Bugzilla Bug 145405

version available with new goodies (features) and bug fixes. Also include
compile system changes (hopefully) for the better

*** Bug 152574 has been marked as a duplicate of this bug. ***

Created an attachment (id=108762) [edit]
Ebuild sleuthkit-2.07.ebuild

Since mid-december version 2.07 is out. I think sleuthkit should be upgraded at
least to 2.04, since AFF and Encase image files support is a great feature.
I've modified the patch to add dbtool binary (I've add new options to dbtool.c
to be more consistent with the other tools).

Created an attachment (id=108763) [edit]
Support for dbtool added to sleuthkit-2.07

thanks - will look at this soon

I ran the ebuild once more, and it failed because ranlib did not finished with
libtsk.a before this library was used in linking. I've just added
MAKEOPTS="${MAKEOPTS} -j1" to the ebuild to get rid of this.

successful install here:

 app-forensics/sleuthkit
    selected: 2.03
   protected: 2.07
     omitted: none

thanks. Added 2.08

Many thanks, but... it was about sleuthkit (the tools to do the job) rather
than autopsy (the front-end) ;)
By the way, can you do something for Afflib:
http://bugs.gentoo.org/show_bug.cgi?id=123175
These are tools to compress (by block to remain usable) disk images. sleuthkit
can read them since 2.04 but does not produce them.

opps - two web pages open and put the entry in the wrong bug report.

I haven't added sleuthkit because it is failing for me:
could be a parallel make issue as per comment #5. Haven't had time to look
through it.

i686-pc-linux-gnu-g++ -DLINUX2 -D_FILE_OFFSET_BITS=64 -D_LARGEFILE64_SOURCE
-DVER=\"2.07\" -I../auxtools -I../imgtools  -ggdb3 -g -o ../../bin/jcat jcat.o
-L../../lib -ltsk -lz -lcrypto
i686-pc-linux-gnu-gcc -DLINUX2 -D_FILE_OFFSET_BITS=64 -D_LARGEFILE64_SOURCE
-DVER=\"2.07\" -I../auxtools -I../imgtools  -ggdb3 -g   -c -o dbtool.o dbtool.c
make: *** No rule to make target `-L../../lib', needed by `../../bin/dbtool'. 
Stop.
make: *** Waiting for unfinished jobs....
dbtool.c: In function 'print_inode':
dbtool.c:431: error: 'FS_FLAG_FILE_NOABORT' undeclared (first use in this
function)
dbtool.c:431: error: (Each undeclared identifier is reported only once
dbtool.c:431: error: for each function it appears in.)
dbtool.c: In function 'main':
dbtool.c:589: error: 'progname' undeclared (first use in this function)
dbtool.c:655: warning: passing argument 2 of 'img_open' makes integer from
pointer without a cast
dbtool.c:655: warning: passing argument 3 of 'img_open' makes pointer from
integer without a cast
dbtool.c:655: error: too many arguments to function 'img_open'
dbtool.c:659: warning: passing argument 2 of 'fs_open' makes integer from
pointer without a cast
dbtool.c:659: error: too few arguments to function 'fs_open'
dbtool.c:674: warning: passing argument 2 of 'fs_open' makes integer from
pointer without a cast
dbtool.c:674: error: too few arguments to function 'fs_open'
make: *** [dbtool.o] Error 1
make[1]: *** [defs] Error 2
make[1]: Leaving directory
`/var/tmp/portage/app-forensics/sleuthkit-2.07/work/sleuthkit-2.07/src/fstools'
make: *** [no-perl] Error 2

Have you tried the original patch (shipped with 2.03) or the one I provided to
replace it (dbtool is not part of sleuthkit it's an add-on included in the
patch) ?
FS_FLAG_FILE_NOABORT is not defined anymore, just remove it.
progname is no more a global variable since 2.06
img_open and fs_open prototypes have changed (offset added to fs_open as second
argument)

Hi, here is a cleaned 2.08 ebuild with a "dbtool" USEflag, the dbtool patch,
the patch against Makefiles for make -j*, another patch against fscheck.c to
resolve trouble caused by -j8 :), updated src_install(), removed useless and
buggy src_test(), cleaned src_unpack(), and added !RDEP against dstat (see bug
131268)

Note that the Makefiles are not very compliant with a massively parallel
compilation.



Daniel, I can bump it into the tree if you are OK.

Created an attachment (id=115977) [edit]
Ebuild for sleuthkit 2.08

Created an attachment (id=115978) [edit]
Patch against makefiles for -j2 or more

Created an attachment (id=115980) [edit]
Patch (optional) against fscheck.c which has not been upgraded to the new
definitions

Created an attachment (id=115981) [edit]
Dbtool from PyFlag 0.84RC2 and ported to the new sleuthkit interfaces

bumped, feel free to reopen if there is something wrong