sleuthkit-4.15.0.jar ships with empty NATIVELIBS/amd64/linux/ directory

[Usman0220]

Problem

The sleuthkit-4.15.0.jar bundled with Autopsy 4.23.1 contains an empty NATIVELIBS/amd64/linux/ directory - no libtsk_jni.so file. This means SleuthkitJNI can never load the native library from the jar on Linux, regardless of classloader behavior.

$ jar tf sleuthkit-4.15.0.jar | grep NATIVELIBS/amd64/linux
NATIVELIBS/amd64/linux/       <-- empty, no .so file

Compare with the Windows DLLs which are present:

NATIVELIBS/amd64/win/libtsk_jni.dll   <-- present

Impact

On Linux, the native library loading always falls through to the "Library not found in jar" path. This works only if:

1. sleuthkit-java is installed system-wide (providing /usr/lib/x86_64-linux-gnu/libtsk_jni.so)
2. The LibraryUtils class has a System.loadLibrary fallback

Without the system package, Autopsy cannot load the JNI library on Linux.

Fix

Include libtsk_jni.so in NATIVELIBS/amd64/linux/ during the jar build process, or alternatively bundle a system-loadable copy alongside the jar.