sleuthkit-developers — A list to discuss development of new features of The Sleuth Kit and Autopsy

[sleuthkit-developers] DFXML Schema draft validates Fiwalk output

[Alex N. <ajn...@cs...>]

Hi all,

This is an annotation for a patch I realize now could've been titled with
some more vigor:
<https://github.com/sleuthkit/sleuthkit/pull/212>

There is now a draft XML Schema that validates the output of Fiwalk, once
that patch with XML code motion is merged.  The schema is at this
repository:
<https://github.com/dfxml-working-group/dfxml_schema>

The schema's version currently includes "rfc" for "Request for comments."
 It would be helpful for any Fiwalk or DFXML users to provide feedback on
the schema.

As for how to give feedback, anybody is welcome to:
* Join the discussion mailing list, df...@ni...: <
https://email.nist.gov/mailman/listinfo/dfxml>;
* Open a Github Issue on the schema repository (which may be cleanest for
easily actionable issues); or
* Email the sleuthkit-users or sleuthkit-developers list (or even me).

I don't mean to overload the sleuthkit lists.  The DFXML working group is
trying to make DFXML a topic of a bigger community than just TSK.  However,
discussion wherever it occurs will be good discussion.

--Alex

[sleuthkit-developers] TSK Jar file and Autopsy change

[Brian C. <ca...@sl...>]

For the folks building Autopsy from source, when you next do a pull of Autopsy, you'll also need a pull of TSK and rebuild it (and then rebuild Autopsy). The TSK Jar file now includes all of the native libraries inside of it so the building and launching process is a bit different.

[sleuthkit-developers] Bug in the icat command into sleuthkit-4.1.0 version for EXT4 support

[Maikel A. <mai...@gm...>]

Hi all:

I'm testing the 4.1.0 version of sleuthkit and I think I've found a bug.

I've compiled the sources downloaded from

http://sourceforge.net/projects/sleuthkit/files/sleuthkit/4.1.0/sleuthkit-4.1.0.tar.gz/download

and then when I use the command

# fls -f ext4 -dpFrl /dev/sda3 on my Ubuntu 13.04 64bits



I get correctly many line with information about deleted files

all lines are like

r/r * 483647:    home/mainu/Imágenes/IMG_
20121114_190334.jpg    2013-09-05 07:12:50 (CEST)    2013-09-03 23:05:13
(CEST)    2013-09-05 07:12:50 (CEST)    2012-11-19 16:16:30 (CET)    0
1000    1000

but problem is when I run the command

./icat -f ext4 -r /dev/sda3 483647 >picture.jpg

for any deleted file when I run an icat command like this I'm getting this
error message

Invalid API argument (tsk_fs_attrlist_get: Null list pointer)

and nothing is recovered.

This is not happening for fat deleted files. They are recovered correctly.

Is there a bug in the ext4 support? What do you think?

Thanks in advance.
Makelen

Re: [sleuthkit-developers] TSK_OFF_T and TSK_DADDR_T

[Brian C. <ca...@sl...>]

I use TSK_OFF_T for bye offsets and lengths and TSK_DADDR_T for block/sector addresses. In theory, there is little difference and you can use them interchangeably (they are both 64-bit integers).   Over the years, I have found it very useful to be very clear about which variables are storing offsets in bytes and which are in sectors/blocks because it is easy to get them confused. 

To be honest, I forget why TSK_OFF_T is signed and not unsigned like TSK_DADDR_T. I thought it was because it was being returned by the various _read() methods and they need to return -1. But, ssize_t is returned there (though I forget if TSK_OFF_T was once returned from there...).  Is this causing a problem, or just curious?



On Aug 29, 2013, at 1:11 AM, Robert James <sro...@gm...> wrote:

> What is the difference in intention between TSK_OFF_T and TSK_DADDR_T?
> Why is TSK_OFF_T signed?
> 
> ------------------------------------------------------------------------------
> Learn the latest--Visual Studio 2012, SharePoint 2013, SQL 2012, more!
> Discover the easy way to master current and previous Microsoft technologies
> and advance your career. Get an incredible 1,500+ hours of step-by-step
> tutorial videos with LearnDevNow. Subscribe today and save!
> http://pubads.g.doubleclick.net/gampad/clk?id=58040911&iu=/4140/ostg.clktrk
> _______________________________________________
> sleuthkit-developers mailing list
> sle...@li...
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-developers

[sleuthkit-developers] TSK_OFF_T and TSK_DADDR_T

[Robert J. <sro...@gm...>]

What is the difference in intention between TSK_OFF_T and TSK_DADDR_T?
Why is TSK_OFF_T signed?

[sleuthkit-developers] Finding byte offset of file on disk

[Robert J. <sro...@gm...>]

>From a TSK_FS_META, I know how to find the offset of every run making
up the file. But those offsets are relative to the start of the
_filesystem_, and in units of filesystem blocks.

I'd like to turn those into offsets relative to the start of the
_disk_, factoring in any filesystem or volume system. And I'd like
them in units of bytes (or device sectors).

That is, given a TSK_FS_META, I'd like to find the byte offset in the
disk of the runs. Something I could feed right into dd. Can I do this?
How?

Re: [sleuthkit-developers] Autopsy 3 module development: Loading an external ingest module from netbeans

[Petter C. B. <pet...@hi...>]

Thanks Brian,

I'm using the 3.0.6 release of the Autopsy platform.

Petter


2013/8/23 Brian Carrier <ca...@sl...>

> Hi Petter,
>
> Are you using the released version of Autopsy as a platform or source?
> There were problems doing this from the released 3.0.6 version, but it
> should be fixed if you are doing it from the latest github repo.
>
> I'll update those docs to make sure that it is clear that the reboot
> reference is if the module is being installed after packaging.  This page
> is more relevant at the bottom for development.
>
> http://www.sleuthkit.org/autopsy/docs/api-docs/mod_dev_page.html
>
> brian
>
>
>
> On Aug 22, 2013, at 5:28 PM, Petter Christian Bjelland <
> pet...@hi...> wrote:
>
> > Hi,
> >
> > Is there a correct way to dynamically load an external ingest module
> into Autopsy 3? What I want to do is to right-click on my module in
> netbeans and hit "run".
> >
> > Without any modifications Autopsy does not list the module under "Add
> Data Source" -> "Configure Ingest Modules". Reinstalling the .nbm for each
> update is not really an option.
> >
> > I've made this solution using the @OnStart annotation which checks if
> the module is loaded in the IngestManager or not, but it doesn't feel right.
> >
> > @OnStart
> > public class MyModuleStarter implements Runnable {
> >
> >     @Override
> >     public void run() {
> >         List<IngestModuleAbstractFile> modules =
> IngestManager.getDefault().enumerateAbstractFileModules();
> >
> >         boolean started = false;
> >
> >         for (IngestModuleAbstractFile module : modules) {
> >             if (module instanceof MyIngestModule) {
> >                 started = true;
> >                 break;
> >             }
> >         }
> >
> >         if (!started) {
> >             modules.add(MyIngestModule.getDefault());
> >         }
> >     }
> > }
> >
> > Sorry if I've missed something obvious in the docs, but they seem to
> suggest that you need to reinstall the module every time you want to test
> changes. (
> http://www.sleuthkit.org/autopsy/docs/api-docs/mod_ingest_page.html#ingestmodule_registration
> )
> >
> > Thanks
> >
> > Petter
> >
> ------------------------------------------------------------------------------
> > Introducing Performance Central, a new site from SourceForge and
> > AppDynamics. Performance Central is your source for news, insights,
> > analysis and resources for efficient Application Performance Management.
> > Visit us today!
> >
> http://pubads.g.doubleclick.net/gampad/clk?id=48897511&iu=/4140/ostg.clktrk_______________________________________________
> > sleuthkit-developers mailing list
> > sle...@li...
> > https://lists.sourceforge.net/lists/listinfo/sleuthkit-developers
>
>

Re: [sleuthkit-developers] Autopsy 3 module development: Loading an external ingest module from netbeans

[Brian C. <ca...@sl...>]

Hi Petter,

Are you using the released version of Autopsy as a platform or source? There were problems doing this from the released 3.0.6 version, but it should be fixed if you are doing it from the latest github repo.

I'll update those docs to make sure that it is clear that the reboot reference is if the module is being installed after packaging.  This page is more relevant at the bottom for development.
	
http://www.sleuthkit.org/autopsy/docs/api-docs/mod_dev_page.html

brian



On Aug 22, 2013, at 5:28 PM, Petter Christian Bjelland <pet...@hi...> wrote:

> Hi,
> 
> Is there a correct way to dynamically load an external ingest module into Autopsy 3? What I want to do is to right-click on my module in netbeans and hit "run".
> 
> Without any modifications Autopsy does not list the module under "Add Data Source" -> "Configure Ingest Modules". Reinstalling the .nbm for each update is not really an option.
> 
> I've made this solution using the @OnStart annotation which checks if the module is loaded in the IngestManager or not, but it doesn't feel right.
> 
> @OnStart
> public class MyModuleStarter implements Runnable {
> 
>     @Override
>     public void run() {        
>         List<IngestModuleAbstractFile> modules = IngestManager.getDefault().enumerateAbstractFileModules();
>         
>         boolean started = false;
> 
>         for (IngestModuleAbstractFile module : modules) {
>             if (module instanceof MyIngestModule) {
>                 started = true;
>                 break;
>             }
>         }
> 
>         if (!started) {
>             modules.add(MyIngestModule.getDefault());
>         }
>     }
> }
> 
> Sorry if I've missed something obvious in the docs, but they seem to suggest that you need to reinstall the module every time you want to test changes. (http://www.sleuthkit.org/autopsy/docs/api-docs/mod_ingest_page.html#ingestmodule_registration)
> 
> Thanks
> 
> Petter
> ------------------------------------------------------------------------------
> Introducing Performance Central, a new site from SourceForge and 
> AppDynamics. Performance Central is your source for news, insights, 
> analysis and resources for efficient Application Performance Management. 
> Visit us today!
> http://pubads.g.doubleclick.net/gampad/clk?id=48897511&iu=/4140/ostg.clktrk_______________________________________________
> sleuthkit-developers mailing list
> sle...@li...
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-developers

Re: [sleuthkit-developers] TskAuto filterVs

[Robert J. <sro...@gm...>]

On 8/22/13, Brian Carrier <ca...@sl...> wrote:
 > On Aug 22, 2013, at 6:13 AM, Robert James <sro...@gm...> wrote:
 >
 >> I'm using TskAuto and would like to implement the filterVs method.  I
 >> have a few questions:
 >>
 >> 1. filterVs receives a C structure (const TSK_VS_INFO *).  I'd like to
 >> access it via the C++ TskVsInfo wrapper.  But simply doing
 >> TskVsInfo(vs_info) gives compiler errors due to the const attribute of
 >> the struct's pointer.  There doesn't seem to be a constructor for
 >> TskVsInfo which takes a const pointer.
 >>
 >> How should I initialize the TskVsInfo from the TSK_VS_INFO struct
 >> passed to filterVs?
 >
 > It appears that you can't.  But, what do you want to do with the
 > TSK_VS_INFO/TskVsInfo struct/class?
 >
 > The main motivation for filterVs is to let the app skip the system or not.
 > If you decide to process it, then you'll get another callback for each
 > partition in filterVol().
 >
> Knowing your use case could help to change the design (we've designed these
 > based on our use cases).

My use case isn't as a filter, but to have the volume system and
 partition info available during processFile. I didn't see anyway to
 pick these up directly, so I overrode the filter methods to store
 currentVol in member variables.

 (I can do this with the C *_INFO structs, but, if classes are
 available, prefer those.)

 > Hope this helps.  If this gets more into the weeds, let's drop the
 > sleuthkit-users list off.

Thank you! Moved to sleuthkit-developers list.

[sleuthkit-developers] Autopsy 3 module development: Loading an external ingest module from netbeans

[Petter C. B. <pet...@hi...>]

Hi,

Is there a correct way to dynamically load an external ingest module into
Autopsy 3? What I want to do is to right-click on my module in netbeans and
hit "run".

Without any modifications Autopsy does not list the module under "Add Data
Source" -> "Configure Ingest Modules". Reinstalling the .nbm for each
update is not really an option.

I've made this solution using the @OnStart annotation which checks if the
module is loaded in the IngestManager or not, but it doesn't feel right.

@OnStart
public class MyModuleStarter implements Runnable {

    @Override
    public void run() {
        List<IngestModuleAbstractFile> modules =
IngestManager.getDefault().enumerateAbstractFileModules();

        boolean started = false;

        for (IngestModuleAbstractFile module : modules) {
            if (module instanceof MyIngestModule) {
                started = true;
                break;
            }
        }

        if (!started) {
            modules.add(MyIngestModule.getDefault());
        }
    }
}

Sorry if I've missed something obvious in the docs, but they seem to
suggest that you need to reinstall the module every time you want to test
changes. (
http://www.sleuthkit.org/autopsy/docs/api-docs/mod_ingest_page.html#ingestmodule_registration
)

Thanks

Petter

Re: [sleuthkit-developers] [sleuthkit-users] TskAuto filterVs

[Brian C. <ca...@sl...>]

Hi Robert,

[adding sleuthkit-developers list since this topic is more targeted at that audience]

On Aug 22, 2013, at 6:13 AM, Robert James <sro...@gm...> wrote:

> I'm using TskAuto and would like to implement the filterVs method.  I
> have a few questions:
> 
> 1. filterVs receives a C structure (const TSK_VS_INFO *).  I'd like to
> access it via the C++ TskVsInfo wrapper.  But simply doing
> TskVsInfo(vs_info) gives compiler errors due to the const attribute of
> the struct's pointer.  There doesn't seem to be a constructor for
> TskVsInfo which takes a const pointer.
> 
> How should I initialize the TskVsInfo from the TSK_VS_INFO struct
> passed to filterVs?

It appears that you can't.  But, what do you want to do with the TSK_VS_INFO/TskVsInfo struct/class? 

The main motivation for filterVs is to let the app skip the system or not. If you decide to process it, then you'll get another callback for each partition in filterVol(). 

To be honest, there are some inconsistencies with how much const is used in the C and C++ classes.   The older code doesn't have any uses and it has slowly evolved to use it more in the relevant places.  For example, filterFs() doesn't have a const value passed in. 

Knowing your use case could help to change the design (we've designed these based on our use cases).

> 2. Is filterVs always called? Or can there be a partition or file
> which is not part of any volume system?  If it's not always called,
> how should I set the TskVsInfo pointer to NULL? Simple assignment
> gives error: "error: ‘TskVsInfo::TskVsInfo(const TskVsInfo&)’ is
> private".

filterVs is called only if a file system is detected.  If you point TskAuto at a logical partition (i.e. just a file system with no volume system around it), then filterVs will never be called. If you look at TskAutoDb::filterFs (in tsk/auto/auto_db.cpp), it has logic to see if filterVol was previously called.  The TskAutoDb class keeps internal state to know if it is operating inside of a volume or not.

Hope this helps.  If this gets more into the weeds, let's drop the sleuthkit-users list off.

brian

[sleuthkit-developers] More Autopsy Sample Modules

[Brian C. <ca...@sl...>]

To make sure that we have healthy module writing competition at the Open Source Digital Forensics Conference (www.osdfcon.org), I updated the developer docs again for Autopsy modules. There are now more sample modules to use as a starting template.

	http://sleuthkit.org/autopsy/docs/api-docs/

Let me know if you have questions along the way.  I'm sure there are features that we did not design into it that could be useful.  We're adding them all of the time ourselves.

brian

[sleuthkit-developers] Updated DataContentViewer Docs

[Brian C. <ca...@sl...>]

I realized this week while debugging something that the docs for DataContentViewer module development in Autopsy weren't that great. For those who were thinking about making one for the module writing competition (http://www.basistechweek.com/osdf.html#contest), there are updated docs and a sample module that should be easy to follow. 

	http://sleuthkit.org/autopsy/docs/api-docs/mod_content_page.html

For those who have no clue what I am talking about, the DataContentViewers are the viewers in the lower right hand corner that show a file in hex, strings, play videos, etc.  Anyone can make their own viewer for that area.

brian

[sleuthkit-developers] Fwd: Re: fiwalk compilation error using --with-libewf parameter

[Willi B. <wil...@gm...>]

Sorry, meant to reply all.
---------- Forwarded message ----------
From: "Willi Ballenthin" <wil...@gm...>
Date: Aug 5, 2013 6:26 PM
Subject: Re: [sleuthkit-developers] fiwalk compilation error using
--with-libewf parameter
To: "Simson Garfinkel" <si...@ac...>
Cc:

CPPFLAGS are the flags for the C preprocessor, while CXXFLAGS are the flags
for the C++ compiler.

I'm aware that the issue is not visible if libewf is installed in a
standard location, however the documentation describes the optional flag
for LIBEWF_HOME. So, perhaps its a bug with the documentation and the
non-standard library location shouldn't be supported?

Thanks,
Willi
On Aug 5, 2013 6:08 PM, "Simson Garfinkel" <si...@ac...> wrote:

> Possibly the LIBEWF_HOME is apparently in some Makefiles but not others. I
> suspect that the problem will go away of the include file was installed in
> a standard location.
>
> You shouldn't be adding -I to CFLAGS or CXXFLAGS; it should be added to
> CPPFLAGS, since -I is a cpp issue.
>
> I didn't make the current Makefile that fiwalk is using; that was built by
> Kevin Fairbanks. Perhaps he can help.
>
>
>
> [Mucha ~]$ grep -l -r LIBEWF_HOME gits/sleuthkit
> gits/sleuthkit/bindings/java/build-windows.xml
> gits/sleuthkit/framework/INSTALL_win.txt
> gits/sleuthkit/framework/msvcpp/build-deps.pl
> gits/sleuthkit/framework/msvcpp/framework/framework.vcproj
> gits/sleuthkit/framework/msvcpp/framework/framework.vcxproj
> gits/sleuthkit/framework/msvcpp/Makefile
> gits/sleuthkit/release/release-win.pl
> gits/sleuthkit/win32/blkcalc/blkcalc.vcxproj
> gits/sleuthkit/win32/blkcat/blkcat.vcxproj
> gits/sleuthkit/win32/blkls/blkls.vcxproj
> gits/sleuthkit/win32/blkstat/blkstat.vcxproj
> gits/sleuthkit/win32/BUILDING.txt
> gits/sleuthkit/win32/callback-cpp-sample/callback-cpp-sample.vcxproj
> gits/sleuthkit/win32/callback-sample/callback-sample.vcxproj
> gits/sleuthkit/win32/fcat/fcat.vcxproj
> gits/sleuthkit/win32/ffind/ffind.vcxproj
> gits/sleuthkit/win32/fls/fls.vcxproj
> gits/sleuthkit/win32/fsstat/fsstat.vcxproj
> gits/sleuthkit/win32/hfind/hfind.vcxproj
> gits/sleuthkit/win32/icat/icat.vcxproj
> gits/sleuthkit/win32/ifind/ifind.vcxproj
> gits/sleuthkit/win32/ils/ils.vcxproj
> gits/sleuthkit/win32/img_cat/img_cat.vcxproj
> gits/sleuthkit/win32/img_stat/img_stat.vcxproj
> gits/sleuthkit/win32/istat/istat.vcxproj
> gits/sleuthkit/win32/jcat/jcat.vcxproj
> gits/sleuthkit/win32/jls/jls.vcxproj
> gits/sleuthkit/win32/libtsk/libtsk.vcxproj
> gits/sleuthkit/win32/mmcat/mmcat.vcxproj
> gits/sleuthkit/win32/mmls/mmls.vcxproj
> gits/sleuthkit/win32/mmstat/mmstat.vcxproj
> gits/sleuthkit/win32/posix-cpp-sample/posix-cpp-sample.vcxproj
> gits/sleuthkit/win32/posix-sample/posix-sample.vcxproj
> gits/sleuthkit/win32/tsk_comparedir/tsk_compare.vcxproj
> gits/sleuthkit/win32/tsk_gettimes/tsk_gettimes.vcxproj
> gits/sleuthkit/win32/tsk_jni/tsk_jni.vcxproj
> gits/sleuthkit/win32/tsk_loaddb/tsk_loaddb.vcxproj
> gits/sleuthkit/win32/tsk_recover/tsk_recover.vcxproj
> [Mucha ~]$
>
>
> On Aug 5, 2013, at 2:54 PM, Brian Carrier <ca...@sl...> wrote:
>
> > Simson, any ideas on this?  I haven't looked at the fiwalk auto stuff
> much.
> >
> > On Jul 30, 2013, at 11:10 PM, Willi Ballenthin <wil...@gm...>
> wrote:
> >
> >> I've been building TSK with libewf support using the --with-libewf
> parameter, but I think there may be a bug in the makefile generated for
> fiwalk. On my Ubuntu/Debian system with both gcc and g++, g++ is chosen to
> compile fiwalk:
> >>
> >>    me$ LIBEWF_HOME=$(pwd)/../libewf/build ./configure
> --with-libew$(pwd)/../libewf/build/ --prefix=$(pwd)/build/;
> >>    me$ LIBEWF_HOME=$(pwd)/../libewf/build make
> >>    ...snip...
> >>    g++ -DHAVE_CONFIG_H -I. -I../../../tsk  -I../../.. -Wall   -g -O2
> -MT fiwalk.o -MD -MP -MF .deps/fiwalk.Tpo -c -o fiwalk.o fiwalk.cpp
> >> In file included from fiwalk.cpp:39:0:
> >> fiwalk.h:94:20: fatal error: libewf.h: No such file or directory
> >> compilation terminated.
> >>
> >> We see from the build step that the libewf include directory is not
> provided.  Taking a look at the generated makefile, I have:
> >>
> >>    CFLAGS = -g -O2 -pthread -I/usr/local/include
> -I/home/me/Desktop/autopsy-dev/sleuthkit/../libewf/build//include
> >>    ...snip...
> >>    CXXFLAGS = -g -O2
> >>
> >> I found that by copying the include directive over to the CXXFLAGS
> definition in the fiwalk makefile, the compilation completed successfully.
> >>
> >> Unfortunately, I haven't used Automake before, so I cannot give advice
> confidently. However, by looking at the source files, I conjecture adding a
> line to configure.ac around line 176 will fix the issue:
> >>
> >>    AS_IF([test "x$with_libewf" != "xno"],
> >>        # Test the dir if they specified something beyond yes/no
> >>        [AS_IF([test "x$with_libewf" != "xyes"],
> >>            [AS_IF([test -d ${with_libewf}/include],
> >>                [CFLAGS="$CFLAGS -I${with_libewf}/include"
> >>                    CXXFLAGS="$CXXFLAGS -I${with_libewf}/include"      #
> <<<<<<< ADD THIS HERE
> >>                    LDFLAGS="$LDFLAGS -L${with_libewf}/lib"],
> >>                # Dir given was not correct
> >>                [AC_MSG_FAILURE([libewf directory not found at
> ${with_libewf}])])
> >>
> >> Is this, in fact, a bug, and is the proposed fix reasonable?
> >>
> >> Thanks,
> >> Willi
> >>
> ------------------------------------------------------------------------------
> >> Get your SQL database under version control now!
> >> Version control is standard for application code, but databases havent
> >> caught up. So what steps can you take to put your SQL databases under
> >> version control? Why should you start doing it? Read more to find out.
> >>
> http://pubads.g.doubleclick.net/gampad/clk?id=49501711&iu=/4140/ostg.clktrk_______________________________________________
> >> sleuthkit-developers mailing list
> >> sle...@li...
> >> https://lists.sourceforge.net/lists/listinfo/sleuthkit-developers
> >
>
>

Re: [sleuthkit-developers] fiwalk compilation error using --with-libewf parameter

[Brian C. <ca...@sl...>]

Simson, any ideas on this?  I haven't looked at the fiwalk auto stuff much.

On Jul 30, 2013, at 11:10 PM, Willi Ballenthin <wil...@gm...> wrote:

> I've been building TSK with libewf support using the --with-libewf parameter, but I think there may be a bug in the makefile generated for fiwalk. On my Ubuntu/Debian system with both gcc and g++, g++ is chosen to compile fiwalk:
> 
>     me$ LIBEWF_HOME=$(pwd)/../libewf/build ./configure --with-libew$(pwd)/../libewf/build/ --prefix=$(pwd)/build/;
>     me$ LIBEWF_HOME=$(pwd)/../libewf/build make
>     ...snip...
>     g++ -DHAVE_CONFIG_H -I. -I../../../tsk  -I../../.. -Wall   -g -O2 -MT fiwalk.o -MD -MP -MF .deps/fiwalk.Tpo -c -o fiwalk.o fiwalk.cpp
> In file included from fiwalk.cpp:39:0:
> fiwalk.h:94:20: fatal error: libewf.h: No such file or directory
> compilation terminated.
> 
> We see from the build step that the libewf include directory is not provided.  Taking a look at the generated makefile, I have:
> 
>     CFLAGS = -g -O2 -pthread -I/usr/local/include -I/home/me/Desktop/autopsy-dev/sleuthkit/../libewf/build//include
>     ...snip...
>     CXXFLAGS = -g -O2
> 
> I found that by copying the include directive over to the CXXFLAGS definition in the fiwalk makefile, the compilation completed successfully.
> 
> Unfortunately, I haven't used Automake before, so I cannot give advice confidently. However, by looking at the source files, I conjecture adding a line to configure.ac around line 176 will fix the issue:
> 
>     AS_IF([test "x$with_libewf" != "xno"],
>         # Test the dir if they specified something beyond yes/no
>         [AS_IF([test "x$with_libewf" != "xyes"],
>             [AS_IF([test -d ${with_libewf}/include],
>                 [CFLAGS="$CFLAGS -I${with_libewf}/include"
>                     CXXFLAGS="$CXXFLAGS -I${with_libewf}/include"      # <<<<<<< ADD THIS HERE
>                     LDFLAGS="$LDFLAGS -L${with_libewf}/lib"],
>                 # Dir given was not correct
>                 [AC_MSG_FAILURE([libewf directory not found at ${with_libewf}])])
> 
> Is this, in fact, a bug, and is the proposed fix reasonable?
> 
> Thanks,
> Willi
> ------------------------------------------------------------------------------
> Get your SQL database under version control now!
> Version control is standard for application code, but databases havent 
> caught up. So what steps can you take to put your SQL databases under 
> version control? Why should you start doing it? Read more to find out.
> http://pubads.g.doubleclick.net/gampad/clk?id=49501711&iu=/4140/ostg.clktrk_______________________________________________
> sleuthkit-developers mailing list
> sle...@li...
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-developers

Re: [sleuthkit-developers] Lists or Forums

[Alex N. <ajn...@cs...>]

On Thu, Aug 1, 2013 at 1:12 PM, Alex Nelson <ajn...@cs...> wrote:

> This list so far has done a great job of keeping spam down (I'm not sure
> I've seen a spam email from this list yet).
>
>
And then, I got as a direct reply to this email a message entirely in
Chinese.  Google Translate says its contents are exactly:
"Hello, Thanks for your letter, I have received, I will promptly reply to
you."

I suppose I brought that on myself.

--Alex

Re: [sleuthkit-developers] Lists or Forums

[Alex N. <ajn...@cs...>]

The status quo seems to be working quite well.  A forum would need strong
registration hurdles to keep spam out.  This list so far has done a great
job of keeping spam down (I'm not sure I've seen a spam email from this
list yet).

I also like having a message archived in my mail archives with a link-able
copy on SourceForge, too.

--Alex


On Wed, Jul 31, 2013 at 8:06 PM, Brian Carrier <ca...@sl...>wrote:

> We are considering updating the "community environment" for the Sleuth Kit
> and Autopsy.  Currently, we have the wiki and the e-mail lists.  The topic
> of forums has also come up and I wanted to get some feedback from people on
> e-mail lists vs. forums.
>
> Can you reply with any thoughts on:
> - e-mail lists only (status quo)
> - forum only (the lists go away)
> - forum and lists that are independent
> - forum and lists that are integrated (not entirely sure what our options
> are here though)
>
> brian
>
> ------------------------------------------------------------------------------
> Get your SQL database under version control now!
> Version control is standard for application code, but databases havent
> caught up. So what steps can you take to put your SQL databases under
> version control? Why should you start doing it? Read more to find out.
> http://pubads.g.doubleclick.net/gampad/clk?id=49501711&iu=/4140/ostg.clktrk
> _______________________________________________
> sleuthkit-developers mailing list
> sle...@li...
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-developers
>

Re: [sleuthkit-developers] Lists or Forums

[Derrick K. <dk...@gm...>]

Same here.

I prefer mailing lists that I can receive, go through as time permits,
and archive/search.  A forum means I have to login and actively seek
out new and interesting threads which I really can't be bothered with.
 IMO it's too much work to stay current with a forum and its easier to
participate with the mailing list.

Derrick


On Wed, Jul 31, 2013 at 9:55 PM, RB <ao...@gm...> wrote:
> On Wed, Jul 31, 2013 at 6:06 PM, Brian Carrier <ca...@sl...>
> wrote:
>>
>> We are considering updating the "community environment" for the Sleuth Kit
>> and Autopsy.  Currently, we have the wiki and the e-mail lists.  The topic
>> of forums has also come up and I wanted to get some feedback from people on
>> e-mail lists vs. forums.
>>
>> Can you reply with any thoughts on:
>> - e-mail lists only (status quo)
>> - forum only (the lists go away)
>> - forum and lists that are independent
>> - forum and lists that are integrated (not entirely sure what our options
>> are here though)
>
>
> Perhaps harsh, but if the lists go away so will I (from participation,
> you'll pry fls | awk | icat out of my cold, dead fingers).  Integrated forum
> & list would be a curiosity, but I've typically seen a bifurcation - forums
> tend to be used for "random newbie question" type traffic and MLs are
> usually more intentional participants.
>
> ------------------------------------------------------------------------------
> Get your SQL database under version control now!
> Version control is standard for application code, but databases havent
> caught up. So what steps can you take to put your SQL databases under
> version control? Why should you start doing it? Read more to find out.
> http://pubads.g.doubleclick.net/gampad/clk?id=49501711&iu=/4140/ostg.clktrk
> _______________________________________________
> sleuthkit-developers mailing list
> sle...@li...
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-developers
>

Re: [sleuthkit-developers] Lists or Forums

[RB <ao...@gm...>]

On Wed, Jul 31, 2013 at 6:06 PM, Brian Carrier <ca...@sl...>wrote:

> We are considering updating the "community environment" for the Sleuth Kit
> and Autopsy.  Currently, we have the wiki and the e-mail lists.  The topic
> of forums has also come up and I wanted to get some feedback from people on
> e-mail lists vs. forums.
>
> Can you reply with any thoughts on:
> - e-mail lists only (status quo)
> - forum only (the lists go away)
> - forum and lists that are independent
> - forum and lists that are integrated (not entirely sure what our options
> are here though)
>

Perhaps harsh, but if the lists go away so will I (from participation,
you'll pry fls | awk | icat out of my cold, dead fingers).  Integrated
forum & list would be a curiosity, but I've typically seen a bifurcation -
forums tend to be used for "random newbie question" type traffic and MLs
are usually more intentional participants.

[sleuthkit-developers] Lists or Forums

[Brian C. <ca...@sl...>]

We are considering updating the "community environment" for the Sleuth Kit and Autopsy.  Currently, we have the wiki and the e-mail lists.  The topic of forums has also come up and I wanted to get some feedback from people on e-mail lists vs. forums. 

Can you reply with any thoughts on:
- e-mail lists only (status quo)
- forum only (the lists go away)
- forum and lists that are independent
- forum and lists that are integrated (not entirely sure what our options are here though)

brian 

[sleuthkit-developers] fiwalk compilation error using --with-libewf parameter

[Willi B. <wil...@gm...>]

I've been building TSK with libewf support using the --with-libewf
parameter, but I think there may be a bug in the makefile generated for
fiwalk. On my Ubuntu/Debian system with both gcc and g++, g++ is chosen to
compile fiwalk:

    me$ LIBEWF_HOME=$(pwd)/../libewf/build ./configure
--with-libew$(pwd)/../libewf/build/ --prefix=$(pwd)/build/;
    me$ LIBEWF_HOME=$(pwd)/../libewf/build make
    ...snip...
    g++ -DHAVE_CONFIG_H -I. -I../../../tsk  -I../../.. -Wall   -g -O2 -MT
fiwalk.o -MD -MP -MF .deps/fiwalk.Tpo -c -o fiwalk.o fiwalk.cpp
In file included from fiwalk.cpp:39:0:
fiwalk.h:94:20: fatal error: libewf.h: No such file or directory
compilation terminated.

We see from the build step that the libewf include directory is not
provided.  Taking a look at the generated makefile, I have:

    CFLAGS = -g -O2 -pthread -I/usr/local/include
-I/home/me/Desktop/autopsy-dev/sleuthkit/../libewf/build//include
    ...snip...
    CXXFLAGS = -g -O2

I found that by copying the include directive over to the CXXFLAGS
definition in the fiwalk makefile, the compilation completed successfully.

Unfortunately, I haven't used Automake before, so I cannot give advice
confidently. However, by looking at the source files, I conjecture adding a
line to configure.ac around line 176 will fix the issue:

    AS_IF([test "x$with_libewf" != "xno"],
        # Test the dir if they specified something beyond yes/no
        [AS_IF([test "x$with_libewf" != "xyes"],
            [AS_IF([test -d ${with_libewf}/include],
                [CFLAGS="$CFLAGS -I${with_libewf}/include"
                    CXXFLAGS="$CXXFLAGS -I${with_libewf}/include"      #
<<<<<<< ADD THIS HERE
                    LDFLAGS="$LDFLAGS -L${with_libewf}/lib"],
                # Dir given was not correct
                [AC_MSG_FAILURE([libewf directory not found at
${with_libewf}])])

Is this, in fact, a bug, and is the proposed fix reasonable?

Thanks,
Willi

[sleuthkit-developers] Scalpel Help

[Brian C. <ca...@sl...>]

We _almost_ had scalpel integrated into Autopsy for a release, but ran into some problems and got side tracked on another project for a while. So, we are asking for help in the mean time so that we can get carving into Autopsy sooner than later.

Vico and Golden allowed us to change the license of Scalpel to be Apache 2 so that we can tightly integrate it into Autopsy -- THANKS!  We (Basis Tech) modified it so that we can use it as a library and not extract unallocated space to disk and then carve it.  

But, there are some memory leaks in scalpel and running it in Autopsy causes it to eventually fall over because all of the memory is gone.  We fixed some leaks, but some still remain.  If any C/C++ developers have some cycles, it would be appreciated if you could help profile the code and fill some of the leaks.  

Latest code is on github:
	https://github.com/sleuthkit/scalpel

thanks,
brian


 

[sleuthkit-developers] NTFS FileName times now available

[Brian C. <ca...@sl...>]

The master branch now has code to populate TSK_FS_META.time2.ntfs with the file name times.  It took less than 30 minutes to add and I should have done this A LONG time ago, but had been holding off in favor or another design that some of us have talked about that exposed all non-stndard metadata via a hash map.  that requires either a C hashmap or changing the API to C++ and has required more thought than we had cycles for.   Anyway, I just added the NTFS times.  Enjoy and thanks to Kristinn for reminding me that we needed a solution to this. 

brian

Re: [sleuthkit-developers] [sleuthkit-users] TSK 4.1.0 released

[Brian C. <ca...@sl...>]

Ughhh.   I have no clue what that code is supposed to do (my CRC calculation knowledge is a bit fuzzy these days -- that is what libraries are for).  It was part of a code submission.  

Looks like no one is using that function though.  Delete the entire generate_crc_table method (everything you copy and pasted) and try it again.  Mine still compiles. 

I checked in a version that removes this.



On Jun 22, 2013, at 2:27 PM, Greg Freemyer <gre...@gm...> wrote:

> Brian,
> 
> In crc.c I'm getting a warning (that is causing my build to fail)
> about the assignment:
> 
>        crctab[i]= crc;
> 
> The complaint is crctab is a table of short ints, and crc is a long.
> 
> My c skills are rusty, but if you can send me the patch I'd appreciate it.
> 
> === relevant code
> void generate_crc_table(short *crctab[], p_cm_t p_cm){
>    int i, j;
>    unsigned long bit, crc;
>    unsigned long crchighbit = (unsigned long)1 << (p_cm->cm_width-1);
>    unsigned long crcmask = ((((unsigned long)1<<(p_cm->cm_width-1))-1)<<1)|1;
> 
>    for (i=0; i<256; i++)
>    {
>        crc=(unsigned long)i;
>        if(p_cm->cm_refin) crc = reflect(crc,8);
>        crc <<= p_cm->cm_width-8;
>        for(j=0; j<8; j++)
>        {
>            bit = crc & crchighbit;
>            crc <<=1;
>            if(bit) crc ^=p_cm->cm_poly;
>        }
>        if(p_cm->cm_refin) crc = reflect(crc,p_cm->cm_width);
>        crc &= crcmask;
>        crctab[i]= crc;
>    }
>    return;
> }
> ===
> 
> Thanks
> Greg
> -- 
> Greg Freemyer
> Chief Technology Officer
> Intelligent Avatar Corporation
> 
> (678) 653-4860
> Gre...@gm...
> http://www.linkedin.com/in/gregfreemyer
> CNN/TruTV Aired Forensic Imaging Demo -
>   http://insession.blogs.cnn.com/2010/03/23/how-computer-evidence-gets-retrieved/
> 
> 
> On Mon, Jun 17, 2013 at 5:57 PM, Brian Carrier <ca...@sl...> wrote:
>> Version 4.1.0 of The Sleuth Kit is finally available.  It adds many commonly requested features:
>> - YAFFS2 and Ext4 support (from viaForensics and Kevin Fairbanks)
>> - Framework runs on Linux and OS X.
>> - Lots of other less minor things in comparison (see http://sleuthkit.org/sleuthkit/history.php for details)
>> 
>> http://sleuthkit.org/sleuthkit/download.php
>> 
>> A note on YAFFS2, though I'm sure I'll be responding to many questions like this in the future. The layout of the flash memory spare area is not defined in the YAFFS2 spec. The viaForensics patch had a format that they commonly saw and we (Basis Technology) updated it with some layouts that we also came across.  Ideally, TSK would allow the caller to specify the layout, but that feature does not yet exist.
>> 
>> See some notes here on the topic:
>>    http://wiki.sleuthkit.org/index.php?title=YAFFS2_Implementation_Notes
>> 
>> I've cc:ed sleuthkit-developers on this because this version made  some development environment changes.  Previously, include paths were '/usr/local/include/tsk3'...'  Well, it's no longer TSK3.  The number was removed so that it does not need to be updated with major version changes. So, update your code to remove the '3'.
>> 
>> thanks,
>> brian
>> 
>> 
>> 
>> ------------------------------------------------------------------------------
>> This SF.net email is sponsored by Windows:
>> 
>> Build for Windows Store.
>> 
>> http://p.sf.net/sfu/windows-dev2dev
>> _______________________________________________
>> sleuthkit-users mailing list
>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>> http://www.sleuthkit.org

[sleuthkit-developers] TSK 4.1.0 released

[Brian C. <ca...@sl...>]

Version 4.1.0 of The Sleuth Kit is finally available.  It adds many commonly requested features:
- YAFFS2 and Ext4 support (from viaForensics and Kevin Fairbanks)
- Framework runs on Linux and OS X. 
- Lots of other less minor things in comparison (see http://sleuthkit.org/sleuthkit/history.php for details)

http://sleuthkit.org/sleuthkit/download.php

A note on YAFFS2, though I'm sure I'll be responding to many questions like this in the future. The layout of the flash memory spare area is not defined in the YAFFS2 spec. The viaForensics patch had a format that they commonly saw and we (Basis Technology) updated it with some layouts that we also came across.  Ideally, TSK would allow the caller to specify the layout, but that feature does not yet exist. 

See some notes here on the topic:
    http://wiki.sleuthkit.org/index.php?title=YAFFS2_Implementation_Notes

I've cc:ed sleuthkit-developers on this because this version made  some development environment changes.  Previously, include paths were '/usr/local/include/tsk3'...'  Well, it's no longer TSK3.  The number was removed so that it does not need to be updated with major version changes. So, update your code to remove the '3'.

thanks,
brian