sleuthkit-users — List to discuss Autopsy and The Sleuth Kit.

[sleuthkit-users] how do I get the file location without a scan?

[brads <br...@ny...>]

I followed the instruction from
http://wiki.sleuthkit.org/index.php?title=FS_Analysis but following the
process, I am unable to find a given string  http://i.imgur.com/kYuEatn.png 

I know the string is there because I can locate it using the string command
http://i.imgur.com/alQCRfM.png but, this is not an acceptable solution
because the scan takes 3 hrs against the image, I have 400 to do.

How do I get blkfs to work correctly or an alternative to getting a string
location at the disk layer like string but more robust?

 

Brad

Re: [sleuthkit-users] Fiwalk on running system

[Derrick K. <dk...@gm...>]

Hi Rolf.

I'm not sure if Michael's suggestion works with the latest fiwalk or
not but if it doesn't, have you looked at tsk_loaddb as an alternative
to fiwalk?  fiwalk hasn't been getting as much development lately but
tsk_loaddb is actively developed and outputs all the results into a
SQLite database.  Something like this would work with tsk_loaddb:

  tsk_loaddb -d myimage.db \\.\c:

Alternatively, for physical disks:

  wmic diskdrive list
  tsk_loaddb -d myimage.db \\.\PhysicalDrive0

Derrick


On Fri, Sep 18, 2015 at 8:05 AM, Michael Cohen <scu...@gm...> wrote:
> Does it work if you give it the volume name? fiwalk \\.\C:
>
> On 18 September 2015 at 14:50, Rolf Inator <rol...@gm...> wrote:
>> Hi list,
>>
>> I wonder if it's possible to run fiwalk on a live system? The documentation says
>> user@forensicbox:~$ fiwalk
>> usage: fiwalk [options] iso-name
>>
>> The problem I am facing is, that if I want to run fiwalk over a bitlocker encrypted dd image, I have to install Dislocker (a new driver) on my Linux system. It would be more decent if I could just run the fiwalk Windows executable while the suspects system is still running.
>>
>> I hope that was clear :)
>>
>> Kind regards,
>> Rolf
>>
>> ------------------------------------------------------------------------------
>> _______________________________________________
>> sleuthkit-users mailing list
>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>> http://www.sleuthkit.org
>
> ------------------------------------------------------------------------------
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org

Re: [sleuthkit-users] Fiwalk on running system

[Michael C. <scu...@gm...>]

Does it work if you give it the volume name? fiwalk \\.\C:

On 18 September 2015 at 14:50, Rolf Inator <rol...@gm...> wrote:
> Hi list,
>
> I wonder if it's possible to run fiwalk on a live system? The documentation says
> user@forensicbox:~$ fiwalk
> usage: fiwalk [options] iso-name
>
> The problem I am facing is, that if I want to run fiwalk over a bitlocker encrypted dd image, I have to install Dislocker (a new driver) on my Linux system. It would be more decent if I could just run the fiwalk Windows executable while the suspects system is still running.
>
> I hope that was clear :)
>
> Kind regards,
> Rolf
>
> ------------------------------------------------------------------------------
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org

[sleuthkit-users] Fiwalk on running system

[Rolf I. <rol...@gm...>]

Hi list,

I wonder if it's possible to run fiwalk on a live system? The documentation says
user@forensicbox:~$ fiwalk 
usage: fiwalk [options] iso-name

The problem I am facing is, that if I want to run fiwalk over a bitlocker encrypted dd image, I have to install Dislocker (a new driver) on my Linux system. It would be more decent if I could just run the fiwalk Windows executable while the suspects system is still running.

I hope that was clear :)

Kind regards,
Rolf

Re: [sleuthkit-users] Timeline Survey Question

[Jonathan M. <jmi...@ba...>]

Nanni,

There is already a button to export a screen grab of the current timeline
view as a report.  Is there a specific format or feature you would want in
a timeline-centered report?


On Thu, Aug 20, 2015 at 2:12 AM, Nanni Bassetti <dig...@gm...> wrote:

> Maybe is OT,  I would like to have a button to export the timeline report
> ;)
>
>
> ------------------------------------------------------------------------------
>
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>
>


-- 
Jonathan Millman
Software Engineer
Basis Technology

Re: [sleuthkit-users] Timeline Survey Question

[Jonathan M. <jmi...@ba...>]

We went ahead and built the new visualization, and would like some ​more
feedback. Attached are screen shots of both with real data. Rendering time
is very similar for each, but somewhat dependent on the data.

The questions are basically the same as before:  Which is easier to
understand? Which is more useful?  Should we keep both or only provide one?


Thanks for your time.  Your feedback is essential to help us develop the
most useful features possible!

-jon

--


On Thu, Aug 20, 2015 at 2:12 AM, Nanni Bassetti <dig...@gm...> wrote:

> Maybe is OT,  I would like to have a button to export the timeline report
> ;)
>
>
> ------------------------------------------------------------------------------
>
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>
>


-- 
Jonathan Millman
Software Engineer
Basis Technology

Re: [sleuthkit-users] New The Sleuth Kit Release!

[Mike P. <mpi...@gm...>]

It's a labor of love I imagine, but labor nonetheless.  Thanks so much for
all the hard work you contribute to the forensic community!

Mike

On Thu, Sep 17, 2015 at 10:57 AM, fpi <fra...@gm...> wrote:

> On 17/09/2015 06:10, Brian Carrier wrote:
> > The 4.2.0 release is finally out.  It’s been well over 1.5 years
> > since there was an independent TSK release. ...
>
> Great! Thank you for your awesome work!
> Francesco
>
>
>
> ------------------------------------------------------------------------------
> Monitor Your Dynamic Infrastructure at Any Scale With Datadog!
> Get real-time metrics from all of your servers, apps and tools
> in one place.
> SourceForge users - Click here to start your Free Trial of Datadog now!
> http://pubads.g.doubleclick.net/gampad/clk?id=241902991&iu=/4140
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>

Re: [sleuthkit-users] New The Sleuth Kit Release!

[fpi <fra...@gm...>]

On 17/09/2015 06:10, Brian Carrier wrote:
> The 4.2.0 release is finally out.  It’s been well over 1.5 years
> since there was an independent TSK release. ...

Great! Thank you for your awesome work!
Francesco

Re: [sleuthkit-users] New The Sleuth Kit Release!

[Nanni B. <dig...@gm...>]

Thanks! ;)
I just release this based on TSK :-)

XAll V.1.0
http://scripts4cf.sourceforge.net/tools.html

thank you again


-- 
Dott. Nanni Bassetti
http://www.nannibassetti.com
CAINE project manager - http://www.caine-live.net

Re: [sleuthkit-users] New The Sleuth Kit Release!

[Kalin K. <me....@gm...>]

Great!

>> -----Original Message-----
>> From: Brian Carrier [mailto:ca...@sl...]
>>
>> The 4.2.0 release is finally out.  It’s been well over 1.5 years since there was
>> an independent TSK release. There is a lot more in there than what we have
>> listed in the NEWS.txt file because we didn’t keep it up to date with all of the
>> little fixes and changes.
>>

I included an ebuild in my Gentoo overlay, will file a revbump bug
after some more testing.
The Java bindings are not built/enabled, I'll need to work this out.

https://github.com/thinrope/pkalin/tree/master/app-forensics/sleuthkit


Looking at the compiler warnings, I noticed quite a few with yaffs.c
and it may be good to look at those in more detail. I haven't used
YAFFS yet so testing it locally may be a bit of time investment.

Here are the messages in question

libtool: compile:  x86_64-pc-linux-gnu-g++ -DHAVE_CONFIG_H -I.
-I../../tsk -I../.. -I./../.. -Wall -pthread -O2 -pipe -c yaffs.cpp
-fPIC -DPIC -o .libs/yaffs.o
yaffs.cpp: In function ‘void yaffscache_object_dump(FILE*, YaffsCacheObject*)’:
yaffs.cpp:619:30: warning: format ‘%llx’ expects argument of type
‘long long unsigned int’, but argument 6 has type ‘TSK_OFF_T {aka long
int}’ [-Wformat=]
             chunk->ycc_offset);
                              ^
yaffs.cpp: In function ‘uint8_t yaffsfs_parse_image_load_cache(YAFFSFS_INFO*)’:
yaffs.cpp:1524:99: warning: format ‘%x’ expects argument of type
‘unsigned int’, but argument 3 has type ‘TSK_OFF_T {aka long int}’
[-Wformat=]
                     fprintf(stderr, "Error reading header to get
parent id at offset %x\n", offset);

                            ^
yaffs.cpp:1560:16: warning: unused variable ‘orphanParentID’ [-Wunused-variable]
     TSK_INUM_T orphanParentID = yfs->fs_info.last_inum;
                ^
yaffs.cpp: In function ‘uint8_t yaffs_make_deleted(YAFFSFS_INFO*,
TSK_FS_FILE*)’:
yaffs.cpp:1743:95: warning: deprecated conversion from string constant
to ‘char*’ [-Wwrite-strings]
     if (yaffs_make_directory(yaffsfs, fs_file, YAFFS_OBJECT_DELETED,
YAFFS_OBJECT_DELETED_NAME))

                        ^
yaffs.cpp: In function ‘uint8_t yaffs_make_unlinked(YAFFSFS_INFO*,
TSK_FS_FILE*)’:
yaffs.cpp:1765:97: warning: deprecated conversion from string constant
to ‘char*’ [-Wwrite-strings]
     if (yaffs_make_directory(yaffsfs, fs_file, YAFFS_OBJECT_UNLINKED,
YAFFS_OBJECT_UNLINKED_NAME))

                          ^
yaffs.cpp: In function ‘uint8_t yaffs_inode_lookup(TSK_FS_INFO*,
TSK_FS_FILE*, TSK_INUM_T)’:
yaffs.cpp:1876:19: warning: deprecated conversion from string constant
to ‘char*’ [-Wwrite-strings]
         real_name = YAFFS_OBJECT_LOSTNFOUND_NAME;
                   ^
yaffs.cpp:1879:19: warning: deprecated conversion from string constant
to ‘char*’ [-Wwrite-strings]
         real_name = YAFFS_OBJECT_UNLINKED_NAME;
                   ^
yaffs.cpp:1882:19: warning: deprecated conversion from string constant
to ‘char*’ [-Wwrite-strings]
         real_name = YAFFS_OBJECT_DELETED_NAME;
                   ^
yaffs.cpp: In function ‘TSK_FS_INFO* yaffs2_open(TSK_IMG_INFO*,
TSK_OFF_T, TSK_FS_TYPE_ENUM, uint8_t)’:
yaffs.cpp:1580:39: warning: ‘max_inum’ may be used uninitialized in
this function [-Wmaybe-uninitialized]
     yfs->fs_info.last_inum = max_inum + 1; // One more for the orphan dir
                                       ^
yaffs.cpp:1578:16: note: ‘max_inum’ was declared here
     TSK_INUM_T max_inum;
                ^
yaffs.cpp: At global scope:
yaffs.cpp:626:5: warning: ‘void yaffscache_objects_dump(FILE*,
YAFFSFS_INFO*)’ defined but not used [-Wunused-function]
     yaffscache_objects_dump(FILE *fp, YAFFSFS_INFO *yfs)
     ^


Kalin.

Re: [sleuthkit-users] New The Sleuth Kit Release!

[Grundy B. J T. <Bar...@ti...>]

I am literally weeping with joy over here...

/*******************************************
Barry J. Grundy
Assistant Special Agent in Charge
Digital Forensic Support Group
Treasury Inspector General for Tax Administration
(301) 210-8741 (desk)
(202) 527-5778 (cell)
Bar...@ti...
********************************************\


> -----Original Message-----
> From: Brian Carrier [mailto:ca...@sl...]
> Sent: Thursday, September 17, 2015 12:10 AM
> To: sleuthkit-users; sle...@li...
> Subject: [sleuthkit-users] New The Sleuth Kit Release!
> 
> The 4.2.0 release is finally out.  It’s been well over 1.5 years since there was
> an independent TSK release. There is a lot more in there than what we have
> listed in the NEWS.txt file because we didn’t keep it up to date with all of the
> little fixes and changes. But here are the big items:
> 
> - ExFAT support added
> - New database schema
> - New Sqlite hash database
> - Added secondary hash database index
> - Various bug fixes
> - NTFS pays more attention to sequence and loads metadata only
>   if it matches.
> 
> Source code tar ball and windows binaries are here:
> 
>     http://www.sleuthkit.org/sleuthkit/
> 
> brian
> ------------------------------------------------------------------------------
> Monitor Your Dynamic Infrastructure at Any Scale With Datadog!
> Get real-time metrics from all of your servers, apps and tools in one place.
> SourceForge users - Click here to start your Free Trial of Datadog now!
> http://pubads.g.doubleclick.net/gampad/clk?id=241902991&iu=/4140
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org

Re: [sleuthkit-users] New The Sleuth Kit Release!

[Luís F. N. <lfc...@gm...>]

Great news! Thank you sleuthkit team for the awesome work!

Luis Nassif

2015-09-17 1:10 GMT-03:00 Brian Carrier <ca...@sl...>:

> The 4.2.0 release is finally out.  It’s been well over 1.5 years since
> there was an independent TSK release. There is a lot more in there than
> what we have listed in the NEWS.txt file because we didn’t keep it up to
> date with all of the little fixes and changes. But here are the big items:
>
> - ExFAT support added
> - New database schema
> - New Sqlite hash database
> - Added secondary hash database index
> - Various bug fixes
> - NTFS pays more attention to sequence and loads metadata only
>   if it matches.
>
> Source code tar ball and windows binaries are here:
>
>     http://www.sleuthkit.org/sleuthkit/
>
> brian
>
> ------------------------------------------------------------------------------
> Monitor Your Dynamic Infrastructure at Any Scale With Datadog!
> Get real-time metrics from all of your servers, apps and tools
> in one place.
> SourceForge users - Click here to start your Free Trial of Datadog now!
> http://pubads.g.doubleclick.net/gampad/clk?id=241902991&iu=/4140
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>

[sleuthkit-users] New The Sleuth Kit Release!

[Brian C. <ca...@sl...>]

The 4.2.0 release is finally out.  It’s been well over 1.5 years since there was an independent TSK release. There is a lot more in there than what we have listed in the NEWS.txt file because we didn’t keep it up to date with all of the little fixes and changes. But here are the big items:

- ExFAT support added
- New database schema
- New Sqlite hash database
- Added secondary hash database index 
- Various bug fixes
- NTFS pays more attention to sequence and loads metadata only 
  if it matches. 

Source code tar ball and windows binaries are here: 

    http://www.sleuthkit.org/sleuthkit/

brian

Re: [sleuthkit-users] New version of TSK?

[Luís F. N. <lfc...@gm...>]

Hi,

There were many fixes since 4.1.3, related to loaddb, ntfs and hfs code,
but I am not a sleuthkit developer to enumerate them. I would suggest you
to pick up the sleuthkit develop snapshot used to compile the last release
of Autopsy 3.1.3 (06/26/2015), as I believe it was tested a bit before
releasing autopsy.

Regards,
Luis Nassif

2015-09-09 12:57 GMT-03:00 Greg Freemyer <gre...@gm...>:

> On Wed, Sep 9, 2015 at 9:45 AM, Grundy Barry J TIGTA
> <Bar...@ti...> wrote:
> >>  From: Luís Filipe Nassif [mailto:lfc...@gm...]
> >>  No new version of tsk was released after theses fixes were done.
> >
> > I've been asking about this for a while...Are we going to see any stable
> releases of TSK again?  For those of us packaging the software for
> tested/validated distribution, relying on GitHub's moving target is not a
> really good idea.
> >
> > Does anyone else here packaging for a specific distro have the same
> issue?  I take care of the Slackware build script on SBo, and it's stuck at
> 4.1.3.   It may be a bit different for others, but the Slack build scripts
> rely on downloadable tarballs.
>
> Like you, I only package for openSUSE and only package for released
> versions with a tarball:
>
> https://build.opensuse.org/package/show/security:forensics/sleuthkit
>
> If the tsk fixes are important enough I can (and do) add patches to
> the build.  You can see that I'm carrying a very simple one of those
> now.
>
> I assume the Slack build scripts support that as well.
>
> Can someone summarize any patches that should be picked up by the distro's?
>
> Thanks
> Greg
>
>
> ------------------------------------------------------------------------------
> Monitor Your Dynamic Infrastructure at Any Scale With Datadog!
> Get real-time metrics from all of your servers, apps and tools
> in one place.
> SourceForge users - Click here to start your Free Trial of Datadog now!
> http://pubads.g.doubleclick.net/gampad/clk?id=241902991&iu=/4140
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>

Re: [sleuthkit-users] tsk_loaddb too slow

[Brian C. <ca...@sl...>]

Autopsy calls the equivalent of tsk_loaddb -k, which does not populate the block map.   See if that is equivalent to what you are seeing.



> On Sep 5, 2015, at 9:24 PM, Mike.Xin <805...@qq...> wrote:
> 
> To whom it may concern,
>     I'm testing SleuthKit and Autopsy, I found when adding image files with Autopsy, it is so fast, but using tsk_loaddb is too slow. Can somebody tell me why? I'm trying to building application with C++. Please, many thanks.
> 
> 
> bst rgrds,
> 
> Mike.Xin
> ------------------------------------------------------------------------------
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org

Re: [sleuthkit-users] New version of TSK?

[Greg F. <gre...@gm...>]

On Wed, Sep 9, 2015 at 9:45 AM, Grundy Barry J TIGTA
<Bar...@ti...> wrote:
>>  From: Luís Filipe Nassif [mailto:lfc...@gm...]
>>  No new version of tsk was released after theses fixes were done.
>
> I've been asking about this for a while...Are we going to see any stable releases of TSK again?  For those of us packaging the software for tested/validated distribution, relying on GitHub's moving target is not a really good idea.
>
> Does anyone else here packaging for a specific distro have the same issue?  I take care of the Slackware build script on SBo, and it's stuck at 4.1.3.   It may be a bit different for others, but the Slack build scripts rely on downloadable tarballs.

Like you, I only package for openSUSE and only package for released
versions with a tarball:

https://build.opensuse.org/package/show/security:forensics/sleuthkit

If the tsk fixes are important enough I can (and do) add patches to
the build.  You can see that I'm carrying a very simple one of those
now.

I assume the Slack build scripts support that as well.

Can someone summarize any patches that should be picked up by the distro's?

Thanks
Greg

[sleuthkit-users] New version of TSK?

[Grundy B. J T. <Bar...@ti...>]

>  From: Luís Filipe Nassif [mailto:lfc...@gm...] 
>  No new version of tsk was released after theses fixes were done.

I've been asking about this for a while...Are we going to see any stable releases of TSK again?  For those of us packaging the software for tested/validated distribution, relying on GitHub's moving target is not a really good idea.

Does anyone else here packaging for a specific distro have the same issue?  I take care of the Slackware build script on SBo, and it's stuck at 4.1.3.   It may be a bit different for others, but the Slack build scripts rely on downloadable tarballs.

/*******************************************
Barry J. Grundy
Assistant Special Agent in Charge
Digital Forensic Support Group
Treasury Inspector General for Tax Administration
(301) 210-8741 (desk)
(202) 527-5778 (cell)
Bar...@ti...
********************************************\

Re: [sleuthkit-users] [sleuthkit-developers] Millions of orphan files found with sleuthkit develop branch

[Luís F. N. <lfc...@gm...>]

Sorry for the long delay. I do not have the image with me, I will ask my
colleague if trimming the image is possible... We worked around the problem
by filtering out orphans with logical size greater than 10 MB before
sending them to the processing engine.

Thank you,
Luis

2015-08-13 14:13 GMT-03:00 Stefan Petrea <ste...@gm...>:

> Hi Luis,
>
> Could the NTFS image you're looking at be trimmed down and provided as
> sample input to reproduce the problem ?
>
> Best Regards,
> Stefan
>
> On Thu, Aug 13, 2015 at 8:05 PM, Luís Filipe Nassif <lfc...@gm...>
> wrote:
>
>> This error have happened again with a colleague's NTFS image, using the
>> develop branch compiled about 1 month ago. Thousands of huge corrupted
>> orphans were added by loaddb, which caused our processing application (and
>> probably Autopsy too) to process indefinitely the evidence.
>>
>> Any help will be appreciated.
>>
>> Regards,
>> Luis Nassif
>>
>>
>> 2014-09-30 21:00 GMT-03:00 Luís Filipe Nassif <lfc...@gm...>:
>>
>>> This problem still happens with 4.2.0 branch. If I can help with some
>>> more information, please let me know.
>>>
>>> Thanks
>>> Luis
>>>
>>> 2014-07-24 9:21 GMT-03:00 Luís Filipe Nassif <lfc...@gm...>:
>>>
>>>> Another information: the sum of the millions of file sizes resulted in
>>>> 1,1 petabyte, while the image has only 250 GB.
>>>>
>>>>
>>>> 2014-07-23 22:21 GMT-03:00 Luís Filipe Nassif <lfc...@gm...>:
>>>>
>>>>> We tested loaddb of both the released 4.1.3 version and the develop
>>>>> branch of sleuthkit on a NTFS image of a hard disk with a lot of bad
>>>>> blocks, many of them at the beginning of the disk.
>>>>>
>>>>> The 4.1.3 version found ~400.000 allocated files more ~100.000 orphan
>>>>> files, about the same found by other forensic tools. The develop branch
>>>>> found the same ~400.000 allocated files more ~2.500.000 orphan files! Most
>>>>> of these millions of orphans have corrupted names or the name
>>>>> OrphanFile-xxxxxxx and have lengths ranging from 0 to 4.294.967.296 bytes.
>>>>> We think the recent changes to NTFS code are causing this large number of
>>>>> corrupted orphans to be added to the case. Maybe it should be investigated
>>>>> before the final 4.2 release.
>>>>>
>>>>> Luis
>>>>>
>>>>
>>>>
>>>
>>
>>
>> ------------------------------------------------------------------------------
>>
>> _______________________________________________
>> sleuthkit-developers mailing list
>> sle...@li...
>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-developers
>>
>>
>

Re: [sleuthkit-users] [sleuthkit-developers] Java Bindings Update

[Luís F. N. <lfc...@gm...>]

Interesting work, Stuart, thank you for sharing! I have not had time to
test your bindings yet, but I see use cases where it should be very useful,
like fast previewing of data at crime scenes, or processing data as soon as
the file system starts to be transversed (in some cases loaddb takes a long
time...)

Thanks again for sharing your great work,
Luis

2015-08-20 12:36 GMT-03:00 Stuart Maclean <st...@ap...>:

> Hi Brian, yes my effort is just Java and C.
>
> Stuart
>
>
> On 08/20/2015 06:22 AM, Brian Carrier wrote:
> > Thanks Stuart.  Just to be clear, the main difference between your
> bindings and the one that ships with TSK is that the “official” one relies
> on SQLite and JNI while yours is 100% JNI, right?
> >
> > thanks,
> > brian
> >
> >
>
>
>
> ------------------------------------------------------------------------------
> _______________________________________________
> sleuthkit-developers mailing list
> sle...@li...
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-developers
>

Re: [sleuthkit-users] tsk_loaddb too slow

[Luís F. N. <lfc...@gm...>]

I think Autopsy is compiled with the develop branch of sleuthkit, which has
a lot of fixes related to loaddb speed. No new version of tsk was released
after theses fixes were done.

Best,
Luis

2015-09-05 22:24 GMT-03:00 Mike.Xin <805...@qq...>:

> To whom it may concern,
>     I'm testing SleuthKit and Autopsy, I found when adding image files
> with Autopsy, it is so fast, but using tsk_loaddb is too slow. Can somebody
> tell me why? I'm trying to building application with C++. Please, many
> thanks.
>
>
> bst rgrds,
>
> Mike.Xin
>
>
> ------------------------------------------------------------------------------
>
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>
>

[sleuthkit-users] Writing files to disk

[<sle...@fa...>]

Hi community,
I am working on a small extraction utility using tsk. What I want to to is to find certain files and write them to disk. One could say copy a file from the image I am processing. But all I manage is writing binary data. I want it to work with text files primarily, but in the end with every file type. Just a simple copy so I can open the exported files the same way I would if the image was mounted. I use tsk_fs_file_walk with a callback that does nothing more than an fwrite. But as I said, this way I only write binary data. So what am I doing wrong?
Kind regards

[sleuthkit-users] tsk_loaddb too slow

[Mike.X. <805...@qq...>]

To whom it may concern,    I'm testing SleuthKit and Autopsy, I found when adding image files with Autopsy, it is so fast, but using tsk_loaddb is too slow. Can somebody tell me why? I'm trying to building application with C++. Please, many thanks.




bst rgrds,


Mike.Xin

[sleuthkit-users] Chocolatey packaging

[Declan W. <d.w...@re...>]

Hi all,

I have created a Chocolatey (http://chocolatey.org/) package for TSK;
	- https://github.com/DeclanEWilliams/chocolatey-sleuthkit/
	- https://chocolatey.org/packages/sleuthkit/4.1.3

For those who don't know about Chocolatey, it is a package management system
for Windows based on nuget, allowing for:
	PS> choco install sleuthkit --version 4.1.3
	PS> choco upgrade sleuthkit

Are you OK with this package? I can always remove it, or hand it over to
someone else. If all is well I can create one for Autopsy too.

Kind regards,

Declan

[sleuthkit-users] Autopsy Online Training

[Brian C. <ca...@sl...>]

Join us online (or in person) on Oct 29 for the next 1-day Autopsy training course.  We will be again doing this as a joint in-person and online event (it is the day after OSDFCon in Herndon, VA). 

Registration details are available at:

    http://www.basistech.com/digital-forensics/autopsy/training/

The 1-day course provides hands-on experience with Autopsy.  We cover the basic concepts of the tool and how each module works.  We assume that you have a background in forensics and we do not cover basic investigation concepts.  At the end of this course attendees will be able to use Autopsy 3 to execute an end-to-end digital investigation on a hard drive and understand the best practices when using Autopsy for optimal results.

thanks,
brian

Re: [sleuthkit-users] Java bindings: ClassNotFoundException TskDataException

[<zah...@gm...>]

Nevermind. I just forgot to adapt the Jar file's classpath. It works now.

-----Ursprüngliche Nachricht-----
Gesendet: Wednesday, 02 September 2015 um 11:32:01 Uhr
Von: zah...@gm...
An: sle...@li...
Betreff: [sleuthkit-users] Java bindings: ClassNotFoundException TskDataException
Hey everyone,
I just started using Tsk. To get a feeling I wanted to try out the sample (Sample.java, see below). I build it with Ant (build.xl, see below). While the build itself is successful I can't get the program to run (java -jar Sample.jar). I am working on a Linux Machine, the JNI libs are in /usr/lib. The file Tsk_DataModel.jar I copied to projectdir/lib.
This is the message I get:
'Exception in thread "main" java.lang.NoClassDefFoundError: org/sleuthkit/datamodel/TskDataException
	at java.lang.Class.getDeclaredMethods0(Native Method)
	at java.lang.Class.privateGetDeclaredMethods(Class.java:2625)
	at java.lang.Class.getMethod0(Class.java:2866)
	at java.lang.Class.getMethod(Class.java:1676)
	at sun.launcher.LauncherHelper.getMainMethod(LauncherHelper.java:494)
	at sun.launcher.LauncherHelper.checkAndLoadMain(LauncherHelper.java:486)
Caused by: java.lang.ClassNotFoundException: org.sleuthkit.datamodel.TskDataException

So could anyone help me on that? Thanks.