README


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52

pytsk is a Python binding for the SleuthKit.

The SleuthKit is a complete filesystem analysis tool. In the past
PyFlag shipped a Python binding for a statically compiled version
which was incorporated in the PyFlag source tree (Version 2.78). That
version is now very old and does not support HFS+ which SleuthKit 3.1
does. At the time there were some important functions that we needed
to link to but the old libtsk (the shared object produced by older
SleuthKit binaries) did not export these - which is the reason for
incorporating a slightly modified version in the source tree.

These days things are much better - libtsk is designed to be a
general purpose library with many useful functions linked in. The
overall architecture has been tremendously improved and it is now very
easy to use it from an external program.

This is a Python binding against the libtsk shared object. Our aim is
to make the binding reflect the TSK API as much as possible in
capabilities, while at the same time having a nice Pythonic OO
interface:

4.2: http://www.sleuthkit.org/sleuthkit/docs/api-docs/4.2/
4.3: http://www.sleuthkit.org/sleuthkit/docs/api-docs/4.3/

The new binding just links to libtsk which should make it easier to
maintain against newer versions. We should be able to rewrite all the
SleuthKit tools in Python (using the library and bindings) as a
demonstration of what is possible with the new bindings.

If downloaded pytsk using git you'll have to first run:

python setup.py update

If you want to use the latest version of Sleuthkit that is checked into git
(also known as HEAD), instead of the currently supported version, you can run:

python setup.py update --use-head

To build the bindings just use the standard Python distutils method:

python setup.py build
python setup.py install

At the top level of the source tree.

The Python binding is autogenerated from the libtsk header files
using a small OO C shim. This means that most of the fields in many of
the structs are already available. We aim to provide most of the
functionality using this shim (e.g. traversing and iterating over
lists etc). The authoritative source of documentation is the library
API linked above.