Re: [sleuthkit-users] Installation Problems (and hello!)

[Barry J. G. <bg...@im...>]

On Wed, 2006-02-08 at 16:16 +0000, Stuart Bird wrote:

> I then tried "man sleuthkit" and got a "not found". I tried a couple of 
> commands on a test dd image. Each time command not found. I tried 
> "whereis sleuthkit" and again nothing found.

Hi Stuart.

The "man sleuthkit" won't work because sleuthkit is the collection of
tools, not the command.  

When you untarred sleuthkit, and typed "make", you ended up with a
number of directories in that current directory.  One of those is ./bin
and another is ./man

./sleuthkit-2.xx/bin
./sleuthkit-2.xx/man/man1 (for command usage)

(note that the "./" indicates "from the current directory".)

in order to use the programs, you have to either call the program with
the explicit path, copy them to a direcory that is in you $PATH
(/usr, /usr/bin/ ...) or add their current directory to your $PATH.  I
usually choose to leave them where they are and either call them
explicity or use symlinks.

So, to use fsstat, I would type:

timmy Exercises # ~/tools/sleuthkit-2.03/bin/fsstat practical.floppy.dd

...to run fsstat on a floppy image in the "Exercises" directory.  Note
that I had to give the full path to the tool.

Again, if you want to run the man page for a given tool, change to
the ./sleuthkit-2.xx/man/man1 directory and look at the man page using:

timmy man1 # man ./fsstat.1

Note again that the ./ indicates that the file "fsstat.1" is located in
the current directory.

Do a little search on "$PATH" and "$MANPATH" to learn more about why you
either need to edit these paths or move/copy/link the files elsewhere.
Remember, Linux does not look in you current directory by default (like
DOS) for a command.  

HTH a litte...

Also, note that "whereis" normally uses hard coded paths, so it most
likely won't find TSK tools unless they are moved/copied/linked to
standard "program" locations for Linux.  You could use "locate", but
would have to run "updatedb" first.

Barry

-- 
/***************************************
Special Agent Barry J. Grundy
NASA Office of Inspector General
Computer Crimes Division 
Goddard Space Flight Center
Code 190
Greenbelt Rd.
Greenbelt, MD 20771
(301)286-3358
**************************************/