Compiling Sleuth Kit with AFF4 support on MacOS

We recently contributed patches to the Sleuth Kit to read AFF4 images. While we are waiting for those to be pulled into the main distribution, the following recipe should suffice for compiling a stand alone copy on MacOS.

Dependencies
The following dependencies are needed to compile libAFF4 on OSX. I use MacPorts, and the corresponding packages i needed to install are:

ossp-uuid
zlib
snappy
raptor2
google-glog
pcrexx
* tclap (missing *.pc file – place in /opt/local/lib/pkgconfig/)

Clone and compile LibAFF4 (C/C++)

Use the following to clone the current release of libaff4, configure it, and install.

git clone https://github.com/google/aff4.git
cd aff4
git submodule update –init third_party/gtest
cd third_party/gtest
git reset –hard
cd ../..
./autogen.sh
./configure CC=clang CXX=clang++ CXXFLAGS=”-std=c++11 -stdlib=libc++ -O2 -g0 -I/opt/local/include” LDFLAGS=”-stdlib=libc++ -L/opt/local/lib”
make
sudo make install

Clone and compile the Sleuth Kit

Use the following to compile the sleuthkit with libaff4 support.

git clone https://github.com/blschatz/sleuthkit.git
cd sleuthkit/
git checkout release-4.4
autoreconf –force –install –verbose
./configure
make
sudo make install