Last Updated: Sept 17, 2014 This file outlines what it takes to build Autopsy from source. Note that it currently only works out of the box on Windows. We are working on getting the process working under non-Windows systems. It generally works, but needs some custom mangling to find the correct C libraries. STEPS: 1) Get Java Setup 1a) Download and install JDK version 1.8. You can now use 32-bit or 64-bit, but special work is needed to get The Sleuth Kit to compile as 64-bit. So, 32-bit is easier. Autopsy has been used and tested with Oracle JavaSE and the included JavaFX support (http://www.oracle.com/technetwork/java/javase/downloads/index.html). OpenJDK and OpenJFX might work, but they are not fully tested with Autopsy. 1b) Ensure that JDK_HOME is set to the root JDK directory. 1c) (optional) Download and install Netbeans IDE (http://netbeans.org/) Note: Netbeans IDE is not required to build and run Autopsy, but it is a recommended IDE to use for development of Autopsy modules. 1d) (optional) If you are going to package Autopsy, then you'll also need to set JRE_HOME_32 to the root 32-bit JRE directory and/or JRE_HOME_64 to the root 64-bit JRE directory. 1e) (optional) For some Autopsy features to be functional, you need to add java executable to the system PATH. 2) Get Sleuth Kit Setup 2a) Download and build the release version of Libewf2 (20130119 or later). All you need is the dll file. Note that you will get a launching error if you use libewf 1. - http://sourceforge.net/projects/libewf/ If you want to build the 64-bit version of The Sleuth Kit, download our 64-bit version of libewf: - https://github.com/sleuthkit/libewf_64bit 2b) Set LIBEWF_HOME environment variable to root directory of LIBEWF 2c) Download and build a Release version of Sleuth Kit (TSK) 4.0. You need to build the tsk_jni project. You can use a released version or download the latest from github: - git://github.com/sleuthkit/sleuthkit.git 2d) Build the TSK JAR file by typing 'ant' in bindings/java in the TSK source code folder from a command line. You can also add the code to a NetBeans project and build it from there. 2e) Set TSK_HOME environment variable to the root directory of TSK 2f) On Non-Windows systems, you will need to do a 'make install' from the TSK root directory to install the libraries and such in the needed places (i.e. '/usr/local'). 3) Get gstreamer Setup. gstreamer is used to view video files. You can either download it and install it or manually by unziping the version that is included in the 'thirdparty/gstreamer' folder. You will need the 'bin' and 'lib/gstreamer-1.0' folders to be in your Windows PATH environment variable. NOTE: This has not been fully tested in non-Windows environments yet, so we don't have instructions for that yet. 4) Get Autopsy source. 4a) If you are not planning to contribute to Autopsy development, clone a read-only repository: git clone https://github.com/sleuthkit/autopsy.git 4b) if you plan to contribute and submit patches, login to Github and create your own Autopsy fork. Then, clone your fork and work on that source-tree: git clone https://github.com/YOUR_USERNAME/autopsy.git You will be able to submit patches by committing and pushing changes to your fork and by submitting pull requests to the main Autopsy repository. 5) Compile Autopsy 5a) using Netbeans IDE: - Start NetBeans IDE and open the Autopsy project. - Choose to build the Autopsy project / module. It is the highest level project that will then cause the other modules to be compiled. 5b) without Netbeans IDE (requires JDK and ant >= 1.7.1): - from root directory of Autopsy source execute: ant build (to build Autopsy) ant run (to run Autopsy) BACKGROUND: Here are some notes to shed some light on what is going on during the build process. - The Sleuth Kit Java datamodel JAR file has native JNI libraries that are copied into it. These JNI libraries have dependencies on libewf and zlib. On non-Windows platforms, the JNI library also has a dependency on libtsk (on Windows, it is compiled into libtsk_jni). - NetBeans uses ant to build Autopsy. The build target copies the TSK datamodel JAR file into the project. If you want to use the debug version of the TSK dll, then there is a different ant target in the TSK datamodel to copy the debug versions of the dlls. - On a Windows system, the compile-time ant target copies the dependency libraries into the Autopsy code structure so that they can be found when Autopsy is run and packaged. At run-time, the native library inside of the JAR file will be extracted and used. - On a Unix system, the ant taget copies only the JNI library and then relies on the other libraries (libtsk, libewf, zilb, etc.) to be installed on the system in their standard locations (i.e. /usr/local). - Everytime that you do a source code update of TSK, make sure you rebuild both the libtsk_dll, the JAR file, and then rebuild Autopsy so that it copies the latest data model JAR file. --------------- Brian Carrier carrier sleuthkit org