search

teamdfir / sift

SIFT
MIT License
492 stars 65 forks source link

All Sleuthkit MD5's are the same? #44

Closed user31415 closed 9 years ago

user31415 commented 9 years ago

Sleuthkit indicates that all MD5's are identical for an imported Win7 image.

Perhaps this is related to a missing module (icat ?)?

user31415 commented 9 years ago

In Sift 3.0, Autopsy is looking for "icat-sleuthkit" which is missing. Creating a soft link of:

            ln -s /usr/bin/icat /usr/bin/icat-sleuthkit

resolves the issue.

ekristen commented 9 years ago

I'll get this committed in

ekristen commented 9 years ago

Done - https://github.com/sans-dfir/sift-bootstrap/blob/master/bootstrap.sh#L757