Installing Snap
An Autopsy snap package file can be installed by running sudo snap install --dangerous autopsy.snap
. The --dangerous
needs to be specified because the snap package isn't signed (see install modes for more information). Super-priveleged may need to be connected. This can be done manually by running snap connections autopsy
to determine any missing connections, and then running snap connect autopsy:home
replacing home
with the name of the plug. Another option is to run this script, which will connect all missing plugs: snap connections autopsy | sed -nE 's/^[^ ]* *([^ ]*) *- *- *$/\1/p' | xargs -I{} sudo snap connect {}
. One other possible option may be to install the application with --devmode
instead of --dangerous
.
Running Autopsy
After installing Autopsy, you should be able to run with autopsy
. Snap also typically installs a .desktop
file for your launcher. If you want to perform an ingest on a local disk, you will need to run with permissions for disks in the /dev
folder. On Ubuntu, that command will be sudo -g disk autopsy
as disk
group permissions will give access to that folder.
Generating The Snap Package
A snap package of Autopsy can be generated using the snapcraft.yml
file. You will need snapcraft on your system and lxd works well for virtualization while building the snap package. Since snapcraft needs virtualization to create the snap package, your computer's hardware will need to support virtualization and any relevant settings will need to be enabled. From testing as of November 2022, VirtualBox and WSL are not good build environments. Once the development environment has been set up, a snap package can be built with this command: snapcraft --use-lxd --debug
run from this directory. If you want to build async, but still get logs, you can run something like this: nohup snapcraft --use-lxd --debug > ./output.log 2>&1 < /dev/null &
.
Updating Versions for Snap
The version of Autopsy in the snapcraft.yml
can be updated by calling version_update.py
with a command like python version_update.py -s sleuthkit_release_tag -a autopsy_release_tag -v snapcraft_version_name
. You will likely need to install the python dependencies in the requirements.txt with a command like: pip install -r requirements.txt
.
The version of Autopsy can be updated manually by modifying fields relating to git repositories and commits in snapcraft.yml
under parts.autopsy
and parts.sleuthkit
. Specifically source
, source-branch
, and source-tag
. More information can be found here.