sleuthkit-users

[sleuthkit-users] Newbie question.

[Mallik Prasad.S <S.M...@ce...>]

Hello everybody,

Sorry if I am asking a basic questions., I went through the early mails on
the web.. but did not find much stuff.

I installed TASK/Autopsy on Sun Solaris system 5.8 with all patches... after
running "make" on both of this and installation successfully.... without the
NSRL.

         Autopsy Forensic Browser
                             ver 1.70

============================================================================

Evidence Locker: /export/home/locker/
Start Time: Wed Feb 26 06:52:52 2003

Paste this as your browser URL on localhost:
        http://localhost:8888/225181695407371775/autopsy.


It gave out this message.. and i tried to connect through a web-browser from
my PC.. and it gave out an error message saying that 

You are not authorized to view this page

I was wondering if I missed out anything.. or made some mistake.. Pls help
me on this.

Also another  question on NSRL.. I went into the web page of NSRL.. it said
it is available only with ordering and distribution with payment... Is it
required to have this or is there any isssues without this.

I did the installation, without the NSRL during Autopsy installation.

Thanks for your thoughts and pointers.


Best Regards,
Mallik Prasad S

Re: [sleuthkit-users] Newbie question.

[Ralf S. <li...@sp...>]

Am Mit, 2003-02-26 um 12.45 schrieb Mallik Prasad.S:
> Hello everybody,
> 
> Paste this as your browser URL on localhost:
>         http://localhost:8888/225181695407371775/autopsy.
> 
> 
> It gave out this message.. and i tried to connect through a web-browser from
> my PC.. and it gave out an error message saying that 
You have to run the browser on the same machine autopsy is running on, since 
autopsy only binds to localhost.

Otherwise you have to start autopsy with port and ip address given on
the commandline, like:
autopsy 8888 192.168.0.5

Cheers,

Ralf
-- 
Ralf Spenneberg
RHCE, RHCX

IPsec/PPTP Kernels for Red Hat Linux:  
http://www.spenneberg.com/.net/.org/.de
Honeynet Project Mirror:                http://honeynet.spenneberg.org
Snort Mirror:                           http://snort.spenneberg.org

Re: [sleuthkit-users] Newbie question.

[Brian C. <ca...@at...>]

> =A0=A0=A0=A0=A0=A0=A0 =
http://localhost:8888/225181695407371775/autopsy.
>
>
> It gave out this message.. and i tried to connect through a=20
> web-browser from my PC.. and it gave out an error message saying that
>
> You are not authorized to view this page
>
> I was wondering if I missed out anything.. or made some mistake.. Pls=20=

> help me on this.
>

The second argument to Autopsy is the host that you will be connecting=20=

from.  Any connections from other hosts are denied access.  'localhost'=20=

is used if you are connecting from the same system.  If you are going=20
to connect from your PC, then supply the hostname or IP address on the=20=

command line.  For example:

	./autopsy 8888 10.0.0.1

If connecting from a remote system, you may want to also provide the=20
'-C' flag.  That forces Autopsy to not use a cookie (which is difficult=20=

to cut & paste between systems).  Plus, the cookie only protects you=20
from multiple people on the same system.


> Also another=A0 question on NSRL.. I went into the web page of NSRL.. =
it=20
> said it is available only with ordering and distribution with=20
> payment... Is it required to have this or is there any isssues without=20=

> this.
>
It is not required.  It just allows you to identify if a file can be=20
"trusted" or not.  If it is in the database, then NIST has identified=20
it as a trusted binary.  It is only used as a data reduction tool,=20
mainly in the File Type mode.

brian