Sleuthkit CLI not work with sleuthkit-java 4.10.2.1

The Sleuth Kit Help
1

I have Ubuntu 20.04 with Autopsy 4.18.0. When I run mmls -V via terminal, I get"
“Command ‘mmls’ not found, but can be installed with:
sudo apt install sleuthkit.”

When I run “sudo apt install sleuthkit” , mmls -V works but it removes sleuthkit-4.10.2.jar and attempting to run autopsy-4.18.0, I get:
“…Checking for Sleuth Kit Java bindings…ERROR: sleuthkit-4.10.2.jar not found in /usr/share/java/ or /usr/local/share/java/.
Please install the Sleuth Kit Java bindings file.”

Both autopsy-4.18.0 and mmls -V work OK on Windows (albeit sloooooow). How can I get both to run on Ubuntu 20.04?
Thank you,
Steve

2

Hi Steve.

The problem is that sleuthkit-java conflicts with and replaces libtsk13. libtsk13 is a dependency for sleuthkit so once libtsk13 is removed it takes the rest of its cohorts with it. I haven’t looked into having them both working simultaneously but you could extract and rebuild sleuthkit-java to remove the Conflicts and Replaces entry in the dpkg control file which should allow it to co-exist with sleuthkit on your machine. I don’t know what kind of long term side affects this might have on your system in regards to Autopsy though!

 $ dpkg -I sleuthkit-java_4.10.2-1_amd64.deb
 <snip>
 Depends: libafflib0v5 (>= 3.7.6), libc6 (>= 2.14), libewf2 (>= 20121209), libgcc1 (>= 1:4.2), libsqlite3-0 (>= 3.5.9), libstdc++6 (>= 5.2), libvhdi1 (>= 20150110), libvmdk1 (>= 20150516), zlib1g (>= 1:1.1.4), libewf-dev (>= 20130416), libafflib-dev (>= 3.6.6), libsqlite3-dev, libc3p0-java, libvmdk-dev, libvhdi-dev
 Conflicts: libtsk13
 Replaces: libtsk13
 Section: contrib
 Priority: optional
 Homepage: http://www.sleuthkit.org/sleuthkit
3

atdt0

Thanks for your fast response. I will experiment with it when I get on my linux PC. I assume the “$ dpkg -I sleuthkit-java_4.10.2-1_amd64.deb” opens the .deb to allow editing.

4

What you’ll want to do is ‘apt-get source [package]’ and from there you can edit the Debian control file and do the rebuild. The official docs for doing this are here: BuildingTutorial - Debian Wiki

5

Thank you again. The Debian Wiki looks like a great resource.

Steve