The Debian autopsy uses the md5sum executable found in the dpkg package. Privileges ------------------------------------------------------------------------------ If you run autopsy as a normal user you may encounter some problems due to lack of privileges: you may not be able to use the default evidence directory (/var/lib/autopsy/) and you may not be able to mount physical devices. If you believe that what you're going to do would not require root privileges you can safely run autopsy using a custom evidence directory (using the '-d' command line argument). If problems related to permissions arise all the same then probably what you're doing requires root privileges. -- Lorenzo Martignoni , Sat Jan 14 16:28:06 2006 Customizations ------------------------------------------------------------------------------ There are a few settings in conf.pl that you may want to change. STIMEOUT: If USE_STIMEOUT is set to 1, then this the server will close after STIMEOUT seconds of no activity. CTIMEOUT: The number of seconds to wait before closing a socket. COOKIES: When USE_COOKIE is set to 1, then all URLs use a random cookie for authentication. It is stored in the file named "..cookie" in the Evidence Locker directory, where is the port number that is being used. LOGGING: When USE_LOG is set to 1, then audit logs are saved to the case and host directories. There are general logs for the case and host and then investigator specific ones that are saved in the 'logs' directory of the host. When the USE_NOTES is set to 1, then the investigator can add comments to a given file, or other object. The notes are stored in a file in the host 'logs' directory. -- Mattia Monga , Sun Apr 27 11:16:48 2003