                        Autopsy Forensics Browser 
               www.cerias.purdue.edu/homes/carrier/forensics


Installation
-----------------------------------------------------------------------------
WARNING: The installation of autopsy is not automated.

1. Install TCT and TCTUTILs (see README for down load locations).  Autopsy 
   by default assumes that TCT is installed in /usr/local/tct and
   TCTUTILs is in /usr/local/tctutils.  This can be reconfigured in step 6.
   It will be the most convenient if symlinks are made from the specific
   version directory (i.e. tct-1.06) to a generic one (i.e. tct).  

2. Untar the autopsy file.  The assumed directory is /usr/local/autopsy.
   If a different one is used, then the 'use lib' line in autopsy must
   be changed to the new location.

3. Edit the autopsy perl file so the following options are correct:
        USE_STIMEOUT   server will turn off after inactivity (default=0)
        USE_COOKIE     server will authenticate session (default=1)
        USE_LOG        server will log all connections (default=1)
     
3. Create a morgue directory where images will be stored.  For example,
   /usr/local/forensics/morgue. 

4. Copy aux/fsmorgue and aux/zoneinfo files contained in this tar file 
   to the above morgue directory.

5. Edit conf.pl so that the following variables are correct:
        $MORGDIR        directory created in step 3
        $TCTDIR         bin directory where TCT was installed in step 1
        $TCTUTILDIR     bin directory where TCTUTILs was installed in step 1
        $STRINGS_EXE    location of strings(1) executable (optional)
        $GREP_EXE       location of grep(1) executable (optional)
        $MD5_EXE        location of md5(1)/md5sum(1) executable (optional)
        $INVESTIG       full name of forensic investigator

6. Verify the #! perl path is correct (default is #!/usr/bin/perl) in
   autopsy and autopsyfunc.pm.


------------------------------------------------------------------------------
brian carrier [carrier@cerias.purdue.edu]

Mar 17, 2001
