Hi, this is the so long talked about Autopsy port.
cat pkg/DESCR: Autopsy is a graphical interface to The Sleuth Kit and other open source digital forensics tools. Autopsy 3 was a complete rewrite from Autopsy 2 to make it Java-based. Autopsy 4 improves on Autopsy 3 by supporting collaboration on a single case by multiple users. It requires a few recently added ports: archivers/sevenzipjbinding, databases/sqlite-jdbc, sysutils/py-prefetch-parser, and updated port: sysutils/sleuthkit, and not yet, but here on the m/l available graphics/openjfx/21 The "original" comes with a lot of bundled binaries and bundled jars, mainly targeting Windows users. It's supposed to run on Linux as well, but less tested, and less modules work there. What works: - *YARA Ingest Module:* uses system YARA (original Autopsy only supports Windows) - *OpenCV:* uses system OpenCV (original Autopsy uses OpenCV 2, OpenBSD has OpenCV 4) - *Plaso Ingest Module:* uses system Plaso (original Autopsy only supports Windows) - *Embedded Files Module:* works with sevenzipjbinding - *Use system TestDisk/PhotoRec* - *Recent Activity Ingest Module:* uses system prefetch-parser - *Timeline View:* via OpenJFX port (WebKit component) - *Audio/Video Playback:* via OpenJFX (media component) - *Solr:* use bundled solr, (Keyword Indexer writes logs to ~/.solr/...) Pinning MODJAVA_VER to 21, as it depends on openjfx/21 which itself is pinned to JDK 21. Patching the autopsy.conf file in pre-build stage didn't work out, it kind of got re-generated, therefore this odd dance in pre-build: and do-install: There's one crasher I haven't figured out yet: it occurs at the end of adding a new datasource. Don't know yet how to get around it. But the case is created with the added datasource, so restarting and opening works. In case anyone is up to look into it, I've two disk images for testing here: https://github.com/buzzdeee/testfiles/tree/main/diskimages any testing, feedback etc. welcome. Sebastian -- https://buzzdeee.reitenba.ch
autopsy.tar.gz
Description: application/gzip
autopsy.tar.gz
Description: application/gzip
