Problem installing SIFT

[5h1n0b1]

Hi. I am trying to install SIFT, on a laptop and a USB live, but it shows me many errors, "** ERROR: Install Failure: ***** (Error Code: 100)."

I tried it with the script and "wget --quiet -O - https://raw.github.com/sans-dfir/sift-bootstrap/master/bootstrap.sh | sudo bash -s -- -i -s -y"

Installation on both devices is new, and Ubuntu is the 14.04 LTS 64 bits.

Thanks in advance and sorry for my english.

[ekristen]

Make sure there is no other process running using apt, like the synaptic package manager.

Sent from my iPhone

On Jul 29, 2015, at 03:05, 5h1n0b1 notifications@github.com wrote:

Hi. I am trying to install SIFT, on a laptop and a USB live, but it shows me many errors, "** ERROR: Install Failure: ***** (Error Code: 100)."

I tried it with the script and "wget --quiet -O - https://raw.github.com/sans-dfir/sift-bootstrap/master/bootstrap.sh | sudo bash -s -- -i -s -y"

Installation on both devices is new, and Ubuntu is the 14.04 LTS 64 bits.

Thanks in advance and sorry for my english.

—
Reply to this email directly or view it on GitHub.

[5h1n0b1]

Hi ekristen. Thanks for answering. Synaptic is not running. Mistakes are alternates, some packages installed and the other not. I put the first lines of the console.

wget --quiet -O - https://raw.github.com/sans-dfir/sift-bootstrap/master/bootstrap.sh | sudo bash -s -- -i -s -y

• INFO: Welcome to the SIFT Bootstrap
• INFO: This script will now proceed to configure your system.
• INFO: You supplied the -y option, this script will not exit for any reason
• INFO: OS: Ubuntu
• INFO: Arch: 64
• INFO: Version: 14.04
• INFO: Updating your APT Repositories ...
• INFO: Installing Python Software Properies ...
• INFO: Enabling Universal Repository ...
• INFO: Enabling Elastic Repository ...
• INFO: Adding Ubuntu Tweak Repository
• INFO: Adding SIFT Repository: stable
• INFO: Updating Repository Package List ...
• ERROR: Install Failure: aeskeyfind (Error Code: 100)
• ERROR: Install Failure: afflib-tools (Error Code: 100)
• INFO: Installed Package: afterglow
• ERROR: Install Failure: aircrack-ng (Error Code: 100)
• ERROR: Install Failure: arp-scan (Error Code: 100)
• ERROR: Install Failure: autopsy (Error Code: 100)
• INFO: Installed Package: apache2
• INFO: Installed Package: binplist
• ERROR: Install Failure: bitpim (Error Code: 100)
• ERROR: Install Failure: bitpim-lib (Error Code: 100)
• ERROR: Install Failure: bless (Error Code: 100)
• INFO: Installed Package: blt
• INFO: Installed Package: build-essential
• ERROR: Install Failure: bulk-extractor (Error Code: 100)
  ...

Reviewing the installation log, I see that generates some errors saying;

Could not locate the package *****
The ***** package is not available, but some other package refers to it
The package ***** has no installation candidate

[FCPD85]

I am experiencing the same problems, any possible solutions.

[ekristen]

If you can post the install logs that will help. I am traveling today so I cannot directly troubleshoot, but I can tonight and tomorrow.

On Jul 30, 2015, at 13:04, FCPD85 notifications@github.com wrote:

I am experiencing the same problems, any possible solutions.

—
Reply to this email directly or view it on GitHub.

[DigiAngel]

Same here:

 * ERROR: Install Failure: libbde (Error Code: 100)
 * ERROR: Install Failure: libbde-tools (Error Code: 100)
 * ERROR: Install Failure: libesedb (Error Code: 100)
 * ERROR: Install Failure: libesedb-tools (Error Code: 100)
 * ERROR: Install Failure: libevt (Error Code: 100)
 * ERROR: Install Failure: libevt-tools (Error Code: 100)
 * ERROR: Install Failure: libevtx (Error Code: 100)
 * ERROR: Install Failure: libevtx-tools (Error Code: 100)
 * ERROR: Install Failure: libewf (Error Code: 100)
 * ERROR: Install Failure: libewf-python (Error Code: 100)
 * ERROR: Install Failure: libewf-tools (Error Code: 100)
 * ERROR: Install Failure: libfvde (Error Code: 100)
 * ERROR: Install Failure: libfvde-tools (Error Code: 100)
 * ERROR: Install Failure: libmsiecf (Error Code: 100)
 * ERROR: Install Failure: libolecf (Error Code: 100)
 * ERROR: Install Failure: libregf (Error Code: 100)
 * ERROR: Install Failure: libregf-dev (Error Code: 100)
 * ERROR: Install Failure: libregf-python (Error Code: 100)
 * ERROR: Install Failure: libregf-tools (Error Code: 100)
 * ERROR: Install Failure: libvshadow (Error Code: 100)
 * ERROR: Install Failure: libvshadow-dev (Error Code: 100)
 * ERROR: Install Failure: libvshadow-python (Error Code: 100)
 * ERROR: Install Failure: libvshadow-tools (Error Code: 100)
 * ERROR: Install Failure: python-ntdsxtract (Error Code: 100)
 * ERROR: Install Failure: python-plaso (Error Code: 100)
 * ERROR: Install Failure: pytsk3 (Error Code: 100)
 * ERROR: Install Failure: xmount (Error Code: 100)
 * ERROR: Install Failure: mantaray (Error Code: 100)

Not sure how to attach my install log but I'm more than happy to if someone tells me how :) This is on a fresh install of Ubuntu 14.04 64 bit. Thank you.

[FCPD85]

Here is my entire log file.

Thanks for the help, Darel

On Jul 30, 2015, at 2:26 PM, DigiAngel notifications@github.com wrote:

Same here:

• ERROR: Install Failure: libbde (Error Code: 100)
• ERROR: Install Failure: libbde-tools (Error Code: 100)
• ERROR: Install Failure: libesedb (Error Code: 100)
• ERROR: Install Failure: libesedb-tools (Error Code: 100)
• ERROR: Install Failure: libevt (Error Code: 100)
• ERROR: Install Failure: libevt-tools (Error Code: 100)
• ERROR: Install Failure: libevtx (Error Code: 100)
• ERROR: Install Failure: libevtx-tools (Error Code: 100)
• ERROR: Install Failure: libewf (Error Code: 100)
• ERROR: Install Failure: libewf-python (Error Code: 100)
• ERROR: Install Failure: libewf-tools (Error Code: 100)
• ERROR: Install Failure: libfvde (Error Code: 100)
• ERROR: Install Failure: libfvde-tools (Error Code: 100)
• ERROR: Install Failure: libmsiecf (Error Code: 100)
• ERROR: Install Failure: libolecf (Error Code: 100)
• ERROR: Install Failure: libregf (Error Code: 100)
• ERROR: Install Failure: libregf-dev (Error Code: 100)
• ERROR: Install Failure: libregf-python (Error Code: 100)
• ERROR: Install Failure: libregf-tools (Error Code: 100)
• ERROR: Install Failure: libvshadow (Error Code: 100)
• ERROR: Install Failure: libvshadow-dev (Error Code: 100)
• ERROR: Install Failure: libvshadow-python (Error Code: 100)
• ERROR: Install Failure: libvshadow-tools (Error Code: 100)
• ERROR: Install Failure: python-ntdsxtract (Error Code: 100)
• ERROR: Install Failure: python-plaso (Error Code: 100)
• ERROR: Install Failure: pytsk3 (Error Code: 100)
• ERROR: Install Failure: xmount (Error Code: 100)
• ERROR: Install Failure: mantaray (Error Code: 100)
  Not sure how to attach my install log but I'm more than happy to if someone tells me how :) This is on a fresh install of Ubuntu 14.04 64 bit. Thank you.

—
Reply to this email directly or view it on GitHub #70 (comment).

[ekristen]

Those look like the output and not the log. The home directory of the user you are using should have a sift-install.log if you can drag and drop that into an issue comment it would help.

On Jul 30, 2015, at 13:50, FCPD85 notifications@github.com wrote:

Here is my entire log file.

Thanks for the help, Darel

On Jul 30, 2015, at 2:26 PM, DigiAngel notifications@github.com wrote:

Same here:

• ERROR: Install Failure: libbde (Error Code: 100)
• ERROR: Install Failure: libbde-tools (Error Code: 100)
• ERROR: Install Failure: libesedb (Error Code: 100)
• ERROR: Install Failure: libesedb-tools (Error Code: 100)
• ERROR: Install Failure: libevt (Error Code: 100)
• ERROR: Install Failure: libevt-tools (Error Code: 100)
• ERROR: Install Failure: libevtx (Error Code: 100)
• ERROR: Install Failure: libevtx-tools (Error Code: 100)
• ERROR: Install Failure: libewf (Error Code: 100)
• ERROR: Install Failure: libewf-python (Error Code: 100)
• ERROR: Install Failure: libewf-tools (Error Code: 100)
• ERROR: Install Failure: libfvde (Error Code: 100)
• ERROR: Install Failure: libfvde-tools (Error Code: 100)
• ERROR: Install Failure: libmsiecf (Error Code: 100)
• ERROR: Install Failure: libolecf (Error Code: 100)
• ERROR: Install Failure: libregf (Error Code: 100)
• ERROR: Install Failure: libregf-dev (Error Code: 100)
• ERROR: Install Failure: libregf-python (Error Code: 100)
• ERROR: Install Failure: libregf-tools (Error Code: 100)
• ERROR: Install Failure: libvshadow (Error Code: 100)
• ERROR: Install Failure: libvshadow-dev (Error Code: 100)
• ERROR: Install Failure: libvshadow-python (Error Code: 100)
• ERROR: Install Failure: libvshadow-tools (Error Code: 100)
• ERROR: Install Failure: python-ntdsxtract (Error Code: 100)
• ERROR: Install Failure: python-plaso (Error Code: 100)
• ERROR: Install Failure: pytsk3 (Error Code: 100)
• ERROR: Install Failure: xmount (Error Code: 100)
• ERROR: Install Failure: mantaray (Error Code: 100)
  Not sure how to attach my install log but I'm more than happy to if someone tells me how :) This is on a fresh install of Ubuntu 14.04 64 bit. Thank you.

—
Reply to this email directly or view it on GitHub #70 (comment).

—
Reply to this email directly or view it on GitHub.

[DigiAngel]

No workie with .log files:

[DigiAngel]

Gads that's ugly....anyway there it is.

[5h1n0b1]

Hi ekristen. Quiet, leisurely, not urges me.
As soon as I can, I'll upload the log.
For now, I will use the virtual machine to make a disk image, (alternative solution).
Thanks.

[ekristen]

Lets use gists for the logs, and then just post the gist link in here, https://gist.github.com/, that'll help. Thanks

[ekristen]

@DigiAngel I deleted your entry, cause it was really ugly and not useful, looks like it got truncated. Try a gist, and we'll go from there.

[DigiAngel]

And done:
https://gist.github.com/DigiAngel/3f1cdefb1c31c5610fe2

[DigiAngel]

Ya and good call on the delete ;)

[ekristen]

It looks like a number of packages have gone missing from the stable repo for SIFT, I'll need to investigate and get them back in. In the mean time try this ...

sudo bash bootstrap.sh -iys dev

That'll pull from the dev repo, which has the latest packages in it to.

Keep in mind if you do the dev part we'll want to update that to stable after I resolve the repo problem.

[DigiAngel]

No problem...I'm just starting to get this box set up so I don't mind testing...I'll report my results...thanks as always.

[ekristen]

I found the problem. Kristinn and I have talked about consolidating efforts and where packages are stored and I was off on the timeline. This is my fault, I'll remedy it shortly.

Can you try adding this repo https://launchpad.net/~gift/+archive/ubuntu/stable and then just re-run the bootstrap script normally and that should fix things.

I cannot test this until later tonight at the earliest.

[DigiAngel]

Thanks Erik...looks like that repo has a fair bit of errors as well:

 * ERROR: Install Failure: ccrypt (Error Code: 100)
 * ERROR: Install Failure: readpst (Error Code: 100)
 * ERROR: Install Failure: ettercap-graphical (Error Code: 100)
 * ERROR: Install Failure: driftnet (Error Code: 100)
 * ERROR: Install Failure: tcpreplay (Error Code: 100)
 * ERROR: Install Failure: tcpxtract (Error Code: 100)
 * ERROR: Install Failure: tcptrack (Error Code: 100)
 * ERROR: Install Failure: p0f (Error Code: 100)
 * ERROR: Install Failure: netwox (Error Code: 100)
 * ERROR: Install Failure: lft (Error Code: 100)
 * ERROR: Install Failure: netsed (Error Code: 100)
 * ERROR: Install Failure: socat (Error Code: 100)
 * ERROR: Install Failure: knocker (Error Code: 100)
 * ERROR: Install Failure: nikto (Error Code: 100)
 * ERROR: Install Failure: nbtscan (Error Code: 100)
 * ERROR: Install Failure: radare-gtk (Error Code: 100)
 * ERROR: Install Failure: python-yara (Error Code: 100)
 * ERROR: Install Failure: gzrt (Error Code: 100)
 * ERROR: Install Failure: testdisk (Error Code: 100)
 * ERROR: Install Failure: scalpel (Error Code: 100)
 * ERROR: Install Failure: qemu (Error Code: 100)
 * ERROR: Install Failure: qemu-utils (Error Code: 100)
 * ERROR: Install Failure: gddrescue (Error Code: 100)
 * ERROR: Install Failure: dcfldd (Error Code: 100)
 * ERROR: Install Failure: vmfs-tools (Error Code: 100)
 * ERROR: Install Failure: mantaray (Error Code: 100)
 * ERROR: Install Failure: python-fuse (Error Code: 100)
 * ERROR: Install Failure: samba (Error Code: 100)
 * ERROR: Install Failure: open-iscsi (Error Code: 100)
 * ERROR: Install Failure: curl (Error Code: 100)
 * ERROR: Install Failure: git (Error Code: 100)
 * ERROR: Install Failure: system-config-samba (Error Code: 100)
 * ERROR: Install Failure: libpff (Error Code: 100)
 * ERROR: Install Failure: libpff-dev (Error Code: 100)
 * ERROR: Install Failure: libpff-tools (Error Code: 100)
 * ERROR: Install Failure: libpff-python (Error Code: 100)
 * ERROR: Install Failure: xfsprogs (Error Code: 100)
 * ERROR: Install Failure: gawk (Error Code: 100)
 * ERROR: Install Failure: exfat-fuse (Error Code: 100)
 * ERROR: Install Failure: exfat-utils (Error Code: 100)
 * ERROR: Install Failure: xpdf (Error Code: 100)
 * ERROR: Install Failure: feh (Error Code: 100)
 * ERROR: Install Failure: pyew (Error Code: 100)
 * ERROR: Install Failure: radare (Error Code: 100)
 * ERROR: Install Failure: radare2 (Error Code: 100)
 * ERROR: Install Failure: pev (Error Code: 100)
 * ERROR: Install Failure: tcpick (Error Code: 100)
 * ERROR: Install Failure: pdftk (Error Code: 100)
 * ERROR: Install Failure: sslsniff (Error Code: 100)
 * ERROR: Install Failure: dsniff (Error Code: 100)
 * ERROR: Install Failure: rar (Error Code: 100)
 * ERROR: Install Failure: xdot (Error Code: 100)
 * ERROR: Install Failure: ubuntu-tweak (Error Code: 100)
 * ERROR: Install Failure: vim (Error Code: 100)
 * ERROR: Install Failure: elasticsearch (Error Code: 100)

I'll just remove that repo, update again, and then wait until you've got the sift repo squared away. Thanks again.

[5h1n0b1]

Hi Ekristen. Thank you for solving the problem. You are great ;)

[ghost]

Still having errors today on a fresh Ubuntu 14.04.3 LTS (x64)

• ERROR: Install Failure: libbde (Error Code: 100)
• ERROR: Install Failure: libbde-tools (Error Code: 100)
• ERROR: Install Failure: libesedb (Error Code: 100)
• ERROR: Install Failure: libesedb-tools (Error Code: 100)
• ERROR: Install Failure: libevt (Error Code: 100)
• ERROR: Install Failure: libevt-tools (Error Code: 100)
• ERROR: Install Failure: libevtx (Error Code: 100)
• ERROR: Install Failure: libevtx-tools (Error Code: 100)
• ERROR: Install Failure: libewf (Error Code: 100)
• ERROR: Install Failure: libewf-python (Error Code: 100)
• ERROR: Install Failure: libewf-tools (Error Code: 100)
• ERROR: Install Failure: libfvde (Error Code: 100)
• ERROR: Install Failure: libfvde-tools (Error Code: 100)
• ERROR: Install Failure: libmsiecf (Error Code: 100)
• ERROR: Install Failure: libolecf (Error Code: 100)
• ERROR: Install Failure: libregf (Error Code: 100)
• ERROR: Install Failure: libregf-dev (Error Code: 100)
• ERROR: Install Failure: libregf-python (Error Code: 100)
• ERROR: Install Failure: libregf-tools (Error Code: 100)
• ERROR: Install Failure: libvshadow (Error Code: 100)
• ERROR: Install Failure: libvshadow-dev (Error Code: 100)
• ERROR: Install Failure: libvshadow-python (Error Code: 100)
• ERROR: Install Failure: libvshadow-tools (Error Code: 100)
• ERROR: Install Failure: python-ntdsxtract (Error Code: 100)
• ERROR: Install Failure: python-plaso (Error Code: 100)
• ERROR: Install Failure: pytsk3 (Error Code: 100)
• ERROR: Install Failure: xmount (Error Code: 100)
• ERROR: Install Failure: mantaray (Error Code: 100)

Fixed with solution: sudo bash bootstrap.sh -iys dev

[ekristen]

I just pushed an update to the bootstrap script into the master branch try it.

There are 2 known issues still. libfvde is not installable and mantaray will not install because libfvde is missing.

libfvde is being worked on ... log2timeline/l2tdevtools#30

[joachimmetz]

I don't get why you are waiting for libfvde in GIFT. It is available in SIFT: https://launchpad.net/~sift/+archive/ubuntu/dev. It should not be a show stopper for packages in SIFT that it currently is not available in GIFT.

[ekristen]

I can move it from dev to stable again. Kristinn deleted it from stable because we were migrating to using GIFT.

[joachimmetz]

Kristinn deleted it from stable because we were migrating to using GIFT.

There was no need to delete it, since it is currently not used by plaso and does not conflict with packages in GIFT. So it is fine to put it back.

Also a quick search on the Internet indicates to me that "Error Code: 100" is a dpkg configuration issue:
https://thelowedown.wordpress.com/2010/04/16/debian-apt-get-installs-fail-with-dpkg-error-code-100/

[DigiAngel]

As of about 20 seconds ago:

• ERROR: Install Failure: libfvde (Error Code: 100)
• ERROR: Install Failure: libfvde-tools (Error Code: 100)

This is doing an "update-sift". Should I just point bootstrap to dev with "sudo bash bootstrap.sh -iys dev" or hold off and go stable? I have three SIFT workstations now that are in this state. Thank you.

[ekristen]

I'm waiting on the PPA to update with the libfvde package. As soon as it does it should fix itself.

[ekristen]

Status is Pending -- https://launchpad.net/~sift/+archive/ubuntu/stable/+packages?field.name_filter=libfvde&field.status_filter=published&field.series_filter=trusty

[DigiAngel]

Sweet...thanks a bunch on this...I know you're a busy person :)

[DigiAngel]

This is working perfectly now....I have three very happy SIFT/REMnux machines :)

[Noxcivis]

I've been trying to install with the script and "wget --quiet -O - https://raw.github.com/sans-dfir/sift-bootstrap/master/bootstrap.sh | sudo bash -s -- -i -s -y". I'm using Utunbu LTS 14.04. I'm trying the script on two physical machines and two virtual machines. Lots of components are missing.
. Been trying since 2015-08-10. Still having the issue on the morning of 2015-08-15.

[ekristen]

Interesting. Can you please upload your sift-install.log from your home directory.

Sent from my iPhone

On Aug 15, 2015, at 11:11, Noxcivis notifications@github.com wrote:

I've been trying to install with the script and "wget --quiet -O - https://raw.github.com/sans-dfir/sift-bootstrap/master/bootstrap.sh | sudo bash -s -- -i -s -y". I'm using Utunbu LTS 14.04. I'm trying the script on two physical machines and two virtual machines. Lots of components are missing.

. Been trying since 2015-08-10. Still having the issue on the morning of 2015-08-15.

—
Reply to this email directly or view it on GitHub.

[Noxcivis]

Thanks erkisten ! Log file at : http://expirebox.com/download/c9897b7c0e292207f07ca9f468484d4d.html. Too large to paste as-is.

[ekristen]

Looks like the box you are using is having problems resolving some DNS. Looks like it can't pull a full package history and was unable to install some PGP keys.

On Aug 15, 2015, at 11:51, Noxcivis notifications@github.com wrote:

Thanks erkisten ! Log file at : http://expirebox.com/download/c9897b7c0e292207f07ca9f468484d4d.html. Too large to paste as-is.

—
Reply to this email directly or view it on GitHub.

[Noxcivis]

I'm seeing a lot of success but quite a few failures. For example, Autopsy is consistently failing when I do "update-sift".

..............................

Reading state information...
The following extra packages will be installed:
libtsk sleuthkit
The following NEW packages will be installed:
autopsy libtsk sleuthkit
0 upgraded, 3 newly installed, 0 to remove and 1 not upgraded.
Need to get 5,890 kB of archives.
After this operation, 49.7 MB of additional disk space will be used.
WARNING: The following packages cannot be authenticated!
libtsk sleuthkit

................................

The various machines are on otherwise healthy networks with no other apparent DNS issues.

Can you give me some pointers as to what you see as the DNS issue indicators ?

[ekristen]

The log says it can't resolve us.archive.ubuntu.com

I'll run through another build shortly but I did earlier this week and had no problems.

It also says in the log if you search for PGP that it failed to retrieve one which means a repo was not added that needs to be.

On Aug 15, 2015, at 12:24, Noxcivis notifications@github.com wrote:

I'm seeing a lot of success but quite a few failures. For example, Autopsy is consistently failing when I do "update-sift".

..............................

Reading state information...
The following extra packages will be installed:
libtsk sleuthkit
The following NEW packages will be installed:
autopsy libtsk sleuthkit
0 upgraded, 3 newly installed, 0 to remove and 1 not upgraded.
Need to get 5,890 kB of archives.
After this operation, 49.7 MB of additional disk space will be used.
WARNING: The following packages cannot be authenticated!
libtsk sleuthkit

................................

The various machines are on otherwise healthy networks with no other apparent DNS issues.

Can you give me some pointers as to what you see as the DNS issue indicators ?

—
Reply to this email directly or view it on GitHub.

[ekristen]

@Noxcivis I just ran through a clean install using the latest script from the master branch of the repository and everything built and installed just fine.

Best I can tell there are maybe some DNS/networking issues on your VM that is preventing it from updating and installing properly.

[Noxcivis]

Odd... browsing to that seems ok.... . I'm going to flatten the machine and give it a fresh Ubuntu install and try the script again. Thanks for the help. I'll give feedback after the fresh install and attempt.

[ekristen]

You shouldn't have to do a fresh install. Have you ensured you are getting the latest bootstrap script?

[Noxcivis]

- It's a VM on a nice fast host so no big deal. :) I'm also watching firewall and cache logs for any DNS issues, destination timeouts or drops. Got past "autopsy" this time with no errors so far.

[ekristen]

yeah that is the latest, you have the GIFT repository, found a typo in the script too.

[Noxcivis]

Running the script produced zero visible errors. It was a beautiful thing to behold. :)

Still issues though. Autopsy does not seem happy...

... and the logs show issues towards the end...

[Noxcivis]

Full install log at http://expirebox.com/download/3e7b09748c630a8cb0703ecf34a56c6a.html.

[ekristen]

Check the permissions on your .cache folder looks like something went wrong with permissions there, but that shouldn't have affect on autopsy log. I'm not sure where that is stored off the top of my head, put looks like just a permissions error.

[Noxcivis]

This is a fresh and pristine install with zero changes but I'll check the permissions out. Guessing the following is related...
Note the "~" before "Simon". Guessing that's going to complicate things.

[ekristen]

Are you using 14.04 or 12.04 ubuntu? I think you just found a bug, but not sure how it hasn't surfaced before now.

[Noxcivis]

14.04 LTS. Want me to try with 12.04 ?

[ekristen]

No 14.04 is right.

[ekristen]

I don't think this bug has anything to do with autopsy, but I'll take a look tonight at the bug and see about fixing it.

[ekristen]

Closing this issue for now. Two new issues.

#76

@Noxcivis see this #77