47096 2004-04-07 07:37 0000 app-admin/sleuthkit-1.69 ebuild request 2004-09-23 05:34:25 0000 1 1 1 Unclassified Gentoo Linux Ebuilds unspecified All All CLOSED TEST-REQUEST http://packages.debian.org/unstable/admin/sleuthkit EBUILD P2 enhancement --- 47097 1 rockoo@gmail.com dragonheart@gentoo.org alpha@gentoo.org amd64@gentoo.org lsmod@hotmail.com rockoo@gmail.com 2004-04-07 07:37:18 0000 app-admin/sleuthkit-1.68 ebuild request homepage: http://www.sleuthkit.org/sleuthkit/ desc: The Sleuth Kit is a collection of command line digital forensic tools. The tools run on Linux, OS X, FreeBSD, OpenBSD, and Solaris and can analyze FAT, NTFS, UFS, EXT2FS, and EXT3FS. Autopsy requires SleuthKit mholzer@gentoo.org 2004-04-27 09:08:57 0000 Daniel wanna try this ebuild too ? lsmod@hotmail.com 2004-04-27 17:39:34 0000 Created an attachment (id=30200) sleuthkit-1.69.ebuild ACK! Sleuthkit and Autopsy were obviously not made for distros. >.< dragonheart@gentoo.org 2004-05-05 22:06:02 0000 Committed to cvs. Arch test requested - debian lists this package as unstable on all archs/ http://packages.debian.org/unstable/admin/sleuthkit fmccor@gentoo.org 2004-05-06 05:05:50 0000 It builds on sparc, installs without disturbing anything, and the programs seem to run, so I'll mark it ~sparc. I'm not sure how to go about testing it, though. randy@gentoo.org 2004-05-06 07:15:33 0000 Installs on s390 lsmod@hotmail.com 2004-05-06 10:05:08 0000 bump to 1.69, which is what i put my ebuild in as. dragonheart@gentoo.org 2004-05-06 13:46:31 0000 version bumped to 1.69. Thanks Daniel. Appoligies for the oversight - good ebuild btw. lsmod@hotmail.com 2004-05-06 14:41:53 0000 >good ebuild btw. Thanks! I feel special now. =D rockoo@gmail.com 2004-05-06 18:22:35 0000 *** Bug 50222 has been marked as a duplicate of this bug. *** rockoo@gmail.com 2004-05-06 18:41:58 0000 can not connect w/ autopsy-2.0 to sleuthkit-1.69 ... 1.68 works fine (x86) <snip> ERROR: Sleuth Kit file executable missing </snap> lsmod@hotmail.com 2004-05-06 19:26:17 0000 portion of sleuthkit-1.68 makefile: no-perl: cd src/misc; make "CC=$(CC)" MAKELEVEL= cd src/hashtools; make "CC=$(CC)" MAKELEVEL= cd src/fstools; make "CC=$(CC)" MAKELEVEL= cd src/mmtools; make "CC=$(CC)" MAKELEVEL= cd src/file; CC="$(CC)" sh ./install same portion of sleuthkit-1.69 makefile: no-perl: cd src/misc; make "CC=$(CC)" MAKELEVEL= cd src/hashtools; make "CC=$(CC)" MAKELEVEL= cd src/fstools; make "CC=$(CC)" MAKELEVEL= cd src/mmtools; make "CC=$(CC)" MAKELEVEL= The sleuthkit guys took 'file' out 'no-perl'. My ebuild was made for 1.69 so it screwed up when using 1.68. Add sys-apps/file to sleuthkit-1.69 and get everyone who emerge'd sleuthkit-1.68 to update and re-emerge sys-apps/file. dragonheart@gentoo.org 2004-05-06 21:29:33 0000 Ok - removed version 1.68. I added sys-apps/file as a runtime dependancy of autopsy-2.00. sys-apps/file isn't a depend on sleuthkit so I'm not going to put it there to fix the previous version. Looking at: $ qpkg -f -v /usr/bin/file app-arch/file-roller-2.4.4-r2 * gnome-base/control-center-1.4.0.5-r1 * net-fs/coda-6.0.3 * sys-apps/file-4.06 * this isn't the only overwriter of "file". NOTE to peoples here who installed verions 1.68 of sleuthkit - please remerge sys-apps/file. Test plan for ARCHters: Step 1: ils /dev/discs/disc0/part1 This will list inodes of removed files on the partion /dev/discs/disc0/part1 Step 2: Create copy of disk image (suggest /boot or something small) dd if=/dev/discs/disc0/part1 of=/tmp/image Step 3: istat test istat /tmp/image {inodenum from step 1 - first column} will list metadata about that node. dragonheart@gentoo.org 2004-05-06 22:35:09 0000 Please ingore my comments about other packages overwriting /usr/bin/file. This is incorrect and a known qpkg bug #50157 that I based my information off. gmsoft@gentoo.org 2004-05-12 09:29:38 0000 Marked stable on hppa. 30200 2004-04-27 17:39 0000 sleuthkit-1.69.ebuild sleuthkit-1.69.ebuild text/plain IyBDb3B5cmlnaHQgMTk5OS0yMDA0IEdlbnRvbyBUZWNobm9sb2dpZXMsIEluYy4KIyBEaXN0cmli dXRlZCB1bmRlciB0aGUgdGVybXMgb2YgdGhlIEdOVSBHZW5lcmFsIFB1YmxpYyBMaWNlbnNlIHYy CiMgJEhlYWRlcjogJAoKREVTQ1JJUFRJT049IkEgY29sbGVjdGlvbiBvZiBmaWxlIHN5c3RlbSBh bmQgbWVkaWEgbWFuYWdlbWVudCBmb3JlbnNpYyBhbmFseXNpcyB0b29scyIKU1JDX1VSST0ibWly cm9yOi8vc291cmNlZm9yZ2Uvc2xldXRoa2l0LyR7UH0udGFyLmd6IgpIT01FUEFHRT0iaHR0cDov L3d3dy5zbGV1dGhraXQub3JnL3NsZXV0aGtpdC8iCgpLRVlXT1JEUz0ifng4NiIKTElDRU5TRT0i R1BMLTIgSUJNIgpTTE9UPSIwIgoKREVQRU5EPSJkZXYtbGFuZy9wZXJsCglkZXYtcGVybC9EYXRl TWFuaXAiCgpzcmNfdW5wYWNrKCkgewoJdW5wYWNrICR7QX0KCWNkICR7U30KCXNlZCAtaSAnNjMs NjlkJyBzcmMvdGltZWxpbmUvY29uZmlnLXBlcmwKCXNlZCAtaSAnczpgY2QgLi4vLi47IHB3ZGA6 L3VzcjonIHNyYy9zb3J0ZXIvaW5zdGFsbAp9CgpzcmNfY29tcGlsZSgpIHsKCWV4cG9ydCBPUFQ9 IiR7Q0ZMQUdTfSIKCXVuc2V0IENGTEFHUwoJbWFrZSAtZSBuby1wZXJsIHNvcnRlciBtYWN0aW1l IHx8IGRpZSAibWFrZSBmYWlsZWQiCn0KCnNyY19pbnN0YWxsKCkgewoJZG9iaW4gYmluLyoKCWRv ZG9jIENIQU5HRVMgUkVBRE1FIGRvY3MvKgoJZG9jaW50byB0Y3QuZG9jcwoJZG9kb2MgdGN0LmRv Y3MvKgoJaW5zaW50byAvdXNyL3NoYXJlL3NvcnRlcgoJZG9pbnMgc2hhcmUvc29ydGVyLyoKCWRv bWFuIG1hbi9tYW4xLyoKfQo=