GrabDuck

log2timeline/plaso

:

This page contains detailed instructions on how to build and install dependencies on Ubuntu. Some of these instructions should also work on Ubuntu like systems like Debian or Linux Mint.

There are multiple ways to install the dependencies on Ubuntu:

  • Using the GIFT PPA to install prepackaged versions of the dependencies;
  • Using the log2timeline devtools to batch build most of the dependencies;
  • Manual build of the dependencies.

Prepackaged dependencies

Note that the instructions in this page assume you are running on Ubuntu 14.04 or 16.04. Installing packages from the PPA on other versions and/or distributions is not recommended.

The GIFT PPA, pun intended, contains the necessary packages for running plaso. The GIFT PPA provides the following tracks:

  • Release; track intended for the "packaged release" of plaso and dependencies;
  • Bleeding Edge (or Development); track intended for the "development release" of plaso;
  • Testing; track intended for testing newly created packages.

For development we recommend using the "Bleeding Edge" track. To add it to your apt configuration run:

sudo add-apt-repository ppa:gift/dev

To install the dependencies run:

sh config/linux/gift_ppa_install.sh include-development include-test

For troubleshooting crashes it is recommended to install the following debug symbol packages as well:

sh config/linux/gift_ppa_install.sh include-debug

Batch build

Set up the l2tdevtools build script and run:

PYTHONPATH=. python tools/build.py dpkg

Note that the build script is currently still work in progress, but it will build most of the dependencies.

Manual build

It is impossible for us to support all flavors of Ubuntu out there, so if you want smooth sailing, we recommend sticking with the supported version or live with the fact that a manual build of the dependencies can be a tedious task.

For ease of maintenance the following instructions use as much deb package files as possible. Note that the resulting deb files are not intended for public redistribution.

Alternative installation methods like installing directly from source, using easy_install or pip are not recommended because when not maintained correctly they can mess up your setup more easily than using deb packages.

First create a build root directory:

mkdir plaso-build/

Next make sure your installation is up to date:

sudo apt-get update
sudo apt-get upgrade

Build essentials

Make sure the necessary building tools and development packages are installed on the system:

sudo apt-get install build-essential autotools-dev libsqlite3-dev python-dev debhelper devscripts fakeroot quilt git mercurial python-setuptools libtool automake

Python modules

The following instructions apply to the following dependencies:

Some of these Python modules can be directly installed via apt-get:

sudo apt-get install python-yaml

Building a deb

First extract the package:

tar zxvf package-1.0.0.tar.gz

Next change into the package source directory:

cd package-1.0.0\

Some of the Python modules come with dpkg files stored in config/dpkg. For those Python modules copy the dpkg files to a debian sub directory:

cp -rf config/dpkg debian

For those that don't come with dpkg files you can use dpkg-generate.py to generate them e.g.:

PYTHONPATH=l2tdevtools l2tdevtools/tools/dpkg-generate.py --source-directory=. package
mv dpkg debian

Have dpkg-buildpackage build the deb file:

dpkg-buildpackage -rfakeroot

This will create the following files in the build root directory:

python-package-1.0.0-1_all.deb

Note that the actual deb file name can vary per package.

To install the required deb files run:

sudo dpkg -i python-package-1.0.0-1_all.deb

dfVFS

The dfVFS build instructions can be found here. Note that for dfVFS to function correctly several dependencies, like pytsk, mentioned later in a section of this page, are required.

Download the latest source package from: https://github.com/log2timeline/dfvfs/releases

To build deb files run the following command from the build root directory:

tar xvf dfvfs-20140219.tar.gz 
cd dfvfs-20140219/
cp -rf dpkg debian
dpkg-buildpackage -rfakeroot
cd ...

This will create the following files in the build root directory:

python-dfvfs_20140219-1_all.deb

To install the required deb files run:

sudo dpkg -i python-dfvfs_20140219-1_all.deb

Hachoir

To install hachoir run:

sudo apt-get install python-hachoir-core python-hachoir-metadata python-hachoir-parser

IPython

To install IPython run:

sudo apt-get install ipython

For information on how to build IPython from source see: http://ipython.org/ipython-doc/stable/install/install.html

libyal

The following instructions apply to the following dependencies:

Install the following dependencies for building libyal:

sudo apt-get install bzip2-dev libfuse-dev libssl-dev zlib1g-dev

Since the build process for the libyal libraries is very similar, the following paragraph provides building libevt as an example. For more details see the build instructions of the individual projects e.g. https://github.com/libyal/libevt/wiki/Building.

Note that there is also a script to batch build the libyal dependencies more information here: https://github.com/log2timeline/l2tdevtools/wiki/Build-script

Example: libevt and Python-bindings

Download the latest source package from: https://github.com/libyal/libevt/releases

To build deb files run the following command from the build root directory:

tar xfv libevt-alpha-20150105.tar.gz
cd libevt-20130923
cp -rf dpkg debian
dpkg-buildpackage -rfakeroot
cd ..

This will create the following files in the build root directory:

libevt_20150105-1_amd64.deb
libevt-dbg_20150105-1_amd64.deb
libevt-dev_20150105-1_amd64.deb
libevt-python_20150105-1_amd64.deb
libevt-python-dbg_20150105-1_amd64.deb
libevt-tools_20150105-1_amd64.deb

To install the required deb files run:

sudo dpkg -i libevt_20150105-1_amd64.deb libevt-python_20150105-1_amd64.deb

Libyaml and Python-bindings

To install libyaml and Python-bindings run:

sudo apt-get install libyaml-0-2 python-yaml

Pefile

TODO describe

psutil

To install psutil run:

sudo apt-get install python-psutil

PySQLite

Install the following dependencies for building PySQLite:

sudo apt-get install libsqlite3-dev

TODO describe

Pytsk

The build and install Pytsk see:

Optional dependencies for Elastic Search

PyElasticsearch

Download the latest source package from: https://github.com/rhec/pyelasticsearch/releases

TODO describe

XlsxWriter

Download the latest source package from: https://github.com/jmcnamara/XlsxWriter/releases

TODO describe obtaining packing files

To build deb files run the following command from the build root directory:

tar xvf XlsxWriter-RELEASE_0.7.7.tar.gz
cd XlsxWriter-RELEASE_0.7.7
cp -rf config/dpkg debian
dpkg-buildpackage -rfakeroot
cd ..

This will create the following files in the build root directory:

python-xlsxwriter-0.7.7-1_all.deb

To install the required deb files run:

sudo dpkg -i python-xlsxwriter-0.7.7-1_all.deb