sleuthkit-users

[sleuthkit-users] sleuthkit1.73 install prob MAC OS X 10.3.6

[<sle...@dn...>]

First off, I'm using Sleuthkit/Autopsy browser to try to determine if someone deleted files off a iMac with Mac OS 8.5/8.6 installed--is this possible?

Installed on the Sleuthkit/Autopsy working hard drive is:
Mac OS X 10.3.6 (upgraded from 10.3.2)

I tried installing XCode Tools 1.1, but after install it said there were errors and to try re-installing, so I installed the gcc2.95.2.pkg, gcc3.1.pkg packages separately, successfully.  gcc3.3.pkg says, "gcc3.3 cannot be installed on this computer."

1 drive, 3 partitions:

/dev/disk0s11 on /Volumes/os8-9 (local) [ has 8.6, 9.2.2 installed ]
/dev/disk0s13 on /Volumes/osx (local, journaled)  [ has OS X 10.3.6 installed ]
/dev/disk0s15 on /Volumes/misc (local, journaled)

It looks like gcc, gcc2, and gcc3 are in "/Volumes/osx/usr/bin/"

Sleuthkit-1.73 is installed on:
	/Volumes/misc/sleuthkit-1.73

When I run "make" under "/Volumes/misc/sleuthkit-1.73" I get:

dnmacs-Computer:/Volumes/misc/sleuthkit-1.73 dnmac$ make
cd src/misc; make "CC=gcc" MAKELEVEL=
gcc -DDARWIN -DVER=\"1.73\" -O -Wall -g   -c -o mymalloc.o mymalloc.c
make: gcc: Command not found
make: *** [mymalloc.o] Error 127
make: *** [defs] Error 2
make: *** [no-perl] Error 2
dnmacs-Computer:/Volumes/misc/sleuthkit-1.73 dnmac$ 

When I run "make CC=cc" I get:  same, except "make: cc: Command not found"

When I run "make CC=gcc" I get: same, except "make: gcc: Command not found"

When I run "make CC=gcc2" I get:
( & make CC=/Volumes/osx/usr/bin/gcc2 )

dnmacs-Computer:/Volumes/misc/sleuthkit-1.73 dnmac$ make CC=gcc2
cd src/misc; make "CC=gcc2" MAKELEVEL=
gcc2 -DDARWIN -DVER=\"1.73\" -O -Wall -g   -c -o mymalloc.o mymalloc.c
mymalloc.c:49: header file 'stdlib.h' not found
mymalloc.c:50: header file 'unistd.h' not found
mymalloc.c:51: header file 'string.h' not found
cpp-precomp: warning: errors during smart preprocessing, retrying in basic mode
make: *** [mymalloc.o] Error 1
make: *** [defs] Error 2
make: *** [no-perl] Error 2
dnmacs-Computer:/Volumes/misc/sleuthkit-1.73 dnmac$ 

And when I run "make CC=gcc3" I get:
( & make CC=/Volumes/osx/usr/bin/gcc2 )

dnmacs-Computer:/Volumes/misc/sleuthkit-1.73 dnmac$ make CC=gcc3
cd src/misc; make "CC=gcc3" MAKELEVEL=
gcc3 -DDARWIN -DVER=\"1.73\" -O -Wall -g   -c -o mymalloc.o mymalloc.c
mymalloc.c:49: header file 'stdlib.h' not found
mymalloc.c:50: header file 'unistd.h' not found
mymalloc.c:51: header file 'string.h' not found
cpp-precomp: warning: errors during smart preprocessing, retrying in basic mode
make: *** [mymalloc.o] Error 1
make: *** [defs] Error 2
make: *** [no-perl] Error 2
dnmacs-Computer:/Volumes/misc/sleuthkit-1.73 dnmac$ 

I did start the Autopsy 2.03 install after this, but Autopsy install said:
Enter the directory where you installed it:
/Volumes/misc/sleuthkit-1.73      
The Sleuth Kit was not found (try again):

So I guess Sleuthkit didn't get installed.

Can anyone tell me what's going wrong?

After "make" works successfully, is there anything else I need to do in Sleuthkit, or can I go ahead and install Autopsy?

Thanks for your help,

Paul

Re: [sleuthkit-users] sleuthkit1.73 install prob MAC OS X 10.3.6

[Seth A. <sa...@im...>]

On Fri, Jan 07, 2005 at 10:38:04PM -0000, sle...@dn... wrote:
> dnmacs-Computer:/Volumes/misc/sleuthkit-1.73 dnmac$ make CC=3Dgcc2
> cd src/misc; make "CC=3Dgcc2" MAKELEVEL=3D
> gcc2 -DDARWIN -DVER=3D\"1.73\" -O -Wall -g   -c -o mymalloc.o mymalloc.c
> mymalloc.c:49: header file 'stdlib.h' not found
> mymalloc.c:50: header file 'unistd.h' not found
> mymalloc.c:51: header file 'string.h' not found
> cpp-precomp: warning: errors during smart preprocessing, retrying in basi=
c mode
> make: *** [mymalloc.o] Error 1
> make: *** [defs] Error 2
> make: *** [no-perl] Error 2
> dnmacs-Computer:/Volumes/misc/sleuthkit-1.73 dnmac$=20
>=20
> And when I run "make CC=3Dgcc3" I get:
> ( & make CC=3D/Volumes/osx/usr/bin/gcc2 )
>=20
> dnmacs-Computer:/Volumes/misc/sleuthkit-1.73 dnmac$ make CC=3Dgcc3
> cd src/misc; make "CC=3Dgcc3" MAKELEVEL=3D
> gcc3 -DDARWIN -DVER=3D\"1.73\" -O -Wall -g   -c -o mymalloc.o mymalloc.c
> mymalloc.c:49: header file 'stdlib.h' not found
> mymalloc.c:50: header file 'unistd.h' not found
> mymalloc.c:51: header file 'string.h' not found
> cpp-precomp: warning: errors during smart preprocessing, retrying in basi=
c mode
> make: *** [mymalloc.o] Error 1
> make: *** [defs] Error 2
> make: *** [no-perl] Error 2
> dnmacs-Computer:/Volumes/misc/sleuthkit-1.73 dnmac$=20

It appears that your GCC can't find standard system headers. Try to find
the stdlib.h, unistd.h, and string.h headers. (The finder has a find
command you can use; or you can run this command in the terminal:
find / -name stdlib.h -print
)

If you don't have these files, then you'll need to get them, probably
=66rom Apple. They aren't a part of GCC proper, so I doubt that they would
be included in the gcc2 or gcc3 packages.

If you do have these files, then GCC hasn't found them. In the source
code, these files are specified like this:
  #include <stdlib.h>
  #include <unistd.h>
  #include <string.h>
The compiler has a "search path" to try to find these files -- you can
modify the search path with -I/path/to/add/to/the/search/path. So, if
your header files are located in /usr/include/macos/, then you might
try running:
make "CC=3Dgcc -I/usr/include/macos/"

I hope this helps.

Re: [sleuthkit-users] sleuthkit1.73 install prob MAC OS X 10.3.6

[Brian C. <ca...@sl...>]

On Jan 7, 2005, at 5:38 PM, sle...@dn... wrote:

>
> First off, I'm using Sleuthkit/Autopsy browser to try to determine if 
> someone deleted files off a iMac with Mac OS 8.5/8.6 installed--is 
> this possible?

TSK/Autopsy does not support the HFS+ file system, so they will 
probably not do what you need.

> Installed on the Sleuthkit/Autopsy working hard drive is:
> Mac OS X 10.3.6 (upgraded from 10.3.2)
>
> I tried installing XCode Tools 1.1, but after install it said there 
> were errors and to try re-installing, so I installed the 
> gcc2.95.2.pkg, gcc3.1.pkg packages separately, successfully.  
> gcc3.3.pkg says, "gcc3.3 cannot be installed on this computer."

I think you should try to get XCode working if you want to compile it.  
I have never installed gcc directly, but according to Seth it may not 
include the header files that you need. So, I would try to get XCode 
working, but it may not even be what you need if you need to analyze 
HFS.

brian