The Autopsy Forensic Browser is a graphical interface to the command line
digital investigation analysis tools in The Sleuth Kit. Together, they can
analyze Windows and UNIX disks and file systems (NTFS, FAT, UFS1/2, Ext2/3).
As Autopsy is HTML-based, you can connect to the Autopsy server from any
platform using an HTML browser. Autopsy provides a "File Manager"-like
interface and shows details about deleted data and file system structures.
WARNING: The cross-platform version of Autopsy is no longer actively
developed. This port is retained mainly to allow users with
saved data to migrate to another forensic tool.
WWW: http://www.sleuthkit.org/autopsy/v2/
Default autopsy configuration file is /usr/local/lib/autopsy/conf.pl
The NIST National Software Reference Library (NSRL) contains
hash values of known good and bad files.
http://www.nsrl.nist.gov
If you have a copy of the NSRL, you may add support in Autopsy by
adding the path to the NSRLFile.txt to the "NSRLDB" configuration
entry:
NSRLDB = /path/to/NSRLFile.txt
The index file NSRLFile.txt-md5.idx must be in the same directory.
If it does not exist it may be created with the TSK hfind command:
hfind -i nsrl-md5 /path/to/NSRLFile.txt
Autopsy saves configuration files, audit logs, and output to the
Evidence Locker directory. You MUST specify this with the LOCKDIR
configuration entry before running Autopsy:
LOCKDIR = /path/to/locker
WARNING: The cross-platform version of Autopsy is no longer actively
developed. This port is retained mainly to allow users with
saved data to migrate to another forensic tool.
cleanup: Remove expired ports:
2022-03-31 security/revealrk: Deprecate, marked BROKEN on 12+ in 2018
2022-03-31 devel/apache-commons-modeler: Abandoned upstream, last release in
2013
2022-03-31 security/afl: Abandoned upstream, no new release since 2017. Please
consider using security/afl++ instead
2022-03-31 www/mod_line_edit: Abandoned upstream, last release in 2006, Apache
includes mod_sed
2022-03-31 www/myfaces: Unsupported by upstream, released in 2005
2022-03-31 www/mod_backtrace: Abandoned upstream in 2012 (version 2.0)
2022-03-31 security/base: Broken with PHP 7+, forked here
https://github.com/NathanGibbs3/BASE/
2022-03-31 security/find-zlib: Deprecated, no longer relevant
2022-03-31 security/razorback-clamavNugget: Abandonware, last release in 2012
and listed as alpha quality by upstream
2022-03-31 security/shimmer: Abandonware, last release in 2008
2022-03-31 security/kripp: Abandonware, upstream returns 404 and last release
was back in 2007
2022-03-31 security/ipfilter2dshield: Abandonware, no word of it on upstream web
site
2022-03-31 security/sha: Obsolete, we have tools in base
(Only the first 15 lines of the commit message are shown above )
sysutils/autopsy: Deprecate and set expiration date to 2022-03-31
Unsupported version upstream, current version in tree was released
back in 2010
PR: 260681
Approved by: fbsd@dylanleigh.net (maintainer timeout, 3+ weeks)
sysutils/autopsy: Convert from INTERACTIVE port and assign new maintainer
This port was deprecated because it was unmaintained and interactive,
but Dylan Leigh has brought it back into good standing:
* Convert to a regular port by fixing configure script
- Skip useless prompts to user
- Abort instead of prompting when paths are not found, which will never
happen in ports anyway
- Convert evidence locker and NSRL prompts to pkg-message
* Updated description to warn about project inactivity
* Updated WWW link
* Add pkg-message
* Assign maintainership to Dylan
PR: 191778
Submitted by: Dylan Leigh
Verified by: Redports 8x
Deprecate unmaintained interactive ports for removal in 2 months
Interactive ports can't be packaged which means they don't get tested
weekly either. Ideally all interactive ports should be converted to
regular ports. Reduce the number of these types of ports by pruning
unmaintained ones first. Those wishing to pick up these ports are
expected to convert them to regular ports if this can be done with
reasonable effort. Ports deprecated for removal on 20 August 2014:
* mail/mailagent
* net/delegate
* net-mgmt/nocol
* print/hplip-plugin
* print/xdvi
* sysutils/autopsy
* x11-clocks/xalarm
Approved by: portmgr (bapt)
- Update to version 2.23 (required to match `sysutils/sleuthkit')
- Correctly assign RUN_DEPENDS (before, Perl dependency was recorded twice)
- Relinquish as I do not use this port
Related PR: ports/137781
- Update to 2.06 [1]
- Use %%DATADIR%%
- Use ${LOCALBASE} as default for "sleuthkit" dependency (but the port
is still interactive)
Submitted by: Matt Crossley <moose@freebsdfreaks.net> [1]
PR: ports/89685 [1]
Approved by: Pieter Danhieux (maintainer)
[NEW PORT] sysutils/autopsy: The Autopsy Forensic
The Autopsy Forensic Browser is a graphical interface to
the command line digital forensic analysis tools in The
Sleuth Kit. Together, The Sleuth Kit and Autopsy provide
many of the same features as commercial digital forensics
tools for the analysis of Windows and UNIX file systems
(NTFS, FAT, FFS, EXT2FS, and EXT3FS).
The Sleuth Kit and Autopsy are both Open Source and run on
UNIX platforms. As Autopsy is HTML-based, the investigator
can connect to the Autopsy server from any platform using
an HTML browser. Autopsy provides a "File Manager"-like
interface and shows details about deleted data and file
system structures.
PR: ports/55543
Submitted by: Pieter Danhieux <pieter@securax.be>
