Attached updated version contains a tiny fix to the autopsy script in /usr/local/bin
On Sun, Oct 11, 2026 at 10:00 PM Sebastian Reitenbach < [email protected]> wrote: > Hi, > > this is the so long talked about Autopsy port. > > cat pkg/DESCR: > Autopsy is a graphical interface to The Sleuth Kit and other open source > digital forensics tools. Autopsy 3 was a complete rewrite from Autopsy > 2 to make it Java-based. Autopsy 4 improves on Autopsy 3 by supporting > collaboration on a single case by multiple users. > > It requires a few recently added ports: archivers/sevenzipjbinding, > databases/sqlite-jdbc, sysutils/py-prefetch-parser, and updated port: > sysutils/sleuthkit, and not yet, but here on the m/l available > graphics/openjfx/21 > > The "original" comes with a lot of bundled binaries and bundled jars, > mainly targeting > Windows users. It's supposed to run on Linux as well, but less tested, and > less modules work there. > > What works: > > - > > *YARA Ingest Module:* uses system YARA (original Autopsy only supports > Windows) > - > > *OpenCV:* uses system OpenCV (original Autopsy uses OpenCV 2, OpenBSD > has OpenCV 4) > - > > *Plaso Ingest Module:* uses system Plaso (original Autopsy only > supports Windows) > - > > *Embedded Files Module:* works with sevenzipjbinding > - > > *Use system TestDisk/PhotoRec* > - > > *Recent Activity Ingest Module:* uses system prefetch-parser > - > > *Timeline View:* via OpenJFX port (WebKit component) > - > > *Audio/Video Playback:* via OpenJFX (media component) > - > > *Solr:* use bundled solr, (Keyword Indexer writes logs to ~/.solr/...) > > > Pinning MODJAVA_VER to 21, as it depends on openjfx/21 which itself is > pinned to JDK 21. > > Patching the autopsy.conf file in pre-build stage didn't work out, it kind > of got re-generated, therefore this odd dance in pre-build: and do-install: > > There's one crasher I haven't figured out yet: it occurs at the end of > adding a new datasource. Don't know yet how to get around it. But the case > is created with the added datasource, so restarting and opening works. > In case anyone is up to look into it, I've two disk images for testing > here: https://github.com/buzzdeee/testfiles/tree/main/diskimages > > any testing, feedback etc. welcome. > > Sebastian > > -- > https://buzzdeee.reitenba.ch > -- https://buzzdeee.reitenba.ch
autopsy.tar.gz
Description: application/gzip
