Autopsy 4? about sift HOT 6 OPEN

I'm sure this should be possible. Right now we're installing it through the Ubuntu PPA, and that's pinned at 2.24. We'll likely have to build from source, so I'll take a look at what it'll take to get it working.

from sift.

Thank you.

from sift.

Hi digitalsleuth,

I found this project over the weekend.

https://github.com/labcif/autopsy-packager

~Salty

from sift.

Hey @salty4n6 , sorry for the delay, but I'm looking at this right now. It looks promising, but I need to confirm some dependency issues which seem to be popping up. I'll keep you posted.

from sift.

Hi @salty4n6 , I've taken a great deal of time trying to find a workaround with getting this into SIFT, however the primary issue is that Autopsy depends on certain older versions of libvmdk libewf and libvhdi, which have since been updated by Joachim Metz under the GIFT Repo.

The newer versions are already installed in SIFT, as is Sleuthkit, and this causes a conflict when trying to install Autopsy.

As a workaround, I've created a simple Autopsy docker which can be used within SIFT. If you'd like, you can take a look at it here. The instructions can be found in the repo, and the docker is already built and available on the Docker Hub.

Hopefully, until we find a more permanent solution, I hope this helps.

from sift.

@digitalsleuth - Looks awesome! Much appreciated. I'll kick the tires more soon but from what I've tested so far, it's great.

~Salty

from sift.