diff --git a/snap/README.md b/snap/README.md
new file mode 100644
index 0000000000000000000000000000000000000000..d6182d296b9ae157fcdec3831b7161f3ff0355a4
--- /dev/null
+++ b/snap/README.md
@@ -0,0 +1,27 @@
+## Installing Snap
+
+An Autopsy [snap package](https://snapcraft.io/) file can be installed by running `sudo snap install --dangerous autopsy.snap`. The `--dangerous` needs to be specified because the snap package isn't signed (see [install modes](https://snapcraft.io/docs/install-modes#heading--dangerous) for more information). By default, snap doesn't allow certain interactions with the operating system. These [Super-privileged connections](https://snapcraft.io/docs/super-privileged-interfaces) may need to be connected. This can be done manually by running `snap connections autopsy` to determine any missing connections, and then running `snap connect autopsy:home` replacing `home` with the name of the plug. Another option is to run this script, which will connect all missing plugs: `snap connections autopsy | sed -nE 's/^[^ ]* *([^ ]*) *- *- *$/\1/p' | xargs -I{} sudo snap connect {}`. One other possible option may be to install the application with `--devmode` instead of `--dangerous`. The `--devmode` flag is more permissive and will allow all connections to the operating system. More information on interface management can be found at the [snapcraft website](https://snapcraft.io/docs/interface-management).
+
+## Running Autopsy
+
+After installing Autopsy, you should be able to run with `autopsy`. Snap also typically installs a `.desktop` file for your launcher. If you want to perform an ingest on a local disk, you will need to run with permissions for disks in the `/dev` folder. On Ubuntu, that command will be `sudo -g disk autopsy` as `disk` group permissions will give access to that folder.
+
+## Generating The Snap Package
+
+A [snap package](https://snapcraft.io/) of Autopsy can be generated using the [`snapcraft.yml`](./snapcraft.yaml) file. You will need [snapcraft](https://snapcraft.io/) on your system and [lxd](https://snapcraft.io/lxd) works well for virtualization while building the snap package. Since snapcraft needs virtualization to create the snap package, your computer's hardware will need to support virtualization and any relevant settings will need to be enabled. From testing as of November 2022, VirtualBox and WSL are not good build environments. Once the development environment has been set up, a snap package can be built with this command: `snapcraft --use-lxd --debug` run from this directory. If you want to build async, but still get logs, you can run something like this: `nohup snapcraft --use-lxd --debug > ./output.log 2>&1 < /dev/null &`.
+
+## Updating Versions for Snap
+
+The version of Autopsy in the [`snapcraft.yml`](./snapcraft.yaml) can be updated by calling [`version_update.py`](./version_update/version_update.py) with a command like `python version_update.py -s sleuthkit_release_tag -a autopsy_release_tag -v snapcraft_version_name`. You will likely need to install the python dependencies in the [requirements.txt](./version_update/requirements.txt) with a command like: `pip install -r requirements.txt`.
+
+The version of Autopsy can be updated manually by modifying fields relating to git repositories and commits in [`snapcraft.yml`](./snapcraft.yaml) under `parts.autopsy` and `parts.sleuthkit`. Specifically `source`, `source-branch`, and `source-tag`. More information can be found [here](https://snapcraft.io/docs/snapcraft-yaml-reference).
+
+## Troubleshooting
+
+### Solr won't run
+
+An error like "Local Solr Server did not respond to status request" or something similar, may indicate that not all snap connections may have been connected. By default, snap doesn't allow certain interactions with the operating system. These [Super-privileged connections](https://snapcraft.io/docs/super-privileged-interfaces) may need to be connected. This can be done manually by running `snap connections autopsy` to determine any missing connections, and then running `snap connect autopsy:home` replacing `home` with the name of the plug. Another option is to run this script, which will connect all missing plugs: `snap connections autopsy | sed -nE 's/^[^ ]* *([^ ]*) *- *- *$/\1/p' | xargs -I{} sudo snap connect {}`. One other possible option may be to install the application with `--devmode` instead of `--dangerous`. The `--devmode` flag is more permissive and will allow all connections to the operating system. More information on interface management can be found at the [snapcraft website](https://snapcraft.io/docs/interface-management).
+
+### There are no local disks for processing
+
+Autopsy looks at the block devices in the `/dev` directory for local disks to process. If autopsy can't read block devices in that directory, it won't show the local disk. In most instances, starting autopsy with a command like `sudo -g disk autopsy` should give autopsy the right permissions to view local disks. This assumes that the `disk` group has read rights to local disks (i.e. `/dev/sda1`). Appropriate permissions can be determined by running something like `ls -l /dev` looking for the permissions required for the local disks. Then autopsy should be started in such a way that the `$USER` and `$HOME` are preserved (i.e. running as root may be problematic), but the user account and, consequently, autopsy, has sufficient permissions to access local disk block devices.
\ No newline at end of file
diff --git a/snap/gui/autopsy.desktop b/snap/gui/autopsy.desktop
new file mode 100644
index 0000000000000000000000000000000000000000..0af2c78126c71efe2957a1553f3c0fc1fd1ad6d2
--- /dev/null
+++ b/snap/gui/autopsy.desktop
@@ -0,0 +1,9 @@
+[Desktop Entry]
+Name=Autopsy
+Comment=A graphical interface to The Sleuth Kit and other digital forensics tools.
+GenericName=DFIR Tool.
+Exec=autopsy
+Icon=${SNAP}/meta/gui/autopsy.png
+Type=Application
+Categories=Forensics;DFIR
+Keywords=autopsy;sleuth;kit;dfir;forensics
diff --git a/snap/gui/autopsy.png b/snap/gui/autopsy.png
new file mode 100644
index 0000000000000000000000000000000000000000..3173fb97b55ba1b34ec5dd4e41383e402f37b482
Binary files /dev/null and b/snap/gui/autopsy.png differ
diff --git a/snap/snapcraft.yaml b/snap/snapcraft.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..d32596b9ee64a6b9070b4ae335859674b48d4376
--- /dev/null
+++ b/snap/snapcraft.yaml
@@ -0,0 +1,241 @@
+# OVERVIEW:
+# Snap packages are an application and everything needed for that application bundled into a package: https://snapcraft.io/docs/snapcraft
+# Snapd can be installed on the following systems: https://snapcraft.io/docs/installing-snapd
+# Snap packages can be released to the store: https://snapcraft.io/docs/releasing-to-the-snap-store
+# Classic confinement apps and Strict confinement apps using super-priveleged interfaces (https://snapcraft.io/docs/super-privileged-interfaces) will require special approval.
+#
+# DEVELOPMENT / DEBUG:
+# snappy debug can be used to identify apparmor/confinement violations: https://snapcraft.io/docs/debug-snaps#heading--snappy-debug
+# building snaps with lxd/multipass requires hardware assisted virtualization: https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.vm_admin.doc/GUID-2A98801C-68E8-47AF-99ED-00C63E4857F6.html, https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.vm_admin.doc/GUID-F920A3C7-3B42-4E78-8EA7-961E49AF479D.html
+# build provider information can be found here: https://snapcraft.io/docs/build-providers, https://snapcraft.io/docs/build-options
+# A command like the following will run snapcraft in the background to build a snap package and write output to log `nohup snapcraft --use-lxd --debug > ./output.log 2>&1 < /dev/null &``. This must be run from the directory above `snap`
+# Information on debugging snaps can be found here (in particular `snap try` can mount a filesystem as a snap, `snap run --shell autopsy.autopsy` can show shell with env vars like snap ): https://snapcraft.io/docs/debug-snaps, https://snapcraft.io/docs/snap-try
+#
+# INSTALLATION:
+# Some options for installation can be found here: https://snapcraft.io/docs/install-modes
+# Snap uses assertions to digitally sign snaps (https://snapcraft.io/docs/assertions). Otherwise, snaps need to be installed with the `--dangerous` flag
+# it would be best to install autopsy with `sudo snap install --dangerous autopsy` and then connect all super-priveleged interfaces or `sudo snap install --dangerous --devmode autopsy``
+
+# yaml reference here: https://snapcraft.io/docs/snapcraft-yaml-reference
+# sample yaml files here: https://github.com/videolan/vlc/blob/master/extras/package/snap/snapcraft.yaml, https://github.com/canonical/firefox-snap/blob/stable/snapcraft.yaml
+name: autopsy
+# more on base snaps here: https://snapcraft.io/docs/base-snaps
+# core is based on corresponding ubuntu version. ubuntu version information can be found here: https://wiki.ubuntu.com/Releases
+base: core22
+version: 4.20.0
+summary: A graphical interface to The Sleuth Kit and other digital forensics tools. # 79 char long summary
+description: Autopsy is a graphical interface to The Sleuth Kit and other open source digital forensics tools.
+source-code: https://github.com/sleuthkit/autopsy/
+website: https://www.autopsy.com/
+license: Apache-2.0
+grade: stable # must be 'stable' to release into candidate/stable channels
+# Options include 'strict' and 'classic'. 'Strict' is greatly preferred to 'classic'. More information here: https://snapcraft.io/docs/snap-confinement
+# classic confinement does not chroot so elf records need to be patched to point to relative paths: https://snapcraft.io/blog/the-new-classic-confinement-in-snaps-even-the-classics-need-a-change, https://snapcraft.io/docs/linters-classic#heading--issues-auto, https://docs.oracle.com/cd/E19683-01/816-1386/chapter3-33/index.html, https://nehckl0.medium.com/creating-relocatable-linux-executables-by-setting-rpath-with-origin-45de573a2e98
+confinement: strict
+architectures: [amd64]
+# information on lzo here: https://snapcraft.io/blog/why-lzo-was-chosen-as-the-new-compression-method
+compression: lzo
+icon: snap/gui/autopsy.png
+
+plugs:
+ system-files-autopsy:
+ interface: system-files
+ read: [/dev]
+ system-files-hugepages:
+ interface: system-files
+ read: [/sys/kernel/mm/hugepages]
+ # may provide ability for online/offline help
+ browser-sandbox:
+ interface: browser-support
+ allow-sandbox: true
+
+slots:
+ # taken from thunderbird snap: https://github.com/ubuntu/thunderbird/blob/stable/snapcraft.yaml
+ dbus-daemon:
+ interface: dbus
+ bus: session
+ name: org.sleuthkit.autopsy
+
+apps:
+ autopsy:
+ # more on env vars here: https://snapcraft.io/docs/environment-variables
+ environment:
+ jdkhome: $SNAP/usr/lib/jvm/java-17-openjdk-amd64
+ HOME: "$SNAP_USER_COMMON"
+ SOLR_JAVA_HOME: $SNAP/usr/lib/jvm/java-17-openjdk-amd64
+ # provide means for java gstreamer to find gstreamer libs with jna.library.path
+ # set user home to new home value to avoid issues writing cache files to home
+ # can also specify '-Djdk.gtk.verbose=true' for gtk verbose logging: https://stackoverflow.com/a/22457177
+ jreflags: $jreflags '-Djdk.gtk.version=3' '-Duser.home=$SNAP_USER_COMMON' '-Djava.io.tmpdir=$SNAP_USER_COMMON/tmp' '-Djna.library.path=$SNAP_DESKTOP_RUNTIME/usr/lib/x86_64-linux-gnu:$SNAP/usr/local/lib'
+ # to load libtsk.so
+ LD_LIBRARY_PATH: $SNAP/usr/local/lib:$LD_LIBRARY_PATH
+ # make sure path is set up to ensure things like photorec are found
+ PATH: $SNAP/usr/bin:$SNAP/usr/local/bin:$PATH
+ # gstreamer scans for plugins (i.e. app integration plugins). this tells gstreamer where to look for the scanner and libraries
+ # more information here: https://forum.snapcraft.io/t/trouble-with-ros-and-gstreamer/5518/6
+ GST_PLUGIN_SYSTEM_PATH: $SNAP_DESKTOP_RUNTIME/usr/lib/x86_64-linux-gnu/gstreamer-1.0:$SNAP/usr/lib/x86_64-linux-gnu/gstreamer-1.0:$GST_PLUGIN_SYSTEM_PATH
+ GST_PLUGIN_SCANNER: $SNAP_DESKTOP_RUNTIME/usr/lib/x86_64-linux-gnu/gstreamer1.0/gstreamer-1.0/gst-plugin-scanner
+ SOLR_LOGS_DIR: $SNAP_USER_COMMON/.autopsy/dev/solr/logs
+ SOLR_PID_DIR: $SNAP_USER_COMMON/.autopsy/dev/solr/logs
+ # taken from thunderbird snap: https://github.com/ubuntu/thunderbird/blob/stable/snapcraft.yaml
+ DISABLE_WAYLAND: 1
+ GTK_USE_PORTAL: 1
+ command: autopsy/bin/autopsywrapper.sh
+ # More gnome info here: https://snapcraft.io/docs/gnome-extension
+ extensions: [gnome]
+ common-id: org.sleuthkit.autopsy
+ plugs:
+ # taken from https://snapcraft.io/docs/supported-interfaces
+ - audio-playback
+ - block-devices
+ - browser-sandbox
+ - desktop
+ - desktop-launch
+ - desktop-legacy
+ - dm-crypt
+ - fuse-support
+ - gsettings
+ - hardware-observe
+ - home
+ - hugepages-control
+ - kernel-crypto-api
+ - mount-observe
+ - network
+ - network-bind
+ - network-observe
+ - network-setup-observe
+ - network-status
+ - opengl
+ - optical-drive
+ - removable-media
+ - system-files-autopsy
+ - system-files-hugepages
+ - system-observe
+ slots:
+ - dbus-daemon
+
+parts:
+ sleuthkit:
+ # more information on plugins here: https://snapcraft.io/docs/supported-plugins
+ plugin: autotools
+ source: https://github.com/sleuthkit/sleuthkit.git
+ source-branch: develop
+ #source-tag: sleuthkit-4.12.0
+ build-environment: [JAVA_HOME: /usr/lib/jvm/java-17-openjdk-amd64]
+ # information on packages here: https://snapcraft.io/docs/package-repositories
+ build-packages:
+ - build-essential
+ - autoconf
+ - libtool
+ - automake
+ - zip
+ - openjdk-17-jdk
+ - openjdk-17-jre
+ - ant
+ - ant-contrib
+ - ant-optional
+ - libpq-dev
+ - testdisk
+ - libafflib-dev
+ - libewf-dev
+ - libvhdi-dev
+ - libvmdk-dev
+ stage-packages:
+ - libpq-dev
+ - testdisk
+ - libafflib-dev
+ - libewf-dev
+ - libvhdi-dev
+ - libvmdk-dev
+ autopsy:
+ after: [sleuthkit]
+ # information on packages here: https://snapcraft.io/docs/package-repositories
+ build-packages:
+ - zip
+ - unzip
+ - openjdk-17-jdk
+ - openjdk-17-jre
+ - ant
+ - doxygen
+ stage-packages:
+ # lib heif reqs
+ - libheif-dev
+ - libde265-dev
+ # pg reqs
+ - libpq-dev
+ - testdisk
+ # libgstreamer additional plugin reqs that aren't in gnome package extension: https://snapcraft.io/docs/gnome-extension, https://github.com/ubuntu/gnome-sdk/blob/gnome-42-2204/snapcraft.yaml
+ - gstreamer1.0-plugins-bad
+ - gstreamer1.0-plugins-ugly
+ - gstreamer1.0-libav
+ # java req
+ - openjdk-17-jre
+ # needed by solr to determine locally running ports
+ - lsof
+ plugin: nil
+ source: https://github.com/sleuthkit/autopsy.git
+ source-branch: develop
+ build-environment:
+ - JAVA_HOME: /usr/lib/jvm/java-17-openjdk-amd64
+ - TSK_JAVA_LIB_PATH: $SNAPCRAFT_STAGE/usr/local/share/java
+ # information on parts environment variables here: https://snapcraft.io/docs/parts-environment-variables
+ override-build: |
+ # ----- BUILD ZIP -----
+ AUTOPSY_SRC_PATH=$(pwd)
+ NETBEANS_PLAT_VER=$(grep "netbeans-plat-version=" "$AUTOPSY_SRC_PATH/nbproject/platform.properties" | cut -d'=' -f2)
+ AUTOPSY_PLATFORM_PATH="$AUTOPSY_SRC_PATH/netbeans-plat/$NETBEANS_PLAT_VER"
+ AUTOPSY_HARNESS_PATH="$AUTOPSY_PLATFORM_PATH/harness"
+ export TSK_HOME="$HOME/parts/sleuthkit/build"
+ ant -Dnbplatform.active.dir="$AUTOPSY_PLATFORM_PATH" -Dnbplatform.default.harness.dir="$AUTOPSY_HARNESS_PATH" build build-zip
+
+ # ----- SETUP EXTRACT DIRECTORY -----
+ AUTOPSY_LOCATION="$SNAPCRAFT_PART_INSTALL/autopsy"
+ mkdir -p $AUTOPSY_LOCATION
+ AUTOPSY_ZIP=$(find ./dist -maxdepth 1 -name "autopsy-*.*.*.zip")
+ AUTOPSY_ZIP_TMP_LOC=./dist/autopsy_tmp_zip_loc
+ mkdir -p $AUTOPSY_ZIP_TMP_LOC
+ unzip $AUTOPSY_ZIP -d $AUTOPSY_ZIP_TMP_LOC
+ AUTOPSY_EXTRACTED_TMP_LOC=$(find $AUTOPSY_ZIP_TMP_LOC -maxdepth 1 -name "autopsy-*.*.*")
+ cp -r $AUTOPSY_EXTRACTED_TMP_LOC/* $AUTOPSY_LOCATION
+
+ # ----- RUN UNIX SETUP SCRIPT -----
+ UNIX_SETUP_SCRIPT="$AUTOPSY_LOCATION/unix_setup.sh"
+ chmod +x $UNIX_SETUP_SCRIPT
+ $UNIX_SETUP_SCRIPT
+
+ # snaps run applications with different permissions. This ensures applications can run.
+ chmod 755 "$AUTOPSY_LOCATION/bin/autopsy"
+
+ # wrapper to setup temp dir if not exists; also could be easily modified for debugging purposes with snap try: https://snapcraft.io/docs/snap-try
+ cat <<EOF > $AUTOPSY_LOCATION/bin/autopsywrapper.sh
+ #!/bin/bash
+ mkdir -p \$SNAP_USER_COMMON/tmp
+ echo Starting Autopsy...
+ \$SNAP/autopsy/bin/autopsy "\$@"
+ EOF
+
+ chmod 755 $AUTOPSY_LOCATION/bin/autopsywrapper.sh
+
+
+ # taken from https://github.com/ubuntu/gnome-recipes/blob/stable/snapcraft.yaml to clean out files present in core/extensions as well.
+ cleanup:
+ after: [autopsy]
+ plugin: nil
+ build-snaps: [core22, gtk-common-themes, gnome-42-2204]
+ override-prime: |
+ set -eux
+ for snap in "core22" "gtk-common-themes" "gnome-42-2204"; do
+ cd "/snap/$snap/current" && find . -type f,l -name *.so.* -exec rm -f "$CRAFT_PRIME/{}" \;
+ done
+ # remove cross-installed repeated libraries (in /usr/lib in the SDK, but in /usr/lib/TRIPLET
+ # here, and the opposite)
+ for snap in "core22" "gnome-42-2204"; do
+ cd "/snap/$snap/current/usr/lib"
+ for filename in [ *.so* ]; do
+ rm -f "$CRAFT_PRIME/usr/lib/$CRAFT_ARCH_TRIPLET/$filename"
+ done
+ cd "/snap/$snap/current/usr/lib/$CRAFT_ARCH_TRIPLET"
+ for filename in [ *.so* ]; do
+ rm -f "$CRAFT_PRIME/usr/lib/$filename"
+ done
+ done
diff --git a/snap/version_update/.gitignore b/snap/version_update/.gitignore
new file mode 100644
index 0000000000000000000000000000000000000000..f2d51c2b117ae5b11417064ef3b33ad372da9176
--- /dev/null
+++ b/snap/version_update/.gitignore
@@ -0,0 +1,2 @@
+/.idea
+/venv
\ No newline at end of file
diff --git a/snap/version_update/requirements.txt b/snap/version_update/requirements.txt
new file mode 100644
index 0000000000000000000000000000000000000000..72ed5c9e9b08b50d3b5a6e58d677d81402c888ea
--- /dev/null
+++ b/snap/version_update/requirements.txt
@@ -0,0 +1,2 @@
+argparse==1.4.0
+ruamel.yaml==0.17.21
\ No newline at end of file
diff --git a/snap/version_update/version_update.py b/snap/version_update/version_update.py
new file mode 100644
index 0000000000000000000000000000000000000000..74a32f0b3062647340feb41f958d502f7f8687a9
--- /dev/null
+++ b/snap/version_update/version_update.py
@@ -0,0 +1,75 @@
+import sys
+import argparse
+import ruamel.yaml
+from typing import Union
+from os.path import join, dirname, abspath, realpath
+
+SNAPCRAFT_YAML_PATH = join(dirname(dirname(abspath(realpath(__file__)))), 'snapcraft.yaml')
+SLEUTHKIT_REPO = 'https://github.com/sleuthkit/sleuthkit.git'
+AUTOPSY_REPO = 'https://github.com/sleuthkit/autopsy.git'
+
+
+def update_versions(sleuthkit_version_tag: str,
+ autopsy_version_tag: str,
+ snapcraft_version: str,
+ snapcraft_yaml_path: Union[str, None],
+ sleuthkit_repo: Union[str, None],
+ autopsy_repo: Union[str, None]):
+
+ snapcraft_yaml_path = snapcraft_yaml_path if snapcraft_yaml_path is not None and len(
+ snapcraft_yaml_path.strip()) > 0 else SNAPCRAFT_YAML_PATH
+ sleuthkit_repo = sleuthkit_repo if sleuthkit_repo is not None and len(
+ sleuthkit_repo.strip()) > 0 else SLEUTHKIT_REPO
+ autopsy_repo = autopsy_repo if autopsy_repo is not None and len(
+ autopsy_repo.strip()) > 0 else AUTOPSY_REPO
+
+ yaml = ruamel.yaml.YAML()
+ with open(snapcraft_yaml_path) as snapcraft_file:
+ yaml_dict = yaml.load(snapcraft_file)
+
+ yaml_dict['version'] = snapcraft_version
+
+ yaml_dict['parts']['sleuthkit']['source'] = sleuthkit_repo
+ yaml_dict['parts']['sleuthkit']['source-tag'] = sleuthkit_version_tag
+ yaml_dict['parts']['sleuthkit'].pop('source-branch', None)
+
+ yaml_dict['parts']['autopsy']['source'] = autopsy_repo
+ yaml_dict['parts']['autopsy']['source-tag'] = autopsy_version_tag
+ yaml_dict['parts']['autopsy'].pop('source-branch', None)
+
+ with open(snapcraft_yaml_path, "w") as snapcraft_file:
+ yaml.dump(yaml_dict, snapcraft_file)
+
+
+def main():
+ parser = argparse.ArgumentParser(
+ description="Updates snapcraft.yml file with current versions of autopsy and sleuthkit",
+ formatter_class=argparse.ArgumentDefaultsHelpFormatter)
+
+ parser.add_argument('-s', '--sleuthkit_tag', required=True, dest='sleuthkit_version_tag', type=str,
+ help='The git tag to use for sleuthkit.')
+ parser.add_argument('-a', '--autopsy_tag', required=True, dest='autopsy_version_tag', type=str,
+ help='The git tag to use for autopsy.')
+ parser.add_argument('-v', '--version', required=True, dest='snapcraft_version', type=str,
+ help='Version for snapcraft metadata.')
+
+ parser.add_argument('-p', '--snapcraft_path', dest='snapcraft_yaml_path', type=str, default=SNAPCRAFT_YAML_PATH,
+ help='Path to snapcraft.yaml.')
+ parser.add_argument('--sleuthkit_repo', dest='sleuthkit_repo', type=str, default=SLEUTHKIT_REPO,
+ help='Location of sleuthkit repo.')
+ parser.add_argument('--autopsy_repo', dest='autopsy_repo', type=str, default=AUTOPSY_REPO,
+ help='Location of sleuthkit repo.')
+
+ args = parser.parse_args()
+ update_versions(
+ sleuthkit_version_tag=args.sleuthkit_version_tag,
+ autopsy_version_tag=args.autopsy_version_tag,
+ snapcraft_version=args.snapcraft_version,
+ snapcraft_yaml_path=args.snapcraft_yaml_path,
+ sleuthkit_repo=args.sleuthkit_repo,
+ autopsy_repo=args.autopsy_repo
+ )
+
+
+if __name__ == '__main__':
+ main()