Skip to content

Building

Jump to bottom
joachimmetz edited this page Dec 22, 2014 · 12 revisions

Introduction

The pytsk source code can be build with different compilers:

  • Using GNU Compiler Collection (GCC)
    • Using Cygwin
  • Using Minimalist GNU for Windows (MinGW)
  • Using Microsoft Visual Studio

Or directly packaged with different package managers:

  • Using Debian package tools (DEB)
  • Using RedHat package tools (RPM)

Note: that there are issues with using SleuthKit 4.1.3 in combination with pytsk. See Building SleuthKit for more information.

Check Troubleshooting if you run into issues building pytsk.

Getting the source

Source package

To get the source package go to the downloads page and download the file named:

pytsk-<version>.tgz

The source package can be extracted by running:

tar xfv pytsk-<version>.tgz

This will create the source directory:

pytsk

Git

To retrieve the source from the repository make sure to install: git

On a Debian-based system it can be installed by running:

sudo apt-get install git

On Windows download git from: http://git-scm.com/download/win

To get the source using git run:

git clone https://github.com/py4n6/pytsk

Using GNU Compiler Collection (GCC)

Before you build pytsk and tools using GNU Compiler Collection (GCC) you'll need to have the necessary compilation and build tools installed. Make sure that on

  • a Linux machine, you have build-essential (Debian-based) or the Development Tools (RedHat-based) installed.
  • a Mac OS X machine, you have XCode (with command line tools) or MacPorts (or equivalent)

Also make sure to have the following dependencies including source headers installed:

When you're using a prebuilt version of libtsk make sure it is up to date. To build the SleuthKit from source see: Building SleuthKit

Change into the source directory and run the following commands to build pytsk:

python setup.py build

Note that setup.py is fragile and sometimes it will fail to detect the SleuthKit header files. By default is will look for the SleuthKit headers in:

/usr/include/tsk*
/usr/local/include/tsk*
../sleuthkit-*/tsk*

setup.py will fail if it detects more than one SleuthKit header directory. The TSK_HEADERS_PATH variable in setup.py can be manually set if necessary.

Also make sure that for setup.py it is only possible to link against one version of the SleuthKit library.

Note setup.py will auto generate the c file for the binding as pytsk3.c. If you hack on the code you can manually run generate_bindings.py or remove pytsk3.c which forces setup.py to regenerate it.

You can install pytsk by running:

python setup.py install

Mac OS X

ld: warning: ignoring file /usr/lib/libtsk.dylib, file was built for x86_64 which is not the architecture being linked (i386): /usr/lib/libtsk.dylib

On Mac OS X it can be that you explicitly need to define you want to build a 64-bit version of pytsk.

ARCHFLAGS='-arch x86_64' python setup.py build

Using Minimalist GNU for Windows (MinGW)

Not recommended.

Using Microsoft Visual Studio

To build pytsk with Microsoft Visual Studio you'll need to install Microsoft Visual Studio 2008 (or later). The express version is sufficient. Note that if you want to build 64-bit version of pytsk with the express version you'll need at least 2010.

You'll also need to install the Python Windows installation (http://python.org/download/). In the example below we use version 2.7.

First generate the source code of the bindings by running the generate_bindings.py script from withing the pytsk source directory, e.g. for SleuthKit 4.1.2:

C:\Python27\python.exe generate_bindings.py ..\sleuthkit-4.1.2

This will create the file pytsk3.c.

Next open the Microsoft Visual Studio 2008 solution file:

pytsk\msvscpp\pytsk3.sln

Build the solution.

For this to work with Visual Studio 2010 change the "pytsk3" project properties:

"Configuration Properties" -> "Linker" -> "General" -> "Additional Library Directories"

Make sure the location to libtsk.lib is correct e.g."

..\sleuthkit-4.1.2\win32\Release;...

Manual installation

To manually install copy the following files:

copy pytsk\msvscpp\Release\pytsk3.pyd C:\Python27\lib\site-packages\

Creating a MSI

If you want to be able to manage the installation via "Programs and Features" in Windows you can create a MSI-based installer by running:

C:\Python27\python.exe setup.py bdist_msi

This will create a file equivalent to:

dist\pytsk-4.1.2.win32-py2.7.msi

For this to work with Visual Studio 2010 we need to run the previous command from either the "Visual Studio Command Prompt (2010)" or "Windows SDK 7.1 Command Prompt" (or equivalent). Check if the VS100COMNTOOLS environment variable is set:

echo %VS100COMNTOOLS%

Set the VS90COMNTOOLS to match VS100COMNTOOLS:

set VS90COMNTOOLS=%VS100COMNTOOLS%

Microsoft Visual Studio 2010 express and 64-bit compilation

Enabling 64-bit compilation support on the express version of Microsoft Visual Studio 2010 can be a tedious process. Below are some relevant links:

If you have set it up correctly the following should work:

Go to:

Configuration manager -> Active solution platform

Select "<New>"

  • Type or select the new platform: "x64"
  • Copy settings from: "Win32"
  • Create new project platforms: enabled

Additionally for every project change:

Configuration Properties -> General -> Platform Toolset

Into "Windows7.1SDK"

This option is available after you've installed the Windows 7 SDK

Using Debian package tools (DEB)

To build pytsk using the Debian package tools make sure you have the following packages installed:

sudo apt-get install build-essential debhelper fakeroot libtalloc2 libtalloc-dev uuid-dev python2.7-dev

Prepare the Debian packing files:

cp -rf dpkg debian

Check if the version information is correct in the file:

debian/changelog

Note: by default this will is set to version "4.1.2".

To build the Debian package change into the source directory and run:

dpkg-buildpackage -rfakeroot

This will create the following files in the parent directory:

pytsk3_4.1.2-1_amd64.deb

To install the pytsk Debian package run:

sudo dpkg -i pytsk3_4.1.2-1_amd64.deb

Using RedHat package tools (RPM)

To build pytsk using the RedHat package tools make sure you have the following packages installed:

yum install rpm-build python-devel libtalloc-devel

To build:

python setup.py bdist_rpm

This will create several files in the dist sub directory including:

pytsk3-4.1.2-1.x86_64.rpm

To install the pytsk RedHat package run:

sudo rpm -ivh dist/pytsk3-4.1.2-1.x86_64.rpm
Clone this wiki locally