                    Autopsy Forensic Browser
         www.atstake.com/research/tools/autopsy/index.html 

                Brian Carrier [carrier@atstake.com]


Installation
-----------------------------------------------------------------------------
1. Install The @stake Sleuth Kit (TASK) (see README for down load
   locations).  It will be the most convenient if symlinks are made
   from the specific version directory (i.e. task-1.00) to a generic one
   (i.e. task).

2. Untar the Autopsy file. 

3. Run 'make'.  It will try to locate utilities such as grep,
   strings, and md5sum (or md5).  If any are not found, it will
   prompt you for the location.  It will also prompt for the directory
   where TASK was installed and where the default 'morgue' directory
   will be (the morgue is where you will store all of your images).

4. If the morgue directory was not created during installation or if
   you create a new one, then copy the base/fsmorgue file to the morgue
   directory as a template.  

Customizations
------------------------------------------------------------------------------
There are a few settings in conf.pl that you may want to change.  

STIMEOUT: If USE_STIMEOUT is set to 1, then this the server will close
after STIMEOUT seconds of no activity.

CTIMEOUT: The number of seconds to wait before closing a socket.

COOKIES: When USE_COOKIE is set to 1, then all URLs use a random cookie
for authentication.   It is stored in the file named COOKIE_FILE in the 
LOG_FILE directory.  

LOGGING: When USE_LOG is set to 1, then an audit log is saved in a file
named "INVESTIGATOR.log".  This log file contains an audit trail of the
actions performed.  When the USE_NOTES is set to 1, then the investigator
can add comments to a given file, or other object.  The notes are stored
in a file named "INVESTIGATOR.notes".  Both of these files are stored
in either LOG_DIR or the value specified on the command line using the
-l flag.


------------------------------------------------------------------------------
Brian Carrier [carrier@atstake.com]

June 19, 2002
