                        The Sleuth Kit
                http://www.sleuthkit.org/sleuthkit

                    Installation Instructions

                     Last Modified: Sept 2008


REQUIREMENTS
=============================================================================
Tested Platform:
- FreeBSD 2-6.*
- Linux 2.*
- OpenBSD 2-3.*
- Mac OS X
- SunOS 4-5.*
- Windows

System:
- C compiler
- GNU Make

Optional Programs:
- Autopsy: Provides a graphical HTML-based interface to The
Sleuth Kit (which makes it much easier to use).  Install this AFTER
installing The Sleuth Kit.
    Available at: http://www.sleuthkit.org/autopsy

Optional Libraries:
There are optional features that TSK can use if you have installed
them before you build and install TSK. 

- AFFLIB: Allows you to process disk images that are stored in the
AFF format. Version 3.3.4 has been tested to compile and work with this
release. 
    Available at: http://www.afflib.org

- LibEWF: Allows you to process disk images that are stored in the
Expert Witness format (EnCase Format).  Version 20080501 has been
tested to compile and work with this release.
    Available at: https://www.uitwisselplatform.nl/projects/libewf/



INSTALLATION
=============================================================================

Refer to the README_win32.txt file for details on Windows.

The Sleuth Kit uses the GNU autotools for building and installation. 
There are a few steps to this process.  First, run the 'configure'
script in the root TSK directory.

    $ ./configure

If there were no errors, then run 'make'.

    $ make

The 'make' process will take a while and will build the TSK tools.
When this process is complete, the libraries and executables will
be located in the TSK sub-directories.  To install them, type
'make install'.

    $ make install

By default, this will copy everything in to the /usr/local/ structure.
So, the executables will be in '/usr/local/bin'.  This directory will
need to be in your PATH if you want to run the TSK commands without 
specifying '/usr/local/bin' everytime.


CONFIGURE OPTIONS
-----------------------------------------------------------------------------
There are some arguments to 'configure' that you can supply to
customize the setup. Currently, they focus on the optional disk
image format libraries.

--disable-afflib: Supply this if you want TSK to ignore AFFLIB even
if it is installed.

--disable-ewf: Supply this if you want TSK to ignore libewf even
if it is installed.


-----------------------------------------------------------------------------
Brian Carrier
carrier <at> sleuthkit <dot> org
