This error can occur when a user attempts to create a BlackLight case file in a location that is not supported.
A BlackLight case file can be supported locally on an internal or external drive formatted as NTFS, HFS+, or APFS. For best performance, we recommend creating a BlackLight case file on the internal disk of the analysis machine where the OS is installed.
A BlackLight case file is not supported on a network location or on drives formatted as ExFAT or FAT file systems.
We officially support running BlackLight and creating case files on Windows 7, 8, 10, Windows Server 2016, and macOS 10.11 (El Capitan), 10.12 (Sierra), 10.13 (High Sierra), 10.14 (Mojave). Keep in mind the OS BlackLight is running on must be able to write to file system the case file is created on. Natively, macOS does not write to NTFS.
If you are creating a case file on a supported setup explained above and still encounter this error, please follow the steps below.
1- Open BlackLight
2- Open the Debug Console
To enable the debug console:
1- Hold down the SHIFT key while clicking on [Help] menu (Win) or [BlackLight] menu (Mac) and select [About BlackLight]. A window will appear in the lower left corner called 'Debug Console.'
2- At the bottom of the debug console, type the word logfile and hit enter key. This will create a text file on your desktop called ConsoleLog and records the Debug Console data.
*You can dismiss the ‘About BlackLight’ window but leave the ‘Debug Console’ window open.
3- Click on the New button and attempt to create the new case file
4- After the error displays, send the ConsoleLog file to support@blackbagtech.com with a description of the error and the technical support team will assist you.