# The Sleuth Kit Development **URL:** https://sleuthkit.discourse.group/c/tsk/the-sleuth-kit-development/9.md [Latest](https://sleuthkit.discourse.group/latest.md) · [Categories](https://sleuthkit.discourse.group/categories.md) --- ## [About the The Sleuth Kit Development category](https://sleuthkit.discourse.group/t/about-the-the-sleuth-kit-development-category/79)
**Author:** [@carrier](https://sleuthkit.discourse.group/u/carrier)\ **Replies:** 0
Used for questions about integrating The Sleuth Kit into a forensics tool. --- ## [Link Files and Jump Lists](https://sleuthkit.discourse.group/t/link-files-and-jump-lists/5566)
**Author:** [@Sakar](https://sleuthkit.discourse.group/u/Sakar)\ **Replies:** 0\ **Last updated:** [May 3, 2026, 3:26am UTC](https://sleuthkit.discourse.group/t/link-files-and-jump-lists/5566 "2026-05-03T03:26:19Z")
Context/Goal I am currently finalizing a paper on Windows Shell artifact generation and wanted to share some experimental findings regarding the interaction between applications and \`shell32.dll\`. My goal is to understa… --- ## [Sleuthkit 4.14.0 error: use of undeclared identifier 'libewf\_handle\_read\_random'](https://sleuthkit.discourse.group/t/sleuthkit-4-14-0-error-use-of-undeclared-identifier-libewf-handle-read-random/5419)
**Author:** [@Marius\_Schamschula](https://sleuthkit.discourse.group/u/Marius_Schamschula)\ **Replies:** 0\ **Last updated:** [April 16, 2025, 12:44pm UTC](https://sleuthkit.discourse.group/t/sleuthkit-4-14-0-error-use-of-undeclared-identifier-libewf-handle-read-random/5419 "2025-04-16T12:44:20Z")
I’m getting libtool: compile: ccache /usr/bin/clang -DHAVE\_CONFIG\_H -I. -I../../tsk -I../.. -I./../.. -I/opt/local/include -isysroot/Library/Developer/CommandLineTools/SDKs/MacOSX14.sdk -D\_THREAD\_SAFE -pthread -Wall -W… --- ## [Add Ingest Module/Job to SleuthKit Case (Using Java Bindings)](https://sleuthkit.discourse.group/t/add-ingest-module-job-to-sleuthkit-case-using-java-bindings/4463)
**Author:** [@Mohammed\_Kanaan](https://sleuthkit.discourse.group/u/Mohammed_Kanaan)\ **Replies:** 0\ **Last updated:** [August 12, 2024, 10:40am UTC](https://sleuthkit.discourse.group/t/add-ingest-module-job-to-sleuthkit-case-using-java-bindings/4463 "2024-08-12T10:40:16Z")
I am trying to add an ingest module to the sleuth kit case using the available methods which are addIngestModule and addIngestJob but given the source code I read, it only adds the ingest job to the case without any meth… --- ## [Email parser module : wrong number results page](https://sleuthkit.discourse.group/t/email-parser-module-wrong-number-results-page/4080)
**Author:** [@FabriceMontpellier](https://sleuthkit.discourse.group/u/FabriceMontpellier)\ **Replies:** 2\ **Last updated:** [January 11, 2024, 5:31am UTC](https://sleuthkit.discourse.group/t/email-parser-module-wrong-number-results-page/4080 "2024-01-11T05:31:53Z")
Hello, i’m working with autopsy 4.2.1.0. As you can see in the picture attached, the E-mail messages number found is 36639 and the result page number is one for 10000 results instaed of 4 pages… do you know how to corr… --- ## [Can jls and jcat recover deleted files?](https://sleuthkit.discourse.group/t/can-jls-and-jcat-recover-deleted-files/4089)
**Author:** [@sai\_bharadwaj](https://sleuthkit.discourse.group/u/sai_bharadwaj)\ **Replies:** 0\ **Last updated:** [January 6, 2024, 3:04pm UTC](https://sleuthkit.discourse.group/t/can-jls-and-jcat-recover-deleted-files/4089 "2024-01-06T15:04:25Z")
In the context of ext4 deleted file recovery, I observed that using ‘jls’ and ‘jact’ together successfully we are able to recover a deleted file. However, Autopsy, which is capable of listing deleted files, seems to be … --- ## [Zeroing file inside an image](https://sleuthkit.discourse.group/t/zeroing-file-inside-an-image/3909)
**Author:** [@19Doc89](https://sleuthkit.discourse.group/u/19Doc89)\ **Replies:** 2\ **Last updated:** [September 14, 2023, 1:08pm UTC](https://sleuthkit.discourse.group/t/zeroing-file-inside-an-image/3909 "2023-09-14T13:08:25Z")
Hi guys, I am new to both the sleuthkit library and this forum, I apologize for any inconvenience. I’m developing a software that manipulates the disk image, while analyzing it. I know that that’s pretty unusual in for… --- ## [Autopsy Java Setup](https://sleuthkit.discourse.group/t/autopsy-java-setup/3335)
**Author:** [@tej7gandhi](https://sleuthkit.discourse.group/u/tej7gandhi)\ **Replies:** 0\ **Last updated:** [August 1, 2022, 1:38pm UTC](https://sleuthkit.discourse.group/t/autopsy-java-setup/3335 "2022-08-01T13:38:21Z")
Hello All, I am performing a Java Setup for Autopsy plugin development, is there any walk through video I can refer to or an up-to date tutorial? Thanks and Regards Tej Gandhi --- ## [Pytsk3: Reading FS Block Flags via Python](https://sleuthkit.discourse.group/t/pytsk3-reading-fs-block-flags-via-python/3274)
**Author:** [@MarkusD](https://sleuthkit.discourse.group/u/MarkusD)\ **Replies:** 0\ **Last updated:** [June 10, 2022, 10:14am UTC](https://sleuthkit.discourse.group/t/pytsk3-reading-fs-block-flags-via-python/3274 "2022-06-10T10:14:43Z")
Hi, Is there any possibility to read filesystem block flags under python? I cannot find any exposed functions for this. I found this (Add support for unallocated space within volume. · Issue #19 · py4n6/pytsk · GitHub) … --- ## [Sleuthkit support for AFF4](https://sleuthkit.discourse.group/t/sleuthkit-support-for-aff4/3074)
**Author:** [@dmwp](https://sleuthkit.discourse.group/u/dmwp)\ **Replies:** 0\ **Last updated:** [February 8, 2022, 6:00pm UTC](https://sleuthkit.discourse.group/t/sleuthkit-support-for-aff4/3074 "2022-02-08T18:00:34Z")
Hello, What is the latest official word from Sleuthkit on their support for AFF4 images? Thanks --- ## [Development of Python Module](https://sleuthkit.discourse.group/t/development-of-python-module/2792)
**Author:** [@Masardi\_Saja](https://sleuthkit.discourse.group/u/Masardi_Saja)\ **Replies:** 1\ **Last updated:** [August 23, 2021, 1:06pm UTC](https://sleuthkit.discourse.group/t/development-of-python-module/2792 "2021-08-23T13:06:56Z")
Hi all! I am interested in developing my own python module. Can you suggest the best place to start learning to develop python modules? Thanks for the directions. --- ## [File Path for pytsk3](https://sleuthkit.discourse.group/t/file-path-for-pytsk3/2663)
**Author:** [@Chex2020](https://sleuthkit.discourse.group/u/Chex2020)\ **Replies:** 5\ **Last updated:** [June 16, 2021, 12:56am UTC](https://sleuthkit.discourse.group/t/file-path-for-pytsk3/2663 "2021-06-16T00:56:49Z")
Please, I need help with file path. I have some code in python where I use pytsk3 to access a file and obtain its attributes. Unfortunately, the path I use works on one computer but not on another. It says ‘‘path not fou… --- ## [Finding Sectors Associated with a File](https://sleuthkit.discourse.group/t/finding-sectors-associated-with-a-file/2644)
**Author:** [@Chex2020](https://sleuthkit.discourse.group/u/Chex2020)\ **Replies:** 2\ **Last updated:** [May 16, 2021, 10:43pm UTC](https://sleuthkit.discourse.group/t/finding-sectors-associated-with-a-file/2644 "2021-05-16T22:43:32Z")
Hi, I want to find sectors associated with a particular file. I am using python (pytsk3) and I was able to find the cluster runs but not the disk sectors. Does TSK have a feature to find associated sectors? --- ## [Cannot build TSK 4.10.1](https://sleuthkit.discourse.group/t/cannot-build-tsk-4-10-1/2338)
**Author:** [@Matthew](https://sleuthkit.discourse.group/u/Matthew)\ **Replies:** 6\ **Last updated:** [December 1, 2020, 4:22pm UTC](https://sleuthkit.discourse.group/t/cannot-build-tsk-4-10-1/2338 "2020-12-01T16:22:00Z")
I am attempting to build TSK so I can use it on Expert Witness Files, specifically E01’s. However, I can’t get TSK to build using Visual Studio. I installed Visual Studio 2015. Then downloaded the .tar.gz and decompresse… --- ## [Case Details Report](https://sleuthkit.discourse.group/t/case-details-report/2110)
**Author:** [@fisherd91](https://sleuthkit.discourse.group/u/fisherd91)\ **Replies:** 2\ **Last updated:** [August 25, 2020, 11:18am UTC](https://sleuthkit.discourse.group/t/case-details-report/2110 "2020-08-25T11:18:06Z")
Hello, I am attempting to create a module which would export key case details from the current case into a report. I am having get ddifficulting in using the CaseDetails module with the org.sleuthkit.autopsy.casemodule… --- ## [Tsk\_loaddb ids between different runs](https://sleuthkit.discourse.group/t/tsk-loaddb-ids-between-different-runs/566)
**Author:** [@lfcnassif](https://sleuthkit.discourse.group/u/lfcnassif)\ **Replies:** 2\ **Last updated:** [March 30, 2020, 4:48pm UTC](https://sleuthkit.discourse.group/t/tsk-loaddb-ids-between-different-runs/566 "2020-03-30T16:48:50Z")
Hello everyone! Is it safe to assume obj\_id of tsk\_files table in sqlite generated by tsk\_loaddb does not change between different runs of tsk\_loaddb when comparing the same artifacts? I am planning to implement a “con… --- ## [Unable to compile tsk\_logical\_imager in 4.6.7](https://sleuthkit.discourse.group/t/unable-to-compile-tsk-logical-imager-in-4-6-7/258)
**Author:** [@hammerpants](https://sleuthkit.discourse.group/u/hammerpants)\ **Replies:** 2\ **Last updated:** [September 18, 2019, 8:39pm UTC](https://sleuthkit.discourse.group/t/unable-to-compile-tsk-logical-imager-in-4-6-7/258 "2019-09-18T20:39:10Z")
Hi all, I have successfully compiled previous versions of sleuthkit (4.6.5 and 4.6.6) in the past. However, I appear to be unable to compile 4.6.7 due to the new logical imager project. I am trying to build Release\_Pos… --- ## [How did autopsy. db come from?](https://sleuthkit.discourse.group/t/how-did-autopsy-db-come-from/150)
**Author:** [@test](https://sleuthkit.discourse.group/u/test)\ **Replies:** 1\ **Last updated:** [July 11, 2019, 12:43pm UTC](https://sleuthkit.discourse.group/t/how-did-autopsy-db-come-from/150 "2019-07-11T12:43:46Z")
autopsy how to get the data in autopsy. db?