Installation for Python3.7 OLD

Standalone compiled binaries are available for Windows and macOS here, this guide is only for running mac_apt from source code using Python 3.7 (32/64bit). The same should work for 3.8 too

Use these links to jump to instructions for your OS:
Windows, Linux, macOS

Windows

Installing code dependencies:

Use pip to install these dependencies. On windows, this will be found under your python_install_folder\Scripts\pip.exe Run the following command

pip install biplist tzlocal construct==2.9.45 xlsxwriter plistutils kaitaistruct lz4 pycryptodome cryptography pyaff4 pillow

Installing compiled dependencies:

Navigate to the /Libraries_For_Windows folder of the source code. In this folder navigate to the the 32bit_py37 or 64bit_py37 folder depending on whether you have 32 or 64 bit version of python. (Default installation on windows gets you 32 bit python) There are instructions contained in the Readme.txt file in that folder if you need more guidance. Copy all .pyd files contained in the chosen folder to your <Python37_install_folder>\Lib\site-packages folder.

Some of the dlls may have a VC++ dll dependency, so you may need to download and install Microsoft Visual C++ 2015 Redistributable package.

Linux (tested on ubuntu 19.04 64bit)

sudo apt update
sudo apt install python3-pip libbz2-dev zlib1g-dev

Install most dependencies

sudo pip3 install biplist tzlocal construct==2.9.45 xlsxwriter plistutils kaitaistruct lz4 pytsk3==20170802 libvmdk-python==20181227 pycryptodome cryptography pyaff4 pillow

Build, compile and install pylzfse

git clone --recursive https://github.com/ydkhatri/pylzfse
cd pylzfse
python3 setup.py build
sudo python3 setup.py install

Installing pyewf

Download libewf-20140807.tar.gz from https://github.com/libyal/libewf-legacy/releases
Unzip and compile:

cd libewf-20140807
python3 setup.py build
sudo python3 setup.py install

Thats it! Test this by running
python3 mac_apt.py -h

macOS (OSX)

Automated installer

There is an automated install script that will download and install mac_apt and all dependencies. If you wish to use that, download mac_aptInstall-macOS-v17.sh from here, then run the following commands on the Terminal to add execution permission to the file and run it.

chmod u+x mac_aptInstall-macOS-v17.sh
./mac_aptInstall-macOS-v17.sh

Note: Every time you need to run the script you have to open a terminal, browse to the mac_apt folder and activate the virtualenv with the command
source env/bin/activate

Alternatively, if you wish to do install manually, follow the steps below:

Install Homebrew. You will need this to install the other components.

Install python3.7, pip & git

macOS already ships with python 2.7, however it does not come with pip or python dev libraries. It is not recommended to try to alter the installed python framework or upgrade any of the installed packages. There is also the fact that many of these packages are under System Integrity Protection and macOS will not let you alter them! So we install another instance of python using brew, this will automatically get pip and python-devel. Let's also install git with brew.

brew install python3 git

In order to avoid confusion about python libraries, we will lock down our environment using virtualenv. This way any dependencies we install/upgrade/remove will only affect that instance and nothing else. This will avoid hours of frustration later!

sudo pip3 install --upgrade virtualenv

Now go to the extracted mac_apt (source code) folder, from here create the virtual environment, we just call it 'env' here.

cd mac_apt
virtualenv --python python3  env

Now activate 'env' with command:

source env/bin/activate

Your environment is setup and ready for use. When you are done with the rest of the installation and need to go back to the regular shell, type deactivate. Run all the commands below in this activated shell only.

Build, compile and Install pylzfse (tested on High Sierra-10.13)

git clone --recursive https://github.com/ydkhatri/pylzfse
cd pylzfse
python setup.py build
python setup.py install

Installing pytsk & pyvmdk

Install pytsk3 version 20170802, the later versions are not fully tested and known to have issues with mac_apt.

pip3 install pytsk3==20170802 libvmdk-python==20181227

You should not need 'sudo' here, as its only writing to our custom environment.

Installing pyewf

Download libewf-20140807.tar.gz from https://github.com/libyal/libewf-legacy/releases
Unzip and compile:

cd libewf-20140807
python setup.py build
python setup.py install

Installing other dependencies

pip3 install biplist tzlocal construct==2.9.45 xlsxwriter plistutils kaitaistruct lz4 pycryptodome cryptography pyaff4 pillow

Now that all dependencies are installed, you can run python mac_apt.py -h to run the script (-h shows you available options). You can deactivate the virtualenv when done.

Note: Every time you need to run the script you have to open a terminal, browse to the mac_apt folder and activate the virtualenv with the command
source env/bin/activate

---

Possible run-time Errors

Libewf (pyewf)

On Linux/macOS, certain E01 files may not be readable with the installed pyewf library. If you come across an E01 that can't be read correctly, then try this version of libewf: libewf-experimental-20171104. Follow the same procedure as outlined under Installing pyewf above.
For macOS, here is a modified version of the installation script that will install this alternate version of libewf - mac_aptInstall-macOS-v17a.sh

Sqlite

On Windows, if you have an old installation of Python, you may not have the latest sqlite library. It is recommended to update your version of sqlite3.dll to the latest one, go to: https://sqlite.org/download.html. Download and copy the sqlite3.dll file to the DLLs folder inside your python installation folder. Replace the old file with new one.

For other run-time problems, see Known-issues-and-Workarounds.