Answer

What operating systems is PyFlag tested on? Will it be ported to windows?

Answer

PyFlag is developed on a debian testing system. Prior to release it is tested on a number of operating systems, namely Fedora Core, Ubuntu, and Knoppix. There are current issues with 64bit variants which we are resolving.

PyFlag should work on other versions of Linux. It is not tested on non-Linux platforms (mainly because we don't have any), but may work with some porting. PyFlag's developers are keen to hear about PyFlag working on non-Linux platforms (e.g. Darwin), and always welcome patches to enhance portability.

PyFlag has not been tested on windows at present. It is unlikely that it will work on windows without major porting (which is always welcome ... ). At this stage there are no plans to support windows.

Of course, since PyFlag is a web application, the client web browser can easily run on windows, but the server backend needs to be installed on Linux.

How do I install PyFlag in a different location? Or how can I try out PyFlag without having to install it into my system?

Answer

PyFlag may be installed into a different prefix by using the --prefix configure parameter:

./configure --prefix=/tmp/

PyFlag used to use CVS, which was good because I used to be able to check out development releases, browse the source code etc. Why is the CVS tree so out of date?

Answer

The PyFlag developers agreed that CVS did not serve their needs, and PyFlag now uses a more advanced version control system called darcs. Darcs allows anyone to check out the repository at any time, and provides a complete mirror of the repository that they can work on while off line. To check out the repository:

darcs get http://pyflag.sourceforge.net/pyflag/

You can browse the current source tree by navigating to http://pyflag.sourceforge.net/pyflag/_darcs/current/. The current changelog can be found by http://pyflag.sourceforge.net/pyflag/_darcs/inventory

I installed PyFlag OK, but when I load a case, and do a keyword search I do not get any results. Whats wrong?

Answer

PyFlag uses a log time indexing algorithm which indexes a dictionary within the Logical Image. This means that PyFlag will only index the occurance of words within the dictionary, and only these words can be searched. When PyFlag is installed, the keyword dictionary is empty, so any cases loaded will not produce any hits. To load a new dictionary use the load_dictionary.py script in the utilities directory:

~/pyflag$ ./utilities/load_dictionary.sh
This script loads a dictionary of words into the pyflag word dictionary. 
These words will then be indexed during scanning.

Usage: load_dictionary.py [Dictionary files]

I usually do the following to load all 3 letter and longer English words:

~/pyflag$ grep -E ...+ /usr/share/dict/words > keywords.txt
~/pyflag$ ./utilities/load_dictionary.sh keywords.txt

You may need to reload the case to force re-indexing. This can be done by removing the case or resetting the case in Case Management.

How do I mount Encase images using the Linux loopback driver?

Answer

PyFlag supports a large number of image file formats. This support is exported to the operating system by using the Fuse project (Filesystems in userspace). The exported filesystem allows the kernel to see the uncompressed, raw image from a wide variety of image file formats.

See Using Fuse with PyFlag for more details.

Frequently Asked Questions