search

sleuthkit / autopsy

Autopsy® is a digital forensics platform and graphical interface to The Sleuth Kit® and other digital forensics tools. It can be used by law enforcement, military, and corporate examiners to investigate what happened on a computer. You can even use it to recover photos from your camera's memory card.
http://www.sleuthkit.org/autopsy/
2.41k stars 597 forks source link

It works in CAINE (Ubuntu 16.04) and it works on local disks! #3562

Open nannib opened 6 years ago

nannib commented 6 years ago

I installed following your procedure, but when I tried to install sleuthkit-java_4.6.0-1_amd64.deb I got an error. If I try to launch Autopsy sh ./autopsy I got an error, it cannot find the sluethkit-4.6.0.jar file: ERROR: /usr/share/java/sleuthkit-4.6.0.jar not found, please install the sleuthkit-java_4.6.0-1_amd64.deb file. So, I used Engrampa Archive Manager and I extract the file inside the sleuthkit-java_4.6.0-1_amd64.deb into the matching directories of my system (e.g. /usr/share/java, etc.) then when I ran ./autopsy it worked! For working on local disk, you can simply run sudo ./autopsy That's all. Finally the problem is only with the sleuthkit-java_4.6.0-1_amd64.deb PS.1: If you get this error: ERROR: JAVA_HOME environment variable must be defined You can logout then login in your system and the variable is set or try to write export JAVA_HOME, as written by DKARPO in this issues repo. PS.2: Autopsy for Linux seems faster than for Windows ;-)

bcarrier commented 6 years ago

Thanks. What error did you get when you tried to install the .deb file?

nannib commented 6 years ago

sudo apt install ./sleuthkit-java_4.6.0-1_amd64.deb Reading package lists... Done Building dependency tree
Reading state information... Done Note, selecting 'sleuthkit-java' instead of './sleuthkit-java_4.6.0-1_amd64.deb' The following NEW packages will be installed sleuthkit-java 0 to upgrade, 1 to newly install, 0 to remove and 404 not to upgrade. 5 not fully installed or removed. Need to get 0 B/6,026 kB of archives. After this operation, 9,182 kB of additional disk space will be used. Get:1 /home/caine/Downloads/sleuthkit-java_4.6.0-1_amd64.deb sleuthkit-java amd64 4.6.0-1 [6,026 kB] (Reading database ... 237425 files and directories currently installed.) Preparing to unpack .../sleuthkit-java_4.6.0-1_amd64.deb ... Unpacking sleuthkit-java (4.6.0-1) ... dpkg: error processing archive /home/caine/Downloads/sleuthkit-java_4.6.0-1_amd64.deb (--unpack): trying to overwrite '/usr/lib/x86_64-linux-gnu/libtsk.so.13', which is also in package libtsk13 4.2.0-3 Processing triggers for libc-bin (2.23-0ubuntu9) ... Errors were encountered while processing: /home/caine/Downloads/sleuthkit-java_4.6.0-1_amd64.deb E: Sub-process /usr/bin/dpkg returned an error code (1)

bcarrier commented 6 years ago

There is a conflict with libtsk.so, which sleuthkit-java is trying to install and you also got from libtsk package.

In a future release, sleuthkit-java package depends on sleuthkit package. There just wasn't an official libtsk package for the most recent 4.6.0 release. So, we packaged it ourselves so that we could more easily make changes.

At a minimum, the next version of this should more clearly state that it conflicts with libtsk13. Did you overwrite '/usr/lib/x86_64-linux-gnu/libtsk.so.13' when you did it manually?

nannib commented 6 years ago

No! I simply decompress the sleuthkit-java_4.6.0-1_amd64.deb and I copied the files into the matching directories (e.g. /usr/share/java/etc.) I never touched libtsk13. If you read the sleuthkit-users mailing list, the user Danilo M. wrote that he removed libtsk13 and the sleuthkit-java_4.6.0-1_amd64.deb worked. I did not remove libtsk13, so sleuthkit-java_4.6.0-1_amd64.deb does not work, but autopsy works because the decompression and manual copying of the content of /sleuthkit-java_4.6.0-1_amd64.deb

compufuzz commented 6 years ago

still having this issue with the latest release, downloaded today. Nanni's fix works, though. Followed all instructions as written in the zip file, received error message re: could not find sleuthkit.jar.

UPDATE: Nope. Did not work after all. received an error pertaining to "vmdk.so" not being able to open a shared file or something (went by so fast I missed it); however, splash screen pops and main window opens - but I cannot start a case - no functionality. Have tried to replicate the vmdk error, but no luck.

ideas?

Environment: LInux Mint 17 Qiana