According to maintainer of pytsk (http://code.google.com/p/pytsk/wiki/BuildingSleuthKit#Introduction): [quote] Note: that there are issues with using SleuthKit 4.1.3 in combination with pytsk. the interpretation of IMG_RAW_INFO inside the SleuthKit causes it to segfault (Issue 16 and now requires pytsk to use TSK_IMG_TYPE_EXTERNAL which needs to be patched into SleuthKit 4.1.3 the use of ant in the SleuthKit Makefiles prevents building a DEB file. For the time being the solution is to remove these statements manually and run: autoreconf -fiv For the time being we recommend either using SleuthKit 4.1.2 or SleuthKit 4.1.3 with this patch applied. [/quote] Here is the link to the patch referenced: https://4a014e8976bcea5c2cd7bfa3cac120c3dd10a2f1.googledrive.com/host/0B3fBvzttpiiScUxsUm54cG02RDA/tsk4.1.3_external_type.patch Maybe it is possible to introduce another USE-flag, "tsk" to introduce this patch for SleuthKit? Thank you.
pystk is not in the tree. Moreover, the latest version on github (https://github.com/py4n6/pytsk) seems to work with sleuthkit-4.4.1, although they use their own slightly modified version of sleuthkit now. If you really need to apply this patch, you can take advantage of the epatch_user feature which is already there and patch it locally on your machine.
