usr/local/opt/python@3.8/bin:$PATH"’ >> ~/.bash_profile

For compilers to find python@3.8 you may need to set:
export LDFLAGS="-L/usr/local/opt/python@3.8/lib"

==> Summary
/usr/local/Cellar/python@3.8/3.8.2: 4,124 files, 62.7MB
==> Installing sleuthkit dependency: afflib
==> Downloading https://homebrew.bintray.com/bottles/afflib-3.7.18_3.mojave.bottle.tar.gz
==> Downloading from https://akamai.bintray.com/06/06e421180af02a47847f009f721ca91f7b0d03ed954995a1f12171f9d6467665?gda=exp=
######################################################################## 100.0%
==> Pouring afflib-3.7.18_3.mojave.bottle.tar.gz
/usr/local/Cellar/afflib/3.7.18_3: 50 files, 1.5MB
==> Installing sleuthkit dependency: libewf
==> Downloading https://homebrew.bintray.com/bottles/libewf-20140808.mojave.bottle.tar.gz
==> Downloading from https://akamai.bintray.com/4c/4c5482f8f1c97f9c3f3687bccd9c3628b314699bc26743e641f2ae573bf95eeb?gda=exp=
######################################################################## 100.0%
==> Pouring libewf-20140808.mojave.bottle.tar.gz
/usr/local/Cellar/libewf/20140808: 34 files, 8.8MB
==> Installing sleuthkit dependency: krb5
==> Downloading https://homebrew.bintray.com/bottles/krb5-1.18.mojave.bottle.tar.gz
==> Downloading from https://akamai.bintray.com/88/88fb8afbea9dee3d4deb76f6d3059e1782a503ec587a3fffb62ebcb4d92d3b48?gda=exp=
######################################################################## 100.0%
==> Pouring krb5-1.18.mojave.bottle.tar.gz
==> Caveats
krb5 is keg-only, which means it was not symlinked into /usr/local,
because macOS already provides this software and installing another version in
parallel can cause all kinds of trouble.

If you need to have krb5 first in your PATH run:
echo ‘export PATH="/usr/local/opt/krb5/bin:$PATH"’ >> ~/.bash_profile
echo ‘export PATH="/usr/local/opt/krb5/sbin:$PATH"’ >> ~/.bash_profile

For compilers to find krb5 you may need to set:
export LDFLAGS="-L/usr/local/opt/krb5/lib"
export CPPFLAGS="-I/usr/local/opt/krb5/include"

==> Summary
/usr/local/Cellar/krb5/1.18: 162 files, 3.9MB
==> Installing sleuthkit dependency: libpq
==> Downloading https://homebrew.bintray.com/bottles/libpq-12.2_1.mojave.bottle.tar.gz
==> Downloading from https://akamai.bintray.com/e4/e40e3c169e1e15092bab376299462086b6e556f10b1d01489c4aff4da39cf1d4?gda=exp=
######################################################################## 100.0%
==> Pouring libpq-12.2_1.mojave.bottle.tar.gz
==> Caveats
libpq is keg-only, which means it was not symlinked into /usr/local,
because conflicts with postgres formula.

If you need to have libpq first in your PATH run:
echo ‘export PATH="/usr/local/opt/libpq/bin:$PATH"’ >> ~/.bash_profile

For compilers to find libpq you may need to set:
export LDFLAGS="-L/usr/local/opt/libpq/lib"
export CPPFLAGS="-I/usr/local/opt/libpq/include"

==> Summary
/usr/local/Cellar/libpq/12.2_1: 2,240 files, 23.7MB
==> Installing sleuthkit dependency: openjdk
==> Downloading https://homebrew.bintray.com/bottles/openjdk-13.0.2+8_2.mojave.bottle.tar.gz
==> Downloading from https://akamai.bintray.com/60/6034ec5a0927803eae37a5e85b6c6efadb930527827b45ecc593e25a9750061c?gda=exp=
######################################################################## 100.0%
==> Pouring openjdk-13.0.2+8_2.mojave.bottle.tar.gz
==> Caveats
For the system Java wrappers to find this JDK, symlink it with
sudo ln -sfn /usr/local/opt/openjdk/libexec/openjdk.jdk /Library/Java/JavaVirtualMachines/openjdk.jdk

openjdk is keg-only, which means it was not symlinked into /usr/local,
because it shadows the macOS java wrapper.

If you need to have openjdk first in your PATH run:
echo ‘export PATH="/usr/local/opt/openjdk/bin:$PATH"’ >> ~/.bash_profile

For compilers to find openjdk you may need to set:
export CPPFLAGS="-I/usr/local/opt/openjdk/include"

==> Summary
/usr/local/Cellar/openjdk/13.0.2+8_2: 631 files, 314.6MB
==> Installing sleuthkit
==> Downloading https://homebrew.bintray.com/bottles/sleuthkit-4.8.0.mojave.bottle.tar.gz
==> Downloading from https://akamai.bintray.com/02/02ad0263a10f422f630205b332a5361921f4d33d943fe099afeee98feb5ef1bd?gda=exp=
######################################################################## 100.0%
==> Pouring sleuthkit-4.8.0.mojave.bottle.tar.gz
/usr/local/Cellar/sleuthkit/4.8.0: 490 files, 51.3MB
==> Caveats
==> openssl@1.1
A CA file has been bootstrapped using certificates from the system
keychain. To add additional certificates, place .pem files in
/usr/local/etc/openssl@1.1/certs

and run
/usr/local/opt/openssl@1.1/bin/c_rehash

openssl@1.1 is keg-only, which means it was not symlinked into /usr/local,
because macOS provides LibreSSL.

If you need to have openssl@1.1 first in your PATH run:
echo ‘export PATH="/usr/local/opt/openssl@1.1/bin:$PATH"’ >> ~/.bash_profile

For compilers to find openssl@1.1 you may need to set:
export LDFLAGS="-L/usr/local/opt/openssl@1.1/lib"
export CPPFLAGS="-I/usr/local/opt/openssl@1.1/include"

==> readline
readline is keg-only, which means it was not symlinked into /usr/local,
because macOS provides BSD libedit.

For compilers to find readline you may need to set:
export LDFLAGS="-L/usr/local/opt/readline/lib"
export CPPFLAGS="-I/usr/local/opt/readline/include"

==> sqlite
sqlite is keg-only, which means it was not symlinked into /usr/local,
because macOS already provides this software and installing another version in
parallel can cause all kinds of trouble.

If you need to have sqlite first in your PATH run:
echo ‘export PATH="/usr/local/opt/sqlite/bin:$PATH"’ >> ~/.bash_profile

For compilers to find sqlite you may need to set:
export LDFLAGS="-L/usr/local/opt/sqlite/lib"
export CPPFLAGS="-I/usr/local/opt/sqlite/include"

==> python@3.8
Python has been installed as
/usr/local/opt/python@3.8/bin/python3

You can install Python packages with
/usr/local/opt/python@3.8/bin/pip3 install
They will install into the site-package directory
/usr/local/opt/python@3.8/Frameworks/Python.framework/Versions/3.8/lib/python3.8/site-packages

See: https://docs.brew.sh/Homebrew-and-Python

python@3.8 is keg-only, which means it was not symlinked into /usr/local,
because this is an alternate version of another formula.

If you need to have python@3.8 first in your PATH run:
echo ‘export PATH="/usr/local/opt/python@3.8/bin:$PATH"’ >> ~/.bash_profile

For compilers to find python@3.8 you may need to set:
export LDFLAGS="-L/usr/local/opt/python@3.8/lib"

==> krb5
krb5 is keg-only, which means it was not symlinked into /usr/local,
because macOS already provides this software and installing another version in
parallel can cause all kinds of trouble.

If you need to have krb5 first in your PATH run:
echo ‘export PATH="/usr/local/opt/krb5/bin:$PATH"’ >> ~/.bash_profile
echo ‘export PATH="/usr/local/opt/krb5/sbin:$PATH"’ >> ~/.bash_profile

For compilers to find krb5 you may need to set:
export LDFLAGS="-L/usr/local/opt/krb5/lib"
export CPPFLAGS="-I/usr/local/opt/krb5/include"

==> libpq
libpq is keg-only, which means it was not symlinked into /usr/local,
because conflicts with postgres formula.

If you need to have libpq first in your PATH run:
echo ‘export PATH="/usr/local/opt/libpq/bin:$PATH"’ >> ~/.bash_profile

For compilers to find libpq you may need to set:
export LDFLAGS="-L/usr/local/opt/libpq/lib"
export CPPFLAGS="-I/usr/local/opt/libpq/include"

==> openjdk
For the system Java wrappers to find this JDK, symlink it with
sudo ln -sfn /usr/local/opt/openjdk/libexec/openjdk.jdk /Library/Java/JavaVirtualMachines/openjdk.jdk

openjdk is keg-only, which means it was not symlinked into /usr/local,
because it shadows the macOS java wrapper.

If you need to have openjdk first in your PATH run:
echo ‘export PATH="/usr/local/opt/openjdk/bin:$PATH"’ >> ~/.bash_profile

For compilers to find openjdk you may need to set:
export CPPFLAGS="-I/usr/local/opt/openjdk/include"

jeffreyschwartz@jeffreys-MacBook-Pro:~ cd Downloads/autopsy-4.14.0 jeffreyschwartz@jeffreys-MacBook-Pro:~/Downloads/autopsy-4.14.0 sh unix_setup.sh

Checking prerequisites and preparing Autopsy:

-n Checking for PhotoRec…
found in /usr/local/bin
-n Checking for Java…
found in /Library/Java/JavaVirtualMachines/liberica-jdk-8.jdk/Contents/Home
-n Checking for Sleuth Kit Java bindings…
found in /usr/local/share/java
-n Copying sleuthkit-4.8.0.jar into the Autopsy directory…
done

Autopsy is now configured. You can execute bin/autopsy to start it

jeffreyschwartz@jeffreys-MacBook-Pro:~/Downloads/autopsy-4.14.0$ ls
LICENSE-2.0.txt Running_Linux_OSX.txt docs/ icon.ico unix_setup.sh
NEWS.txt autopsy/ etc/ java/
README.txt bin/ harness/ platform/
jeffreyschwartz@jeffreys-MacBook-Pro:~/Downloads/autopsy-4.14.0$ cd bin
jeffreyschwartz@jeffreys-MacBook-Pro:~/Downloads/autopsy-4.14.0/bin$ ./autopsy
jeffreyschwartz@jeffreys-MacBook-Pro:~/Downloads/autopsy-4.14.0/bin$ ./autopsy
jeffreyschwartz@jeffreys-MacBook-Pro:~/Downloads/autopsy-4.14.0/bin$ ./autopsy
jeffreyschwartz@jeffreys-MacBook-Pro:~/Downloads/autopsy-4.14.0/bin$

=================

Jeff · April 23, 2020, 7:01am

Todays update, removed parts of the make command responce.

jeffreyschwartz@jeffreys-MacBook-Pro:~/Downloads$ cd sleuthkit-4.8.0/
jeffreyschwartz@jeffreys-MacBook-Pro:~/Downloads/sleuthkit-4.8.0$ ls
API-CHANGES.txt Makefile.in aclocal.m4 configure.ac m4/ tests/ win32/
ChangeLog.txt NEWS.txt bindings/ docs/ man/ tools/
INSTALL.txt README.md config/ framework/ packages/ tsk/
Makefile.am README_win32.txt configure* licenses/ samples/ unit_tests/
jeffreyschwartz@jeffreys-MacBook-Pro:~/Downloads/sleuthkit-4.8.0$ ./configure
checking for a BSD-compatible install… /usr/bin/install -c
checking whether build environment is sane… yes
checking for a thread-safe mkdir -p… config/install-sh -c -d
checking for gawk… no
checking for mawk… no
checking for nawk… no
checking for awk… awk
checking whether make sets (MAKE)... yes checking whether make supports nested variables... yes checking whether UID '501' is supported by ustar format... yes checking whether GID '20' is supported by ustar format... yes checking how to create a ustar tar archive... gnutar checking for cppunit-config... no checking for Cppunit - version >= 1.12.1... no checking build system type... x86_64-apple-darwin18.7.0 checking host system type... x86_64-apple-darwin18.7.0 checking how to print strings... printf checking for style of include used by make... GNU checking for gcc... gcc checking whether the C compiler works... yes checking for C compiler default output file name... a.out checking for suffix of executables... checking whether we are cross compiling... no checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ISO C89... none needed checking whether gcc understands -c and -o together... yes checking dependency style of gcc... gcc3 checking for a sed that does not truncate output... /usr/bin/sed checking for grep that handles long lines and -e... /usr/bin/grep checking for egrep... /usr/bin/grep -E checking for fgrep... /usr/bin/grep -F checking for ld used by gcc... /Library/Developer/CommandLineTools/usr/bin/ld checking if the linker (/Library/Developer/CommandLineTools/usr/bin/ld) is GNU ld... no checking for BSD- or MS-compatible name lister (nm)... /usr/bin/nm -B checking the name lister (/usr/bin/nm -B) interface... BSD nm checking whether ln -s works... yes checking the maximum length of command line arguments... 196608 checking how to convert x86_64-apple-darwin18.7.0 file names to x86_64-apple-darwin18.7.0 format... func_convert_file_noop checking how to convert x86_64-apple-darwin18.7.0 file names to toolchain format... func_convert_file_noop checking for /Library/Developer/CommandLineTools/usr/bin/ld option to reload object files... -r checking for objdump... objdump checking how to recognize dependent libraries... pass_all checking for dlltool... no checking how to associate runtime and link libraries... printf %s\n checking for ar... ar checking for archiver @FILE support... no checking for strip... strip checking for ranlib... ranlib checking command to parse /usr/bin/nm -B output from gcc object... ok checking for sysroot... no checking for a working dd... /bin/dd checking how to truncate binary pipes... /bin/dd bs=4096 count=1 checking for mt... no checking if : is a manifest tool... no checking for dsymutil... dsymutil checking for nmedit... nmedit checking for lipo... lipo checking for otool... otool checking for otool64... no checking for -single_module linker flag... yes checking for -exported_symbols_list linker flag... yes checking for -force_load linker flag... yes checking how to run the C preprocessor... gcc -E checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... yes checking for inttypes.h... yes checking for stdint.h... yes checking for unistd.h... yes checking for dlfcn.h... yes checking for objdir... .libs checking if gcc supports -fno-rtti -fno-exceptions... yes checking for gcc option to produce PIC... -fno-common -DPIC checking if gcc PIC flag -fno-common -DPIC works... yes checking if gcc static flag -static works... no checking if gcc supports -c -o file.o... yes checking if gcc supports -c -o file.o... (cached) yes checking whether the gcc linker (/Library/Developer/CommandLineTools/usr/bin/ld) supports shared libraries... yes checking dynamic linker characteristics... darwin18.7.0 dyld checking how to hardcode library paths into programs... immediate checking whether stripping libraries is possible... yes checking if libtool supports shared libraries... yes checking whether to build shared libraries... yes checking whether to build static libraries... yes checking whether to enable maintainer-specific portions of Makefiles... no checking for g++... g++ checking whether we are using the GNU C++ compiler... yes checking whether g++ accepts -g... yes checking dependency style of g++... gcc3 checking how to run the C++ preprocessor... g++ -E checking for ld used by g++... /Library/Developer/CommandLineTools/usr/bin/ld checking if the linker (/Library/Developer/CommandLineTools/usr/bin/ld) is GNU ld... no checking whether the g++ linker (/Library/Developer/CommandLineTools/usr/bin/ld) supports shared libraries... yes checking for g++ option to produce PIC... -fno-common -DPIC checking if g++ PIC flag -fno-common -DPIC works... yes checking if g++ static flag -static works... no checking if g++ supports -c -o file.o... yes checking if g++ supports -c -o file.o... (cached) yes checking whether the g++ linker (/Library/Developer/CommandLineTools/usr/bin/ld) supports shared libraries... yes checking dynamic linker characteristics... darwin18.7.0 dyld checking how to hardcode library paths into programs... immediate checking whether g++ supports C++14 features with -std=c++14... yes checking for gcc... (cached) gcc checking whether we are using the GNU C compiler... (cached) yes checking whether gcc accepts -g... (cached) yes checking for gcc option to accept ISO C89... (cached) none needed checking whether gcc understands -c and -o together... (cached) yes checking dependency style of gcc... (cached) gcc3 checking how to run the C preprocessor... gcc -E checking whether ln -s works... yes checking whether make sets (MAKE)… (cached) yes
checking for perl… /usr/bin/perl
checking for ANSI C header files… (cached) yes
checking err.h usability… yes
checking err.h presence… yes
checking for err.h… yes
checking for inttypes.h… (cached) yes
checking for unistd.h… (cached) yes
checking for stdint.h… (cached) yes
checking sys/param.h usability… yes
checking sys/param.h presence… yes
checking for sys/param.h… yes
checking sys/resource.h usability… yes
checking sys/resource.h presence… yes
checking for sys/resource.h… yes
checking for stdbool.h that conforms to C99… yes
checking for _Bool… yes
checking for an ANSI C-conforming const… yes
checking for uid_t in sys/types.h… yes
checking for mode_t… yes
checking for off_t… yes
checking for size_t… yes
checking for special C compiler options needed for large files… no
checking for _FILE_OFFSET_BITS value needed for large files… no
checking for working alloca.h… yes
checking for alloca… yes
checking for error_at_line… no
checking for _LARGEFILE_SOURCE value needed for large files… no
checking whether gcc needs -traditional… no
checking whether lstat correctly handles trailing slash… no
checking whether lstat accepts an empty string… no
checking whether lstat correctly handles trailing slash… (cached) no
checking sys/select.h usability… yes
checking sys/select.h presence… yes
checking for sys/select.h… yes
checking sys/socket.h usability… yes
checking sys/socket.h presence… yes
checking for sys/socket.h… yes
checking types of arguments for select… int,fd_set *,struct timeval *
checking for utime.h… yes
checking whether utime accepts a null argument… yes
checking for vprintf… yes
checking for _doprnt… no
checking for ishexnumber… yes
checking for err… yes
checking for errx… yes
checking for warn… yes
checking for warnx… yes
checking for vasprintf… yes
checking for getrusage… yes
checking for strlcpy… yes
checking for strlcat… yes
checking whether pthreads work with -pthread… yes
checking for joinable pthread attribute… PTHREAD_CREATE_JOINABLE
checking if more special flags are required for pthreads… -D_THREAD_SAFE
checking for main in -lstdc++… yes
checking for list… no
checking for map… no
checking for queue… no
checking for set… no
checking for stack… no
checking for streambuf… no
checking for string… no
checking for vector… no
checking sqlite3.h usability… yes
checking sqlite3.h presence… yes
checking for sqlite3.h… yes
checking for dlopen in -ldl… yes
checking for sqlite3_open in -lsqlite3… yes
checking which sqlite3 to use… system
checking postgresql/libpq-fe.h usability… no
checking postgresql/libpq-fe.h presence… no
checking for postgresql/libpq-fe.h… no
checking libpq-fe.h usability… no
checking libpq-fe.h presence… no
checking for libpq-fe.h… no
checking afflib/afflib.h usability… yes
checking afflib/afflib.h presence… yes
checking for afflib/afflib.h… yes
checking for af_open in -lafflib… yes
configure: checking for zlib
checking zlib.h usability… yes
checking zlib.h presence… yes
checking for zlib.h… yes
checking for inflate in -lz… yes
checking for dlopen in -ldl… (cached) yes
checking libewf.h usability… yes
checking libewf.h presence… yes
checking for libewf.h… yes
checking for libewf_get_version in -lewf… yes
checking libvhdi.h usability… no
checking libvhdi.h presence… no
checking for libvhdi.h… no
checking libvmdk.h usability… no
checking libvmdk.h presence… no
checking for libvmdk.h… no
checking for gcj… no
checking for guavac… no
checking for jikes… no
checking for javac… javac
checking if javac works… yes
checking for javac… /usr/bin/javac
checking symlink for /usr/bin/javac… /System/Library/Frameworks/JavaVM.framework/Versions/Current/Commands/javac
checking for /System/Library/Frameworks/JavaVM.framework/Versions/Current/Headers/jni.h… no
checking for /System/Library/Frameworks/JavaVM.framework/Versions/include/jni.h… no
cannot find JDK header files
checking for kaffe… no
checking for java… java
checking for uudecode… yes
checking if uudecode can decode base 64 file… yes
checking if java works… yes
checking for ant… no
checking if libtool needs -no-undefined flag to build shared libraries… no
checking for getline… yes
checking for library containing regexec… none required
checking that generated files are newer than configure… done
configure: creating ./config.status
config.status: creating Makefile
config.status: creating tsk/Makefile
config.status: creating tsk/base/Makefile
config.status: creating tsk/img/Makefile
config.status: creating tsk/vs/Makefile
config.status: creating tsk/fs/Makefile
config.status: creating tsk/hashdb/Makefile
config.status: creating tsk/auto/Makefile
config.status: creating tsk/pool/Makefile
config.status: creating tsk/util/Makefile
config.status: creating tools/Makefile
config.status: creating tools/imgtools/Makefile
config.status: creating tools/vstools/Makefile
config.status: creating tools/fstools/Makefile
config.status: creating tools/hashtools/Makefile
config.status: creating tools/srchtools/Makefile
config.status: creating tools/autotools/Makefile
config.status: creating tools/pooltools/Makefile
config.status: creating tools/sorter/Makefile
config.status: creating tools/timeline/Makefile
config.status: creating tools/fiwalk/Makefile
config.status: creating tools/fiwalk/src/Makefile
config.status: creating tools/fiwalk/plugins/Makefile
config.status: creating tests/Makefile
config.status: creating samples/Makefile
config.status: creating man/Makefile
config.status: creating bindings/java/Makefile
config.status: creating bindings/java/jni/Makefile
config.status: creating unit_tests/Makefile
config.status: creating unit_tests/base/Makefile
config.status: creating tsk/tsk_config.h
config.status: executing depfiles commands
config.status: executing libtool commands
config.status: executing tsk/tsk_incs.h commands
configure:
Building:
afflib support: yes
libewf support: yes
zlib support: yes
openssl support: no

libvhdi support: no
libvmdk support: no
postgresql support: no
Features:
Java/JNI support: no
Multithreading: yes

jeffreyschwartz@jeffreys-MacBook-Pro:~/Downloads/sleuthkit-4.8.0$ make
Making all in tsk

removed lines*

/Library/Developer/CommandLineTools/usr/bin/make all-recursive
Making all in base
fls.cpp:203:57: warning: comparison of integers of different signs: ‘TSK_DADDR_T’ (aka ‘unsigned long long’) and ‘int’
[-Wsign-compare]
if ((pvol_block = tsk_parse_offset(OPTARG)) == -1) {
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ^ ~~
fls.cpp:209:54: warning: comparison of integers of different signs: ‘TSK_DADDR_T’ (aka ‘unsigned long long’) and ‘int’
[-Wsign-compare]
if ((snap_id = tsk_parse_offset(OPTARG)) == -1) {
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ^ ~~
2 warnings generated.
mv -f .deps/fls.Tpo .deps/fls.Po
/bin/sh …/…/libtool --tag=CXX --mode=link g++ -std=c++14 -Wall -Wextra -Wno-unused-parameter -Wno-unused-command-line-argument -g -O2 -D_THREAD_SAFE -pthread -L/usr/local/lib -static -o fls fls.o …/…/tsk/libtsk.la -lewf -ldl -lz -lafflib -lsqlite3 -ldl -lstdc++
libtool: link: g++ -std=c++14 -Wall -Wextra -Wno-unused-parameter -Wno-unused-command-line-argument -g -O2 -D_THREAD_SAFE -pthread -o fls fls.o -Wl,-bind_at_load -L/usr/local/lib …/…/tsk/.libs/libtsk.a -lewf -lz -lafflib -lsqlite3 -ldl -lstdc++ -pthread
g++ -std=c++14 -DHAVE_CONFIG_H -I. -I…/…/tsk -I…/… -I./…/… -D_THREAD_SAFE -pthread -I/usr/local/include -Wall -Wextra -Wno-unused-parameter -Wno-unused-command-line-argument -g -O2 -MT fcat.o -MD -MP -MF .deps/fcat.Tpo -c -o fcat.o fcat.cpp
mv -f .deps/fcat.Tpo .deps/fcat.Po
/bin/sh …/…/libtool --tag=CXX --mode=link g++ -std=c++14 -Wall -Wextra -Wno-unused-parameter -Wno-unused-command-line-argument -g -O2 -D_THREAD_SAFE -pthread -L/usr/local/lib -static -o fcat fcat.o …/…/tsk/libtsk.la -lewf -ldl -lz -lafflib -lsqlite3 -ldl -lstdc++
libtool: link: g++ -std=c++14 -Wall -Wextra -Wno-unused-parameter -Wno-unused-command-line-argument -g -O2 -D_THREAD_SAFE -pthread -o fcat fcat.o -Wl,-bind_at_load -L/usr/local/lib …/…/tsk/.libs/libtsk.a -lewf -lz -lafflib -lsqlite3 -ldl -lstdc++ -pthread
g++ -std=c++14 -DHAVE_CONFIG_H -I. -I…/…/tsk -I…/… -I./…/… -D_THREAD_SAFE -pthread -I/usr/local/include -Wall -Wextra -Wno-unused-parameter -Wno-unused-command-line-argument -g -O2 -MT fsstat.o -MD -MP -MF .deps/fsstat.Tpo -c -o fsstat.o fsstat.cpp
fsstat.cpp:150:57: warning: comparison of integers of different signs: ‘TSK_DADDR_T’ (aka ‘unsigned long long’) and ‘int’
[-Wsign-compare]
if ((pvol_block = tsk_parse_offset(OPTARG)) == -1) {
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ^ ~~
1 warning generated.
mv -f .deps/fsstat.Tpo .deps/fsstat.Po
/bin/sh …/…/libtool --tag=CXX --mode=link g++ -std=c++14 -Wall -Wextra -Wno-unused-parameter -Wno-unused-command-line-argument -g -O2 -D_THREAD_SAFE -pthread -L/usr/local/lib -static -o fsstat fsstat.o …/…/tsk/libtsk.la -lewf -ldl -lz -lafflib -lsqlite3 -ldl -lstdc++
libtool: link: g++ -std=c++14 -Wall -Wextra -Wno-unused-parameter -Wno-unused-command-line-argument -g -O2 -D_THREAD_SAFE -pthread -o fsstat fsstat.o -Wl,-bind_at_load -L/usr/local/lib …/…/tsk/.libs/libtsk.a -lewf -lz -lafflib -lsqlite3 -ldl -lstdc++ -pthread
g++ -std=c++14 -DHAVE_CONFIG_H -I. -I…/…/tsk -I…/… -I./…/… -D_THREAD_SAFE -pthread -I/usr/local/include -Wall -Wextra -Wno-unused-parameter -Wno-unused-command-line-argument -g -O2 -MT icat.o -MD -MP -MF .deps/icat.Tpo -c -o icat.o icat.cpp
icat.cpp:171:57: warning: comparison of integers of different signs: ‘TSK_DADDR_T’ (aka ‘unsigned long long’) and ‘int’
[-Wsign-compare]
if ((pvol_block = tsk_parse_offset(OPTARG)) == -1) {
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ^ ~~
icat.cpp:177:54: warning: comparison of integers of different signs: ‘TSK_DADDR_T’ (aka ‘unsigned long long’) and ‘int’
[-Wsign-compare]
if ((snap_id = tsk_parse_offset(OPTARG)) == -1) {
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ^ ~~
2 warnings generated.

ore removed

Making all in man
make[1]: Nothing to be done for all'. make[1]: Nothing to be done for all-am’.
jeffreyschwartz@jeffreys-MacBook-Pro:~/Downloads/sleuthkit-4.8.0$ ls
API-CHANGES.txt Makefile.in bindings/ configure.ac m4/ tools/
ChangeLog.txt NEWS.txt config/ docs/ man/ tsk/
INSTALL.txt README.md config.log framework/ packages/ unit_tests/
Makefile README_win32.txt config.status* libtool* samples/ win32/
Makefile.am aclocal.m4 configure* licenses/ tests/
jeffreyschwartz@jeffreys-MacBook-Pro:~/Downloads/sleuthkit-4.8.0$ make install
Making install in tsk
Making install in base
make[3]: Nothing to be done for install-exec-am'. make[3]: Nothing to be done for install-data-am’.
Making install in img
make[3]: Nothing to be done for install-exec-am'. make[3]: Nothing to be done for install-data-am’.
Making install in vs
make[3]: Nothing to be done for install-exec-am'. make[3]: Nothing to be done for install-data-am’.
Making install in fs
make[3]: Nothing to be done for install-exec-am'. make[3]: Nothing to be done for install-data-am’.
Making install in hashdb
make[3]: Nothing to be done for install-exec-am'. make[3]: Nothing to be done for install-data-am’.
Making install in auto
make[3]: Nothing to be done for install-exec-am'. make[3]: Nothing to be done for install-data-am’.
Making install in pool
make[3]: Nothing to be done for install-exec-am'. make[3]: Nothing to be done for install-data-am’.
Making install in util
make[3]: Nothing to be done for install-exec-am'. make[3]: Nothing to be done for install-data-am’.
…/config/install-sh -c -d ‘/usr/local/lib’
/bin/sh …/libtool --mode=install /usr/bin/install -c libtsk.la ‘/usr/local/lib’
libtool: install: /usr/bin/install -c .libs/libtsk.19.dylib /usr/local/lib/libtsk.19.dylib
libtool: install: (cd /usr/local/lib && { ln -s -f libtsk.19.dylib libtsk.dylib || { rm -f libtsk.dylib && ln -s libtsk.19.dylib libtsk.dylib; }; })
libtool: install: /usr/bin/install -c .libs/libtsk.lai /usr/local/lib/libtsk.la
libtool: install: /usr/bin/install -c .libs/libtsk.a /usr/local/lib/libtsk.a
libtool: install: chmod 644 /usr/local/lib/libtsk.a
libtool: install: ranlib /usr/local/lib/libtsk.a
/Library/Developer/CommandLineTools/usr/bin/ranlib: file: /usr/local/lib/libtsk.a(XGetopt.o) has no symbols
/Library/Developer/CommandLineTools/usr/bin/ranlib: file: /usr/local/lib/libtsk.a(tsk_error_win32.o) has no symbols
/Library/Developer/CommandLineTools/usr/bin/ranlib: file: /usr/local/lib/libtsk.a(vhd.o) has no symbols
/Library/Developer/CommandLineTools/usr/bin/ranlib: file: /usr/local/lib/libtsk.a(vmdk.o) has no symbols
/Library/Developer/CommandLineTools/usr/bin/ranlib: file: /usr/local/lib/libtsk.a(db_postgresql.o) has no symbols
/Library/Developer/CommandLineTools/usr/bin/ranlib: file: /usr/local/lib/libtsk.a(crypto.o) has no symbols
make[3]: Nothing to be done for install-data-am'. Making install in tools Making install in imgtools ../../config/install-sh -c -d '/usr/local/bin' /bin/sh ../../libtool --mode=install /usr/bin/install -c img_cat img_stat '/usr/local/bin' libtool: install: /usr/bin/install -c img_cat /usr/local/bin/img_cat libtool: install: /usr/bin/install -c img_stat /usr/local/bin/img_stat make[3]: Nothing to be done for install-data-am’.
Making install in vstools
…/…/config/install-sh -c -d ‘/usr/local/bin’
/bin/sh …/…/libtool --mode=install /usr/bin/install -c mmls mmstat mmcat ‘/usr/local/bin’
libtool: install: /usr/bin/install -c mmls /usr/local/bin/mmls
libtool: install: /usr/bin/install -c mmstat /usr/local/bin/mmstat
libtool: install: /usr/bin/install -c mmcat /usr/local/bin/mmcat
make[3]: Nothing to be done for install-data-am'. Making install in fstools ../../config/install-sh -c -d '/usr/local/bin' /bin/sh ../../libtool --mode=install /usr/bin/install -c blkcalc blkcat blkls blkstat ffind fls fcat fsstat icat ifind ils istat jcat jls usnjls '/usr/local/bin' libtool: install: /usr/bin/install -c blkcalc /usr/local/bin/blkcalc libtool: install: /usr/bin/install -c blkcat /usr/local/bin/blkcat libtool: install: /usr/bin/install -c blkls /usr/local/bin/blkls libtool: install: /usr/bin/install -c blkstat /usr/local/bin/blkstat libtool: install: /usr/bin/install -c ffind /usr/local/bin/ffind libtool: install: /usr/bin/install -c fls /usr/local/bin/fls libtool: install: /usr/bin/install -c fcat /usr/local/bin/fcat libtool: install: /usr/bin/install -c fsstat /usr/local/bin/fsstat libtool: install: /usr/bin/install -c icat /usr/local/bin/icat libtool: install: /usr/bin/install -c ifind /usr/local/bin/ifind libtool: install: /usr/bin/install -c ils /usr/local/bin/ils libtool: install: /usr/bin/install -c istat /usr/local/bin/istat libtool: install: /usr/bin/install -c jcat /usr/local/bin/jcat libtool: install: /usr/bin/install -c jls /usr/local/bin/jls libtool: install: /usr/bin/install -c usnjls /usr/local/bin/usnjls make[3]: Nothing to be done for install-data-am’.
Making install in hashtools
…/…/config/install-sh -c -d ‘/usr/local/bin’
/bin/sh …/…/libtool --mode=install /usr/bin/install -c hfind ‘/usr/local/bin’
libtool: install: /usr/bin/install -c hfind /usr/local/bin/hfind
make[3]: Nothing to be done for install-data-am'. Making install in srchtools ../../config/install-sh -c -d '/usr/local/bin' /bin/sh ../../libtool --mode=install /usr/bin/install -c srch_strings sigfind '/usr/local/bin' libtool: install: /usr/bin/install -c srch_strings /usr/local/bin/srch_strings libtool: install: /usr/bin/install -c sigfind /usr/local/bin/sigfind make[3]: Nothing to be done for install-data-am’.
Making install in sorter
…/…/config/install-sh -c -d ‘/usr/local/bin’
/usr/bin/install -c sorter ‘/usr/local/bin’
make[3]: Nothing to be done for install-data-am'. Making install in timeline ../../config/install-sh -c -d '/usr/local/bin' /usr/bin/install -c mactime '/usr/local/bin' make[3]: Nothing to be done for install-data-am’.
Making install in autotools
…/…/config/install-sh -c -d ‘/usr/local/bin’
/bin/sh …/…/libtool --mode=install /usr/bin/install -c tsk_recover tsk_loaddb tsk_comparedir tsk_gettimes ‘/usr/local/bin’
libtool: install: /usr/bin/install -c tsk_recover /usr/local/bin/tsk_recover
libtool: install: /usr/bin/install -c tsk_loaddb /usr/local/bin/tsk_loaddb
libtool: install: /usr/bin/install -c tsk_comparedir /usr/local/bin/tsk_comparedir
libtool: install: /usr/bin/install -c tsk_gettimes /usr/local/bin/tsk_gettimes
make[3]: Nothing to be done for install-data-am'. Making install in fiwalk Making install in src ../../../config/install-sh -c -d '/usr/local/bin' /bin/sh ../../../libtool --mode=install /usr/bin/install -c fiwalk '/usr/local/bin' libtool: install: /usr/bin/install -c .libs/fiwalk /usr/local/bin/fiwalk make[4]: Nothing to be done for install-data-am’.
Making install in plugins
…/…/…/config/install-sh -c -d ‘/usr/local/bin’
/bin/sh …/…/…/libtool --mode=install /usr/bin/install -c jpeg_extract ‘/usr/local/bin’
libtool: install: /usr/bin/install -c jpeg_extract /usr/local/bin/jpeg_extract
make[4]: Nothing to be done for install-data-am'. make[4]: Nothing to be done for install-exec-am’.
make[4]: Nothing to be done for install-data-am'. Making install in pooltools ../../config/install-sh -c -d '/usr/local/bin' /bin/sh ../../libtool --mode=install /usr/bin/install -c pstat '/usr/local/bin' libtool: install: /usr/bin/install -c pstat /usr/local/bin/pstat make[3]: Nothing to be done for install-data-am’.
make[3]: Nothing to be done for install-exec-am'. make[3]: Nothing to be done for install-data-am’.
Making install in tests
make[2]: Nothing to be done for install-exec-am'. make[2]: Nothing to be done for install-data-am’.
Making install in samples
make[2]: Nothing to be done for install-exec-am'. make[2]: Nothing to be done for install-data-am’.
Making install in man
make[2]: Nothing to be done for install-exec-am'. ../config/install-sh -c -d '/usr/local/share/man/man1' /usr/bin/install -c -m 644 blkcalc.1 blkcat.1 blkls.1 blkstat.1 fcat.1 ffind.1 fls.1 fsstat.1 hfind.1 icat.1 ifind.1 ils.1 img_cat.1 img_stat.1 istat.1 jcat.1 jls.1 mactime.1 mmls.1 mmstat.1 mmcat.1 sigfind.1 sorter.1 usnjls.1 tsk_recover.1 tsk_gettimes.1 tsk_comparedir.1 tsk_loaddb.1 '/usr/local/share/man/man1' make[2]: Nothing to be done for install-exec-am’.
config/install-sh -c -d ‘/usr/local/share’
config/install-sh -c -d ‘/usr/local/share/tsk/sorter’
/usr/bin/install -c -m 644 tsk/sorter/default.sort tsk/sorter/freebsd.sort tsk/sorter/images.sort tsk/sorter/linux.sort tsk/sorter/openbsd.sort tsk/sorter/solaris.sort tsk/sorter/windows.sort ‘/usr/local/share/tsk/sorter’
config/install-sh -c -d ‘/usr/local/include’
config/install-sh -c -d ‘/usr/local/include/tsk/base’
/usr/bin/install -c -m 644 tsk/base/tsk_base.h tsk/base/tsk_os.h ‘/usr/local/include/tsk/base’
config/install-sh -c -d ‘/usr/local/include/tsk/vs’
/usr/bin/install -c -m 644 tsk/vs/tsk_vs.h tsk/vs/tsk_bsd.h tsk/vs/tsk_dos.h tsk/vs/tsk_gpt.h tsk/vs/tsk_mac.h tsk/vs/tsk_sun.h ‘/usr/local/include/tsk/vs’
config/install-sh -c -d ‘/usr/local/include/tsk/fs’
/usr/bin/install -c -m 644 tsk/fs/tsk_fs.h tsk/fs/tsk_ffs.h tsk/fs/tsk_ext2fs.h tsk/fs/tsk_fatfs.h tsk/fs/tsk_ntfs.h tsk/fs/tsk_iso9660.h tsk/fs/tsk_hfs.h tsk/fs/tsk_yaffs.h tsk/fs/tsk_apfs.h tsk/fs/tsk_apfs.hpp tsk/fs/apfs_fs.h tsk/fs/apfs_fs.hpp tsk/fs/apfs_compat.hpp tsk/fs/decmpfs.h tsk/fs/tsk_exfatfs.h tsk/fs/tsk_fatxxfs.h ‘/usr/local/include/tsk/fs’
config/install-sh -c -d ‘/usr/local/include/tsk/pool’
/usr/bin/install -c -m 644 tsk/pool/tsk_pool.h tsk/pool/tsk_pool.hpp tsk/pool/tsk_apfs.h tsk/pool/tsk_apfs.hpp tsk/pool/pool_compat.hpp tsk/pool/apfs_pool_compat.hpp ‘/usr/local/include/tsk/pool’
config/install-sh -c -d ‘/usr/local/include/tsk/img’
/usr/bin/install -c -m 644 tsk/img/tsk_img.h tsk/img/pool.hpp ‘/usr/local/include/tsk/img’
config/install-sh -c -d ‘/usr/local/include/tsk/auto’
/usr/bin/install -c -m 644 tsk/auto/tsk_auto.h tsk/auto/tsk_is_image_supported.h tsk/auto/guid.h ‘/usr/local/include/tsk/auto’
config/install-sh -c -d ‘/usr/local/include/tsk/hashdb’
/usr/bin/install -c -m 644 tsk/hashdb/tsk_hashdb.h ‘/usr/local/include/tsk/hashdb’
config/install-sh -c -d ‘/usr/local/include/tsk/util’
/usr/bin/install -c -m 644 tsk/util/crypto.hpp tsk/util/lw_shared_ptr.hpp tsk/util/span.hpp ‘/usr/local/include/tsk/util’
config/install-sh -c -d ‘/usr/local/include/tsk’
/usr/bin/install -c -m 644 tsk/libtsk.h tsk/tsk_incs.h ‘/usr/local/include/tsk’

John_Lehr · April 23, 2020, 3:21pm

The problem with homebrew sleuthkit package is that is is compiled with an incompatible version of Java. This is why you have to build sleuthkit despite what the Running_Linux_OSX.txt file says.

Remove the sleuthkit package

% brew uninstall sleuthkit
Install liberica-jdk8-full

% brew tap bell-sw/liberica
% brew cask install liberica-jdk8-full
% export JAVA_HOME=$(/usr/libexec/java_home -v 1.8)
Remove openjdk if installed.

% brew uninstall openjdk
Link liberica JDK to openjdk (sleuthkit looks here despite the JAVA_HOME setting)

% ln -s /Library/Java/JavaVirtualMachines/liberica-jdk-8-full.jdk/Contents/Home /usr/local/opt/openjdk
Install the “ant” package without installing openjdk (remove open jdk if installed)

% brew install ant --ignore-dependencies
Install “libpq” for postgresql support. You alread have the other image format dependencies met.

% brew install libpq
Build and install sleuthkit. At the end of the normal make process, you will see the java module being built.

% cd ~/Downloads/sleuthkit-4.8.0
% make clean #to cleanup up previous build attempts
% make
% sudo make install

This process should get you an Autopsy compatible sleutkit-4.8.0.jar file that is imported into Autopsy when you run unix_setup.sh from the root of the Autopsy directory.

If Autopsy starts, but you don’t get the expected Autopsy start screen, then delete the Autopsy application support folder to refresh the settings.

% rm -rf Library/Application\ Support/autopsy/

I hope this helps.

downey · April 23, 2020, 3:30pm

@John_Lehr Well said. I think you covered all the bases there.
If this solves the issue for the OP I suggest we take these steps and put them into the Running_Linux_OSX.txt file (or John could submit a pull request with the change).
FYI: The Running_Linux_OSX.txt file was recently updated to remove the reference to Brew.

@Jeff Nice job providing all that detail. It really helps us figure out what’s going on and people rarely provide it.

John_Lehr · April 23, 2020, 3:50pm

I’m working the steps, start to finish, to installing Autopsy in macOS now. It took me a while to troubleshoot the installation process and achieve success. Once I have the steps documented and tested, I will:

Submit a pull request to change the Running_Linux_OSX.txt file.
Post the instructions on my Github page (since I can’t control when and if the pull request will be accepted).

I may later recommend some changes for the Linux side, too. The .deb package doesn’t leave you with a working command line implementation of sleuthkit-4.8.0, and with the new APFS support, it’s not to be ignored.

Jeff · April 23, 2020, 5:33pm

Thanks, I followed your directions up to the point where my lack of unix/linux knowledge failed me. Not hard to do.

jeffreyschwartz@jeffreys-MacBook-Pro:~/Downloads/autopsy-4.14.0$ ls
Extra download/ README.txt bin/ extra/ java/
LICENSE-2.0.txt Running_Linux_OSX.txt docs/ harness/ platform/
NEWS.txt autopsy/ etc/ icon.ico unix_setup.sh
jeffreyschwartz@jeffreys-MacBook-Pro:~/Downloads/autopsy-4.14.0$ unix_setup.sh
-bash: unix_setup.sh: command not found
jeffreyschwartz@jeffreys-MacBook-Pro:~/Downloads/autopsy-4.14.0$ ./unix_setup.sh
-bash: ./unix_setup.sh: Permission denied
jeffreyschwartz@jeffreys-MacBook-Pro:~/Downloads/autopsy-4.14.0$ sudo ./unix_setup.sh
Password:
sudo: ./unix_setup.sh: command not found
jeffreyschwartz@jeffreys-MacBook-Pro:~/Downloads/autopsy-4.14.0$

I found this but I wanted to make sure that was the issue.

Set execute permission on your script: chmod +x script-name-here.sh.
To run your script, enter: ./script-name-here.sh. sh script-name-here.sh. bash script-name-here.sh.

Thanks again.

Jeff · April 23, 2020, 5:37pm

Thanks,

It’s nice to be getting help from people that are knowledgable.

John_Lehr · April 23, 2020, 5:37pm

The unix setup script is not executable, so you have to run it like this:

% sh unix_setup.sh

An alternative is

% . unix_setup.sh

where there is a space between the dot and the script. The dot is a shortcut for the sh command.

Jeff · April 23, 2020, 6:04pm

Have I mentioned how much I hate computers?

jeffreyschwartz@jeffreys-MacBook-Pro:~/Downloads/autopsy-4.14.0$ sh unix_setup.sh

Checking prerequisites and preparing Autopsy:

-n Checking for PhotoRec…
found in /usr/local/bin
-n Checking for Java…
found in /Library/Java/JavaVirtualMachines/liberica-jdk-8-full.jdk/Contents/Home
-n Checking for Sleuth Kit Java bindings…
ERROR: sleuthkit-4.8.0.jar not found in /usr/share/java/ or /usr/local/share/java/.
Please install the Sleuth Kit Java bindings file.
See https://github.com/sleuthkit/sleuthkit/releases.

John_Lehr · April 23, 2020, 7:38pm

Check the /usr/local/share/java/ folder. If the sleuthkit-4.8.0.jar is not present, you didn’t build sleuthkit correctly.

% ls /usr/local/share/java/
sleuthkit-4.8.0.jar

Jeff · April 23, 2020, 10:30pm

Didn’t find the directory or file as you suggested and it wasn’t there.

Tried redoing the install like you suggested in your reply but no luck.

Now getting different errors. Might go back to windows.

Last login: Thu Apr 23 17:01:45 on ttys002
jeffreyschwartz@jeffreys-MacBook-Pro:~ brew uninstall sleuthkit Error: No such keg: /usr/local/Cellar/sleuthkit jeffreyschwartz@jeffreys-MacBook-Pro:~ Install liberica-jdk8-full
usage: install [-bCcpSsv] [-B suffix] [-f flags] [-g group] [-m mode]
[-o owner] file1 file2
install [-bCcpSsv] [-B suffix] [-f flags] [-g group] [-m mode]
[-o owner] file1 … fileN directory
install -d [-v] [-g group] [-m mode] [-o owner] directory …
jeffreyschwartz@jeffreys-MacBook-Pro:~$ brew tap bell-sw/liberica
Updating Homebrew…
==> Auto-updated Homebrew!
Updated 2 taps (homebrew/core and homebrew/cask).
==> Updated Formulae
babeld diffoscope ensmallen futhark git-cinnabar parallel
bazel enet exploitdb geoserver gitlab-runner
==> Updated Casks
airy dbngin multipass softorino-youtube-converter
alt-tab dingtalk multitouch unicodechecker
arq drama popo wavebox
badlion-client flipper postman whatsize
bettertouchtool ganache quiterss workflowy
blue-jeans ganttproject rsyncosx zoho-mail
cctalk jami screen
chalk lunar scrutiny
data-science-studio mailspring smlnj

jeffreyschwartz@jeffreys-MacBook-Pro:~ brew tap bell-sw/liberica jeffreyschwartz@jeffreys-MacBook-Pro:~ brew cask install liberica-jdk8-full
Warning: Cask ‘liberica-jdk8-full’ is already installed.

To re-install liberica-jdk8-full, run:
brew cask reinstall liberica-jdk8-full
jeffreyschwartz@jeffreys-MacBook-Pro:~ brew cask reinstall liberica-jdk8-full ==> Downloading https://download.bell-sw.com/java/8u252%2B9/bellsoft-jdk8u252%2B9-macos-amd64-full.pkg Already downloaded: /Users/jeffreyschwartz/Library/Caches/Homebrew/downloads/49365c60d1cc44647d2a1be4b00c5b64054869ad66076ce528a8c22e6a03722b--bellsoft-jdk8u252+9-macos-amd64-full.pkg ==> Verifying SHA-256 checksum for Cask 'liberica-jdk8-full'. ==> Uninstalling Cask liberica-jdk8-full ==> Uninstalling packages: com.bell-sw.liberica.jdk8-full Password: ==> Purging files for version 1.8.0,252 of Cask liberica-jdk8-full ==> Installing Cask liberica-jdk8-full ==> Running installer for liberica-jdk8-full; your password may be necessary. ==> Package installers may write to any location; options such as --appdir are ignored. installer: Package name is Liberica JDK 8u252+9-full installer: Upgrading at base path / installer: The upgrade was successful. 🍺 liberica-jdk8-full was successfully installed! jeffreyschwartz@jeffreys-MacBook-Pro:~ export JAVA_HOME=(/usr/libexec/java_home -v 1.8) jeffreyschwartz@jeffreys-MacBook-Pro:~ brew uninstall openjdk
Error: No such keg: /usr/local/Cellar/openjdk
jeffreyschwartz@jeffreys-MacBook-Pro:~ ln -s /Library/Java/JavaVirtualMachines/liberica-jdk-8-full.jdk/Contents/Home /usr/local/opt/openjdkln: /usr/local/opt/openjdk/Home: Permission denied jeffreyschwartz@jeffreys-MacBook-Pro:~ sudo ln -s /Library/Java/JavaVirtualMachines/liberica-jdk-8-full.jdk/Contents/Home /usr/local/opt/openjdk
Password:
jeffreyschwartz@jeffreys-MacBook-Pro:~$ brew install ant --ignore-dependencies
Updating Homebrew…
==> Auto-updated Homebrew!
Updated 1 tap (homebrew/core).
==> Updated Formulae
bcoin joplin node

Warning: --ignore-dependencies is an unsupported Homebrew developer flag!
Adjust your PATH to put any preferred versions of applications earlier in the
PATH rather than using this unsupported flag!

Warning: ant 1.10.7_1 is already installed and up-to-date
To reinstall 1.10.7_1, run brew reinstall ant
jeffreyschwartz@jeffreys-MacBook-Pro:~ brew install libpq Warning: libpq 12.2_1 is already installed and up-to-date To reinstall 12.2_1, run `brew reinstall libpq` jeffreyschwartz@jeffreys-MacBook-Pro:~ cd ~/Downloads/sleuthkit-4.8.2
-bash: cd: /Users/jeffreyschwartz/Downloads/sleuthkit-4.8.2: No such file or directory
jeffreyschwartz@jeffreys-MacBook-Pro:~ cd ~/Downloads/sleuthkit-4.8.0 jeffreyschwartz@jeffreys-MacBook-Pro:~/Downloads/sleuthkit-4.8.0 make clean #to cleanup up previous build attempts
make: *** No rule to make target clean'. Stop. jeffreyschwartz@jeffreys-MacBook-Pro:~/Downloads/sleuthkit-4.8.0$ make make: *** No targets specified and no makefile found. Stop. jeffreyschwartz@jeffreys-MacBook-Pro:~/Downloads/sleuthkit-4.8.0$ ls API-CHANGES.txt Makefile.in aclocal.m4 configure.ac m4/ tests/ win32/ ChangeLog.txt NEWS.txt bindings/ docs/ man/ tools/ INSTALL.txt README.md config/ framework/ packages/ tsk/ Makefile.am README_win32.txt configure* licenses/ samples/ unit_tests/ jeffreyschwartz@jeffreys-MacBook-Pro:~/Downloads/sleuthkit-4.8.0$ ls API-CHANGES.txt Makefile.in aclocal.m4 configure.ac m4/ tests/ win32/ ChangeLog.txt NEWS.txt bindings/ docs/ man/ tools/ INSTALL.txt README.md config/ framework/ packages/ tsk/ Makefile.am README_win32.txt configure* licenses/ samples/ unit_tests/ jeffreyschwartz@jeffreys-MacBook-Pro:~/Downloads/sleuthkit-4.8.0$ make clean #to cleanup up previous build attempts make: *** No rule to make target clean’. Stop.
jeffreyschwartz@jeffreys-MacBook-Pro:~/Downloads/sleuthkit-4.8.0$ make
make: *** No targets specified and no makefile found. Stop.
jeffreyschwartz@jeffreys-MacBook-Pro:~/Downloads/sleuthkit-4.8.0$ sudo make install
Password:
make: *** No rule to make target `install’. Stop.
jeffreyschwartz@jeffreys-MacBook-Pro:~/Downloads/sleuthkit-4.8.0$

downey · April 24, 2020, 12:55am

I don’t have a Mac at hand to try this so I’m shooting in the dark here but…I think you need to run ‘./configure’ in the sleuthkit-4.8.0 directory. That step uses GNU autotools to generate the makefile, which according to your output above, is missing. Then you can run ‘make’ and ‘sudo make install’

Jeff · April 24, 2020, 1:53am

Thanks for your help. Your suggestion helped to get past that issue, but I seem to be back to where I was when trying to run unix_setup.sh. For some reason, I’m not creating sleuthkit-4.8.0.jar and installing it in the correct directory. I am not finding /usr/share/java/ or /usr/local/share/java/ on my machine.

Some of the output is below, I do have all the output available if needed.

effreyschwartz@jeffreys-MacBook-Pro:~/Downloads/sleuthkit-4.8.0$ ./configure
checking for a BSD-compatible install… /usr/bin/install -c
checking whether build environment is sane… yes
checking for a thread-safe mkdir -p… config/install-sh -c -d
checking for gawk… no
checking for mawk… no
checking for nawk… no
checking for awk… awk

config.status: executing tsk/tsk_incs.h commands
configure:
Building:
afflib support: yes
libewf support: yes
zlib support: yes
openssl support: no

libvhdi support: no
libvmdk support: no
postgresql support: no
Features:
Java/JNI support: yes
Multithreading: yes

jeffreyschwartz@jeffreys-MacBook-Pro:~/Downloads/sleuthkit-4.8.0$ make clean #to cleanup up previous build attempts
Making clean in tsk
Making clean in base
rm -rf .libs _libs
rm -f *.c~ *.h~
test -z “libtskbase.la” || rm -f libtskbase.la

BUILD SUCCESSFUL
Total time: 0 seconds
rm -f *.lo
rm -rf .libs _libs
rm -f *.lo
jeffreyschwartz@jeffreys-MacBook-Pro:~/Downloads/sleuthkit-4.8.0$ make
Making all in tsk
/Library/Developer/CommandLineTools/usr/bin/make all-recursive
Making all in base

…/libtool: line 1731: cd: .libs/libtsk.lax/libtskbase.a: No such file or directory
make[3]: *** [libtsk.la] Error 1
make[2]: *** [all-recursive] Error 1
make[1]: *** [all] Error 2
make: *** [all-recursive] Error 1
jeffreyschwartz@jeffreys-MacBook-Pro:~/Downloads/sleuthkit-4.8.0$ sudo make install
Password:
Making install in tsk
Making install in base
make[3]: Nothing to be done for install-exec-am'. make[3]: Nothing to be done for install-data-am’.
Making install in img
make[3]: Nothing to be done for install-exec-am'. make[3]: Nothing to be done for install-data-am’.
Making install in vs

…/libtool: line 1731: cd: .libs/libtsk.lax/libtskbase.a: No such file or directory
make[3]: *** [libtsk.la] Error 1
make[2]: *** [all-recursive] Error 1
make[1]: *** [all] Error 2
make: *** [all-recursive] Error 1
jeffreyschwartz@jeffreys-MacBook-Pro:~/Downloads/sleuthkit-4.8.0$ sudo make install
Password:
Making install in tsk
Making install in base
make[3]: Nothing to be done for install-exec-am'. make[3]: Nothing to be done for install-data-am’.
Making install in img
make[3]: Nothing to be done for install-exec-am'. make[3]: Nothing to be done for install-data-am’.
Making install in vs
make[3]: Nothing to be done for install-exec-am'. make[3]: Nothing to be done for install-data-am’.
Making install in fs
make[3]: Nothing to be done for install-exec-am'. make[3]: Nothing to be done for install-data-am’.
Making install in hashdb
make[3]: Nothing to be done for install-exec-am'. make[3]: Nothing to be done for install-data-am’.
Making install in auto
make[3]: Nothing to be done for install-exec-am'. make[3]: Nothing to be done for install-data-am’.
Making install in pool
make[3]: Nothing to be done for install-exec-am'. make[3]: Nothing to be done for install-data-am’.
Making install in util
make[3]: Nothing to be done for install-exec-am'. make[3]: Nothing to be done for install-data-am’.
/bin/sh …/libtool --tag=CC --mode=link gcc -Wall -Wextra -Wno-unused-parameter -g -O2 -version-info 20:0:1 -D_THREAD_SAFE -pthread -L/usr/local/lib -o libtsk.la -rpath /usr/local/lib base/libtskbase.la img/libtskimg.la vs/libtskvs.la fs/libtskfs.la hashdb/libtskhashdb.la auto/libtskauto.la pool/libtskpool.la util/libtskutil.la -lewf -ldl -lz -lafflib -lsqlite3 -ldl -lstdc++
libtool: link: rm -fr .libs/libtsk.19.dylib .libs/libtsk.dylib .libs/libtsk.lax
libtool: link: gcc -dynamiclib -Wl,-undefined -Wl,dynamic_lookup -o .libs/libtsk.19.dylib -Wl,-force_load,base/.libs/libtskbase.a -Wl,-force_load,img/.libs/libtskimg.a -Wl,-force_load,vs/.libs/libtskvs.a -Wl,-force_load,fs/.libs/libtskfs.a -Wl,-force_load,hashdb/.libs/libtskhashdb.a -Wl,-force_load,auto/.libs/libtskauto.a -Wl,-force_load,pool/.libs/libtskpool.a -Wl,-force_load,util/.libs/libtskutil.a -L/usr/local/lib -lewf -lz -lafflib -lsqlite3 -ldl -lstdc++ -g -O2 -pthread -pthread -install_name /usr/local/lib/libtsk.19.dylib -compatibility_version 21 -current_version 21.0 -Wl,-single_module
libtool: link: (cd “.libs” && rm -f “libtsk.dylib” && ln -s “libtsk.19.dylib” “libtsk.dylib”)
…/libtool: line 5690: cd: /Users/jeffreyschwartz/.Trash/sleuthkit-4.8: No such file or directory
libtool: link: (cd .libs/libtsk.lax/libtskbase.a && ar x “/Users/jeffreyschwartz/.Trash/sleuthkit-4.8 6.15.11 PM.0/tsk/base/.libs/libtskbase.a”)
…/libtool: line 1731: cd: .libs/libtsk.lax/libtskbase.a: No such file or directory
make[2]: *** [libtsk.la] Error 1
make[1]: *** [install-recursive] Error 1
make: *** [install-recursive] Error 1

jeffreyschwartz@jeffreys-MacBook-Pro:~/Downloads/autopsy-4.14.0$ sh unix_setup.sh

Checking prerequisites and preparing Autopsy:

-n Checking for PhotoRec…
found in /usr/local/bin
-n Checking for Java…
found in /Library/Java/JavaVirtualMachines/liberica-jdk-8-full.jdk/Contents/Home
-n Checking for Sleuth Kit Java bindings…
ERROR: sleuthkit-4.8.0.jar not found in /usr/share/java/ or /usr/local/share/java/.
Please install the Sleuth Kit Java bindings file.
See https://github.com/sleuthkit/sleuthkit/releases.
jeffreyschwartz@jeffreys-MacBook-Pro:~/Downloads/autopsy-4.14.0$

downey · April 24, 2020, 3:19am

Looks like the sleuthkit isn’t building successfully. I’m going to take another shot in the dark and wonder whether it is because the output from configure indicates that you don’t have postgresql support (i.e. you are missing libpq).
Try doing a ‘brew install libpq’ then re-run ‘./configure’ and make. If ‘make’ doesn’t succeed it doesn’t make sense to move onto the ‘sudo make install’ and unix_setup.sh steps.

Jeff · April 24, 2020, 4:16am

Might be making progress, I hope. Ran the command and it said it was already installed. I did a reinstall and it gave some options.

effreyschwartz@jeffreys-MacBook-Pro:~/Downloads/sleuthkit-4.8.0$ brew install libpq
Updating Homebrew…
==> Auto-updated Homebrew!
Updated 2 taps (homebrew/core and homebrew/cask).
==> Updated Formulae
userspace-rcu cargo-completion goreleaser libdap msmtp pspg wolfssl
angular-cli catch2 inxi mesa nativefier sd xmrig
apollo-cli contentful-cli istioctl metabase nomad serverless
autopep8 doctl jrtplib mill powerline-go shadowenv
==> Updated Casks
alt-tab datweatherdoe goland plexamp

Warning: libpq 12.2_1 is already installed and up-to-date
To reinstall 12.2_1, run brew reinstall libpq
jeffreyschwartz@jeffreys-MacBook-Pro:~/Downloads/sleuthkit-4.8.0$ brew reinstall libpq
==> Reinstalling libpq
==> Installing dependencies for libpq: openssl@1.1 and krb5
==> Installing libpq dependency: openssl@1.1
==> Downloading https://homebrew.bintray.com/bottles/openssl@1.1-1.1.1g.mojave.bottle.tar.gz
==> Downloading from https://akamai.bintray.com/5c/5c9d113393ff3efc95e5509175305fc9304fba35390a61915ed2864941c423f2?gda=exp=1587700062~h
######################################################################## 100.0%
==> Pouring openssl@1.1-1.1.1g.mojave.bottle.tar.gz
==> Caveats
A CA file has been bootstrapped using certificates from the system
keychain. To add additional certificates, place .pem files in
/usr/local/etc/openssl@1.1/certs

and run
/usr/local/opt/openssl@1.1/bin/c_rehash

openssl@1.1 is keg-only, which means it was not symlinked into /usr/local,
because macOS provides LibreSSL.

If you need to have openssl@1.1 first in your PATH run:
echo ‘export PATH="/usr/local/opt/openssl@1.1/bin:$PATH"’ >> ~/.bash_profile

For compilers to find openssl@1.1 you may need to set:
export LDFLAGS="-L/usr/local/opt/openssl@1.1/lib"
export CPPFLAGS="-I/usr/local/opt/openssl@1.1/include"

==> Summary
/usr/local/Cellar/openssl@1.1/1.1.1g: 8,059 files, 18MB
==> Installing libpq dependency: krb5
==> Downloading https://homebrew.bintray.com/bottles/krb5-1.18.1.mojave.bottle.tar.gz
==> Downloading from https://akamai.bintray.com/01/0171567eb1400f14a4cf9a62b637b79587e4b6fcbeb8ee9c7700da5a9bade2c3?gda=exp=1587700106~h
######################################################################## 100.0%
==> Pouring krb5-1.18.1.mojave.bottle.tar.gz
==> Caveats
krb5 is keg-only, which means it was not symlinked into /usr/local,
because macOS already provides this software and installing another version in
parallel can cause all kinds of trouble.

If you need to have krb5 first in your PATH run:
echo ‘export PATH="/usr/local/opt/krb5/bin:$PATH"’ >> ~/.bash_profile
echo ‘export PATH="/usr/local/opt/krb5/sbin:$PATH"’ >> ~/.bash_profile

For compilers to find krb5 you may need to set:
export LDFLAGS="-L/usr/local/opt/krb5/lib"
export CPPFLAGS="-I/usr/local/opt/krb5/include"

==> Summary
/usr/local/Cellar/krb5/1.18.1: 162 files, 3.8MB
==> Installing libpq
==> Downloading https://homebrew.bintray.com/bottles/libpq-12.2_1.mojave.bottle.tar.gz
Already downloaded: /Users/jeffreyschwartz/Library/Caches/Homebrew/downloads/5b3d2a52e86c97013726a4524832018709b8132c1f2bfed1210dafaccf4f8a27–libpq-12.2_1.mojave.bottle.tar.gz
==> Pouring libpq-12.2_1.mojave.bottle.tar.gz
==> Caveats
libpq is keg-only, which means it was not symlinked into /usr/local,
because conflicts with postgres formula.

If you need to have libpq first in your PATH run:
echo ‘export PATH="/usr/local/opt/libpq/bin:$PATH"’ >> ~/.bash_profile

For compilers to find libpq you may need to set:
export LDFLAGS="-L/usr/local/opt/libpq/lib"
export CPPFLAGS="-I/usr/local/opt/libpq/include"

==> Summary
/usr/local/Cellar/libpq/12.2_1: 2,240 files, 23.7MB
==> Caveats
==> openssl@1.1
A CA file has been bootstrapped using certificates from the system
keychain. To add additional certificates, place .pem files in
/usr/local/etc/openssl@1.1/certs