--- tct-1.19.orig/debian/tct.docs
+++ tct-1.19/debian/tct.docs
@@ -0,0 +1,8 @@
+Beware
+README.FIRST
+TODO
+TODO.before-next-release
+bibliography
+help-recovering-file
+help-when-broken-into
+docs/*
--- tct-1.19.orig/debian/control
+++ tct-1.19/debian/control
@@ -0,0 +1,36 @@
+Source: tct
+Section: admin
+Priority: optional
+Maintainer: Debian Forensics <forensics-devel@lists.alioth.debian.org>
+Uploaders: Christophe Monniez <christophe.monniez@fccu.be>
+Build-Depends: debhelper (>= 7.0.50~), quilt, e2fslibs-dev
+Standards-Version: 3.8.3
+Homepage: http://www.porcupine.org/forensics/tct.html
+Vcs-Browser: http://git.debian.org/?p=forensics/tct.git
+Vcs-Git: git://git.debian.org/forensics/tct.git
+
+Package: tct
+Architecture: any
+Depends: ${shlibs:Depends}, ${misc:Depends}, file, libdate-manip-perl, timeout | coreutils (>= 7.5-1)
+Recommends: lsof
+Suggests: acct
+Description: collection of forensics related utilities
+ TCT is a collection of programs for a post-mortem analysis of a UNIX system
+ after break-in. It enables you to collect data regarding deleted files,
+ modification times of files and more.
+ .
+ Install this BEFORE you need to use it, so you do not risk destroying essential
+ forensic data before you begin.
+ .
+ Tools contained within this package: grave-robber, lazarus, inode-cat,
+ ils, unrm and pcat.
+
+Package: timeout
+Architecture: any
+Depends: ${shlibs:Depends}, ${misc:Depends}
+Description: run a command with a time limit
+ timeout executes a command and imposes an elapsed time limit. When the time
+ limit is reached, timeout sends a predefined signal to the target process.
+ .
+ Please note that recent coreutils (>= 7.5-1) provide a timeout binary as well
+ so you probably won't need this package anymore nowadays.
--- tct-1.19.orig/debian/source.lintian-overrides
+++ tct-1.19/debian/source.lintian-overrides
@@ -0,0 +1,3 @@
+# Avoid warnings if non-uploaders to uploads.
+tct source: changelog-should-mention-nmu
+tct source: source-nmu-has-incorrect-version-number
--- tct-1.19.orig/debian/tct.manpages
+++ tct-1.19/debian/tct.manpages
@@ -0,0 +1,10 @@
+man/man1/ils.1
+man/man1/icat.1
+man/man1/mactime.1
+man/man1/unrm.1
+man/man1/grave-robber.1
+man/man1/lazarus.1
+man/man1/pcat.1
+man/man1/major_minor.1
+
+debian/manpages/*
--- tct-1.19.orig/debian/changelog
+++ tct-1.19/debian/changelog
@@ -0,0 +1,215 @@
+tct (1.19-1) unstable; urgency=low
+
+ * Merging upstream version 1.19
+ * Update debian/patches/02-seconds.patch (Closes: #532342).
+ Thanks to Aron Griffis <agriffis@n01se.net>.
+ * Try to get around the timeout vs. coreutils issue (Closes: #543271).
+ * Update VCS headers (moved to alioth).
+ * Bump Standards-Version to 3.8.3.
+ * Build-Depend on debhelper (>= 7.0.50~) to fix debhelper-overrides-
+ need-versioned-build-depends
+
+ -- Michael Prokop <mika@debian.org> Mon, 05 Oct 2009 16:37:39 +0200
+
+tct (1.18-4) unstable; urgency=low
+
+ * Updating package to standards version 3.8.2.
+ * Adding lintian overrides.
+
+ -- Daniel Baumann <daniel@debian.org> Thu, 09 Jul 2009 12:58:04 +0200
+
+tct (1.18-3) unstable; urgency=low
+
+ * Renaming debian sub-directories to better matching names.
+ * Using quilt rather than dpatch.
+ * Adding patch from Sami Liedes <sliedes@cc.hut.fi> to add support for
+ fractions of seconds for timeout (Closes: #412923).
+ * Unifing code style for variables in tct.postrm.
+ * Updating year in copyrigth file.
+ * Updating to standards 3.8.1.
+ * Using correct rfc-2822 date formats in changelog.
+
+ -- Daniel Baumann <daniel@debian.org> Thu, 28 May 2009 22:55:57 +0200
+
+tct (1.18-2) unstable; urgency=low
+
+ * Setting uploaders to Christophe.
+
+ -- Daniel Baumann <daniel@debian.org> Mon, 08 Dec 2008 13:36:00 +0100
+
+tct (1.18-1) unstable; urgency=low
+
+ * New maintainer (Closes: #499333).
+ * New upstream release (Closes: #262948).
+ * Acknolwedge NUMs (Closes: #235099, #325419).
+ * Redone debian packaging from scratch.
+
+ -- Daniel Baumann <daniel@debian.org> Thu, 27 Nov 2008 15:49:00 +0100
+
+tct (1.11-6.5) unstable; urgency=low
+
+ * Non-maintainer upload.
+ * Fix FTBFS due to wrong use of CFLAGS in debian/rules (Closes: #476023).
+ * Remove useless tct.{postinst,prerm} and timeout.{postinst,prerm}.
+
+ -- Evgeni Golov <sargentd@die-welt.net> Tue, 29 Apr 2008 18:54:03 +0200
+
+tct (1.11-6.4) unstable; urgency=low
+
+ * Non-maintainer upload.
+ * Fix debian/copyrright (Closes: 431541), thanks to Brian M. Carlson for the
+ patch.
+
+ -- Pierre Habouzit <madcoder@debian.org> Sun, 30 Mar 2008 21:12:16 +0000
+
+tct (1.11-6.3) unstable; urgency=medium
+
+ * Non-maintainer upload.
+ * Fix FTBFS due to kernel syscall macros (Closes: #393007).
+
+ -- Luk Claes <luk@debian.org> Tue, 24 Oct 2006 19:55:20 +0200
+
+tct (1.11-6.2) unstable; urgency=low
+
+ * Non-maintainer upload
+ * Fix FTBFS on amd64, thanks to Andreas Jochens for the patch
+ (closes: #251446)
+ * Fix missing include of <errno.h> in src/file/file.c, fsmagic.c,
+ compress.c (closes: #324579)
+
+ -- Hamish Moffatt <hamish@debian.org> Mon, 29 Aug 2005 00:07:38 +1000
+
+tct (1.11-6.1) unstable; urgency=low
+
+ * Non-Maintainer Upload.
+ * Fix FTBFS, patch from Daniel Schepler (Closes: #223209):
+ * Add e2fslibs-dev to Build-Depends.
+ * Fix broken include of kernel headers.
+ * Change path of lsmod to /bin/lsmod.
+
+ -- Steinar H. Gunderson <sesse@debian.org> Mon, 16 Feb 2004 03:16:43 +0100
+
+tct (1.11-6) unstable; urgency=low
+
+ * Ahh, the St. Valentine's Day release!
+ * Edit /etc/tct/coroner.cf so mactime and ils2mac actually work.
+ (Closes: #180919)
+
+ -- Andrew Stribblehill <ads@debian.org> Fri, 14 Feb 2003 09:46:19 +0000
+
+tct (1.11-5) unstable; urgency=low
+
+ * Back out all changes to timeout.c, since Wietse convinced me they were
+ for specious reasons.
+ * Move config files from /etc/tct/*.conf to /etc/tct/*.cf to fit in with
+ upstream.
+
+ -- Andrew Stribblehill <ads@debian.org> Mon, 21 Oct 2002 15:10:43 +0100
+
+tct (1.11-4) unstable; urgency=low
+
+ * Upgrade to Policy 3.5.7:
+ * support DEB_BUILD_OPTIONS=noopt for removing optimisation.
+
+ -- Andrew Stribblehill <ads@debian.org> Tue, 15 Oct 2002 13:56:15 +0100
+
+tct (1.11-3) unstable; urgency=low
+
+ * New upstream release. (closes: #135086)
+ * Use debhelper. Reduces size of diff as well as making maintenance
+ easier.
+ * Remove the empty /usr/sbin directory from the package.
+ * Now Suggests acct.
+ * Provide an md5sums listing for debsums. (closes: #164466)
+ * Let grave-robber know about dpkg.
+ * Make 'timeout' exit with status 128+signum if it had to kill a
+ process. (closes: #137240)
+
+ -- Andrew Stribblehill <ads@debian.org> Tue, 15 Oct 2002 11:21:28 +0100
+
+tct (1.07-11) unstable; urgency=low
+
+ * New maintainer.
+ * Remove postinst and prerm scripts for both tct and timeout, now the
+ /usr/doc -> /usr/share/doc transition has changed gear.
+ * Make both packages 'Section: admin'
+
+ -- Andrew Stribblehill <ads@debian.org> Thu, 03 Oct 2002 15:55:54 +0100
+
+tct (1.07-10) unstable; urgency=low
+
+ * Updated contact address.
+
+ -- Yotam Rubin <yotamr@bezeqint.net> Wed, 22 May 2002 16:16:59 +0300
+
+tct (1.07-9) unstable; urgency=low
+
+ * Made timeout return the exit code of the forked command.
+ Closes: Bug#132927
+ * Prevented signal recursion in timeout. Closes: Bug#132929, Bug#135165
+ * Clarified the manual page. Closes: Bug#134999
+
+ -- Yotam Rubin <yotam@makif.omer.k12.il> Fri, 22 Feb 2002 12:33:54 +0200
+
+tct (1.07-8) unstable; urgency=low
+
+ * Restored paths.pl to its original state. Closes: Bug#118072
+
+ -- Yotam Rubin <yotam@makif.omer.k12.il> Fri, 02 Nov 2001 23:36:48 +0200
+
+tct (1.07-7) unstable; urgency=low
+
+ * Fixed typo in debian/control. Closes: Bug#109560.
+
+ -- Yotam Rubin <yotam@makif.omer.k12.il> Mon, 17 Sep 2001 16:19:16 +0300
+
+tct (1.07-6) unstable; urgency=low
+
+ * Added proper Conflicts and Replaces against netatalk for timeout.
+ Closes: Bug#112219.
+
+ -- Yotam Rubin <yotam@makif.omer.k12.il> Sat, 15 Sep 2001 21:53:35 +0300
+
+tct (1.07-5) unstable; urgency=low
+
+ * Fixed alpha build problem. Patch from Christpoher Chimelis.
+ Closes: Bug#110341
+
+ -- Yotam Rubin <yotam@makif.omer.k12.il> Sat, 01 Sep 2001 17:29:44 +0300
+
+tct (1.07-4) unstable; urgency=low
+
+ * Added proper Replaces: for older tct revisions. Closes: Bug#109713
+
+ -- Yotam Rubin <yotam@makif.omer.k12.il> Thu, 23 Aug 2001 15:39:32 +0300
+
+tct (1.07-3) unstable; urgency=low
+
+ * Conflict with netatalk's timeout has been resolved. Closes: Bug#106355
+
+ -- Yotam Rubin <yotam@makif.omer.k12.il> Fri, 10 Aug 2001 04:16:54 +0300
+
+tct (1.07-2) unstable; urgency=low
+
+ * Fixed ia64 build problem. Closes: Bug#105085
+
+ -- Yotam Rubin <yotam@makif.omer.k12.il> Sat, 14 Jul 2001 22:10:38 +0300
+
+tct (1.07-1) unstable; urgency=low
+
+ * Fixed conflict. Closes: Bug#100913
+
+ -- Yotam Rubin <yotam@makif.omer.k12.il> Sun, 17 Jun 2001 23:25:34 +0300
+
+tct (1.06-2) unstable; urgency=low
+
+ * Fixed build problems. Closes: Bug#99649
+ * This packages has no build dependencies yet.
+
+ -- Yotam Rubin <yotam@makif.omer.k12.il> Sat, 02 Jun 2001 18:30:28 +0300
+
+tct (1.06-1) unstable; urgency=low
+
+ * First Debian release
+
+ -- Yotam Rubin <yotam@makif.omer.k12.il> Sat, 07 Apr 2001 03:34:36 +0200
--- tct-1.19.orig/debian/copyright
+++ tct-1.19/debian/copyright
@@ -0,0 +1,389 @@
+Authors:
+ Dan Farmer
+ Wietse Venema
+Download: http://www.porcupine.org/forensics/tct.html
+
+Files: *
+Copyright: (C) 1999 Dan Farmer
+License: BSD
+ Redistribution and use in source and binary forms are permitted
+ provided that this entire copyright notice is duplicated in all such
+ copies.
+ .
+ THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+ WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+ MERCHANTABILITY AND FITNESS FOR ANY PARTICULAR PURPOSE.
+ .
+ IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
+ INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ (INCLUDING, BUT NOT LIMITED TO, LOSS OF USE, DATA, OR PROFITS OR
+ BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
+ OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
+ ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+Files:
+ extras/findkey/*, extras/entropy/*, lib/logger.pl, lib/command.pl,
+ lib/datez.pl, src/aux/*, src/major_minor/*, src/fstools/*, src/pcat/*
+Copyright:
+ (C) 1999 Dan Farmer
+ (C) 2003-2008 Wietse Venema <wietse@porcupine.org>
+License: other
+ IBM PUBLIC LICENSE VERSION 1.0 - CORONER TOOLKIT UTILITIES
+ .
+ THE ACCOMPANYING PROGRAM IS PROVIDED UNDER THE TERMS OF THIS IBM PUBLIC LICENSE
+ ("AGREEMENT"). ANY USE, REPRODUCTION OR DISTRIBUTION OF THE PROGRAM CONSTITUTES
+ RECIPIENT'S ACCEPTANCE OF THIS AGREEMENT.
+ .
+ 1. DEFINITIONS
+ .
+ "Contribution" means:
+ a) in the case of International Business Machines Corporation ("IBM"),
+ the Original Program, and
+ b) in the case of each Contributor,
+ i) changes to the Program, and
+ ii) additions to the Program;
+ where such changes and/or additions to the Program originate
+ from and are distributed by that particular Contributor.
+ A Contribution 'originates' from a Contributor if it was added
+ to the Program by such Contributor itself or anyone acting on
+ such Contributor's behalf.
+ Contributions do not include additions to the Program which:
+ (i) are separate modules of software distributed in conjunction
+ with the Program under their own license agreement, and
+ (ii) are not derivative works of the Program.
+ .
+ "Contributor" means IBM and any other entity that distributes the Program.
+ .
+ "Licensed Patents " mean patent claims licensable by a Contributor which are
+ necessarily infringed by the use or sale of its Contribution alone or when
+ combined with the Program.
+ .
+ "Original Program" means the original version of the software accompanying this
+ Agreement as released by IBM, including source code, object code and
+ documentation, if any.
+ .
+ "Program" means the Original Program and Contributions.
+ .
+ "Recipient" means anyone who receives the Program under this Agreement,
+ including all Contributors.
+ .
+ 2. GRANT OF RIGHTS
+ .
+ a) Subject to the terms of this Agreement, each Contributor hereby grants
+ Recipient a non-exclusive, worldwide, royalty-free copyright license to
+ reproduce, prepare derivative works of, publicly display, publicly perform,
+ distribute and sublicense the Contribution of such Contributor, if any, and
+ such derivative works, in source code and object code form.
+ .
+ b) Subject to the terms of this Agreement, each Contributor hereby grants
+ Recipient a non-exclusive, worldwide, royalty-free patent license under
+ Licensed Patents to make, use, sell, offer to sell, import and otherwise
+ transfer the Contribution of such Contributor, if any, in source code and
+ object code form. This patent license shall apply to the combination of the
+ Contribution and the Program if, at the time the Contribution is added by the
+ Contributor, such addition of the Contribution causes such combination to be
+ covered by the Licensed Patents. The patent license shall not apply to any
+ other combinations which include the Contribution. No hardware per se is
+ licensed hereunder.
+ .
+ c) Recipient understands that although each Contributor grants the licenses to
+ its Contributions set forth herein, no assurances are provided by any
+ Contributor that the Program does not infringe the patent or other
+ intellectual property rights of any other entity. Each Contributor disclaims
+ any liability to Recipient for claims brought by any other entity based on
+ infringement of intellectual property rights or otherwise. As a condition to
+ exercising the rights and licenses granted hereunder, each Recipient hereby
+ assumes sole responsibility to secure any other intellectual property rights
+ needed, if any. For example, if a third party patent license is required to
+ allow Recipient to distribute the Program, it is Recipient's responsibility to
+ acquire that license before distributing the Program.
+ .
+ d) Each Contributor represents that to its knowledge it has sufficient
+ copyright rights in its Contribution, if any, to grant the copyright license
+ set forth in this Agreement.
+ .
+ 3. REQUIREMENTS
+ .
+ A Contributor may choose to distribute the Program in object code form under
+ its own license agreement, provided that:
+ a) it complies with the terms and conditions of this Agreement; and
+ b) its license agreement:
+ i) effectively disclaims on behalf of all Contributors all
+ warranties and conditions, express and implied, including
+ warranties or conditions of title and non-infringement, and
+ implied warranties or conditions of merchantability and fitness
+ for a particular purpose;
+ ii) effectively excludes on behalf of all Contributors all
+ liability for damages, including direct, indirect, special,
+ incidental and consequential damages, such as lost profits;
+ iii) states that any provisions which differ from this Agreement
+ are offered by that Contributor alone and not by any other
+ party; and
+ iv) states that source code for the Program is available from
+ such Contributor, and informs licensees how to obtain it in a
+ reasonable manner on or through a medium customarily used for
+ software exchange.
+ .
+ When the Program is made available in source code form:
+ a) it must be made available under this Agreement; and
+ b) a copy of this Agreement must be included with each copy of the
+ Program.
+ .
+ Each Contributor must include the following in a conspicuous location in the
+ Program:
+ .
+ Copyright (c) 1997,1998,1999, International Business Machines
+ Corporation and others. All Rights Reserved.
+ .
+ In addition, each Contributor must identify itself as the originator of its
+ Contribution, if any, in a manner that reasonably allows subsequent Recipients
+ to identify the originator of the Contribution.
+ .
+ 4. COMMERCIAL DISTRIBUTION
+ .
+ Commercial distributors of software may accept certain responsibilities with
+ respect to end users, business partners and the like. While this license is
+ intended to facilitate the commercial use of the Program, the Contributor who
+ includes the Program in a commercial product offering should do so in a manner
+ which does not create potential liability for other Contributors. Therefore, if
+ a Contributor includes the Program in a commercial product offering, such
+ Contributor ("Commercial Contributor") hereby agrees to defend and indemnify
+ every other Contributor ("Indemnified Contributor") against any losses, damages
+ and costs (collectively "Losses") arising from claims, lawsuits and other legal
+ actions brought by a third party against the Indemnified Contributor to the
+ extent caused by the acts or omissions of such Commercial Contributor in
+ connection with its distribution of the Program in a commercial product
+ offering. The obligations in this section do not apply to any claims or Losses
+ relating to any actual or alleged intellectual property infringement. In order
+ to qualify, an Indemnified Contributor must:
+ a) promptly notify the Commercial Contributor in writing of such claim,
+ and
+ b) allow the Commercial Contributor to control, and cooperate with the
+ Commercial Contributor in, the defense and any related settlement
+ negotiations. The Indemnified Contributor may participate in any such
+ claim at its own expense.
+ .
+ For example, a Contributor might include the Program in a commercial product
+ offering, Product X. That Contributor is then a Commercial Contributor. If that
+ Commercial Contributor then makes performance claims, or offers warranties
+ related to Product X, those performance claims and warranties are such
+ Commercial Contributor's responsibility alone. Under this section, the
+ Commercial Contributor would have to defend claims against the other
+ Contributors related to those performance claims and warranties, and if a court
+ requires any other Contributor to pay any damages as a result, the Commercial
+ Contributor must pay those damages.
+ .
+ 5. NO WARRANTY
+ .
+ EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, THE PROGRAM IS PROVIDED ON AN
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, EITHER EXPRESS OR
+ IMPLIED INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES OR CONDITIONS OF TITLE,
+ NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Each
+ Recipient is solely responsible for determining the appropriateness of using
+ and distributing the Program and assumes all risks associated with its exercise
+ of rights under this Agreement, including but not limited to the risks and
+ costs of program errors, compliance with applicable laws, damage to or loss of
+ data, programs or equipment, and unavailability or interruption of operations.
+ .
+ 6. DISCLAIMER OF LIABILITY
+ .
+ EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, NEITHER RECIPIENT NOR ANY
+ CONTRIBUTORS SHALL HAVE ANY LIABILITY FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING WITHOUT LIMITATION LOST
+ PROFITS), HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY
+ WAY OUT OF THE USE OR DISTRIBUTION OF THE PROGRAM OR THE EXERCISE OF ANY RIGHTS
+ GRANTED HEREUNDER, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
+ .
+ 7. GENERAL
+ .
+ If any provision of this Agreement is invalid or unenforceable under applicable
+ law, it shall not affect the validity or enforceability of the remainder of the
+ terms of this Agreement, and without further action by the parties hereto, such
+ provision shall be reformed to the minimum extent necessary to make such
+ provision valid and enforceable.
+ .
+ If Recipient institutes patent litigation against a Contributor with respect to
+ a patent applicable to software (including a cross-claim or counterclaim in a
+ lawsuit), then any patent licenses granted by that Contributor to such
+ Recipient under this Agreement shall terminate as of the date such litigation
+ is filed. In addition, If Recipient institutes patent litigation against any
+ entity (including a cross-claim or counterclaim in a lawsuit) alleging that the
+ Program itself (excluding combinations of the Program with other software or
+ hardware) infringes such Recipient's patent(s), then such Recipient's rights
+ granted under Section 2(b) shall terminate as of the date such litigation is
+ filed.
+ .
+ All Recipient's rights under this Agreement shall terminate if it fails to
+ comply with any of the material terms or conditions of this Agreement and does
+ not cure such failure in a reasonable period of time after becoming aware of
+ such noncompliance. If all Recipient's rights under this Agreement terminate,
+ Recipient agrees to cease use and distribution of the Program as soon as
+ reasonably practicable. However, Recipient's obligations under this Agreement
+ and any licenses granted by Recipient relating to the Program shall continue
+ and survive.
+ .
+ IBM may publish new versions (including revisions) of this Agreement from time
+ to time. Each new version of the Agreement will be given a distinguishing
+ version number. The Program (including Contributions) may always be distributed
+ subject to the version of the Agreement under which it was received. In
+ addition, after a new version of the Agreement is published, Contributor may
+ elect to distribute the Program (including its Contributions) under the new
+ version. No one other than IBM has the right to modify this Agreement. Except
+ as expressly stated in Sections 2(a) and 2(b) above, Recipient receives no
+ rights or licenses to the intellectual property of any Contributor under this
+ Agreement, whether expressly, by implication, estoppel or otherwise. All rights
+ in the Program not expressly granted under this Agreement are reserved.
+ .
+ This Agreement is governed by the laws of the State of New York and the
+ intellectual property laws of the United States of America. No party to this
+ Agreement will bring a legal action under this Agreement more than one year
+ after the cause of action arose. Each party waives its rights to a jury trial
+ in any resulting litigation.
+
+Files: Date/Manip.pm
+Copyright: (C) 1995-1999 Sullivan Beck
+License: GPL | Artistic
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of either:
+ .
+ a) the GNU General Public License as published by the Free
+ Software Foundation; either version 1, or (at your option) any
+ later version, or
+ .
+ b) the "Artistic License" which comes with this Kit.
+ .
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See either
+ the GNU General Public License or the Artistic License for more details.
+
+Files: lib/realpath.pl
+Copyright: 1996 Shigio Yamaguchi
+License: GPL | Artistic
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of either:
+ .
+ a) the GNU General Public License as published by the Free
+ Software Foundation; either version 1, or (at your option) any
+ later version, or
+ .
+ b) the "Artistic License" which comes with this Kit.
+ .
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See either
+ the GNU General Public License or the Artistic License for more details.
+
+Files: man/man1/file.1, src/file/*
+Copyright: (C) 1987-1995 Ian F. Darwin
+License: BSD
+ This software (or derivative software) may not be made subject to any
+ license which denies anyone permission to alter it and redistribute it
+ freely. Derivative software must also still fall under this license.
+ .
+ This software is not subject to any export provision of the United States
+ Department of Commerce, and may be exported to any country or planet.
+ .
+ Permission is granted to anyone to use this software for any purpose on
+ any computer system, and to alter it and redistribute it freely, subject
+ to the following restrictions:
+ .
+ 1. The author is not responsible for the consequences of use of this
+ software, no matter how awful, even if they arise from flaws in it.
+ .
+ 2. The origin of this software must not be misrepresented, either by
+ explicit claim or by omission. Since few users ever read sources,
+ credits must appear in the documentation.
+ .
+ 3. Altered versions must be plainly marked as such, and must not be
+ misrepresented as being the original software. Since few users
+ ever read sources, credits must appear in the documentation.
+ Derivative works must also be marked as such, and credits must appear
+ in the documentation.
+ .
+ 4. This notice may not be removed or altered.
+
+Files: man/man1/lastcomm.1, src/lastcomm/*
+Copyright: (C) 1980-1993
+License: The Regents of the University of California
+ Redistribution and use in source and binary forms, with or without
+ modification, are permitted provided that the following conditions
+ are met:
+ .
+ 1. Redistributions of source code must retain the above copyright
+ notice, this list of conditions and the following disclaimer.
+ .
+ 2. Redistributions in binary form must reproduce the above copyright
+ notice, this list of conditions and the following disclaimer in the
+ documentation and/or other materials provided with the distribution.
+ .
+ 3. All advertising materials mentioning features or use of this software
+ must display the following acknowledgement:
+ .
+ This product includes software developed by the University of
+ California, Berkeley and its contributors.
+ .
+ 4. Neither the name of the University nor the names of its contributors
+ may be used to endorse or promote products derived from this software
+ without specific prior written permission.
+ .
+ THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ SUCH DAMAGE.
+
+Files: src/misc/md5.*
+Copyright: (C) 1991-1992 RSA Data Security, Inc.
+License: Other
+ License to copy and use this software is granted provided that it
+ is identified as the "RSA Data Security, Inc. MD5 Message-Digest
+ Algorithm" in all material mentioning or referencing this software
+ or this function.
+ .
+ License is also granted to make and use derivative works provided
+ that such works are identified as "derived from the RSA Data
+ Security, Inc. MD5 Message-Digest Algorithm" in all material
+ mentioning or referencing the derived work.
+ .
+ RSA Data Security, Inc. makes no representations concerning either
+ the merchantability of this software or the suitability of this
+ software for any particular purpose. It is provided "as is"
+ without express or implied warranty of any kind.
+ .
+ These notices must be retained in any copies of any part of this
+ documentation and/or software.
+
+Files: debian/*
+Copyright: (C) 2008-2009 Daniel Baumann <daniel@debian.org>
+License: BSD
+ Redistribution and use in source and binary forms, with or without
+ modification, are permitted providing that the following conditions
+ are met:
+ .
+ 1. Redistributions of source code must retain the above copyright
+ notice, this list of conditions and the following disclaimer.
+ .
+ 2. Redistributions in binary form must reproduce the above copyright
+ notice, this list of conditions and the following disclaimer in the
+ documentation and/or other materials provided with the distribution.
+ .
+ THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ POSSIBILITY OF SUCH DAMAGE.
--- tct-1.19.orig/debian/tct.install
+++ tct-1.19/debian/tct.install
@@ -0,0 +1,18 @@
+conf/coroner.cf /etc/tct
+conf/grave-robber.cf /etc/tct
+conf/lazarus.cf /etc/tct
+conf/look@first /etc/tct
+conf/paths.pl /etc/tct
+conf/save_these_files /etc/tct
+
+bin/grave-robber /usr/bin
+bin/icat /usr/bin
+bin/ils /usr/bin
+bin/mactime /usr/bin
+bin/major_minor /usr/bin
+bin/pcat /usr/bin
+bin/unrm /usr/bin
+extras/ils2mac /usr/bin
+lazarus/lazarus /usr/bin
+
+lib/* /usr/share/tct
--- tct-1.19.orig/debian/tct.postrm
+++ tct-1.19/debian/tct.postrm
@@ -0,0 +1,26 @@
+#!/bin/sh
+
+set -e
+
+case "${1}" in
+ purge)
+ echo "Purging grave-robber databases..."
+
+ rm -rf /etc/tct /var/cache/tct
+
+ echo " done."
+ ;;
+
+ remove|upgrade|failed-upgrade|abort-install|abort-upgrade|disappear)
+
+ ;;
+
+ *)
+ echo "postrm called with unknown argument \`${1}'" >&2
+ exit 1
+ ;;
+esac
+
+#DEBHELPER#
+
+exit 0
--- tct-1.19.orig/debian/compat
+++ tct-1.19/debian/compat
@@ -0,0 +1 @@
+7
--- tct-1.19.orig/debian/timeout.install
+++ tct-1.19/debian/timeout.install
@@ -0,0 +1 @@
+bin/timeout /usr/bin
--- tct-1.19.orig/debian/timeout.manpages
+++ tct-1.19/debian/timeout.manpages
@@ -0,0 +1 @@
+man/man1/timeout.1
--- tct-1.19.orig/debian/rules
+++ tct-1.19/debian/rules
@@ -0,0 +1,24 @@
+#!/usr/bin/make -f
+
+SHELL := sh -e
+
+%:
+ dh ${@} --with quilt
+
+override_dh_auto_clean:
+ cp conf/paths.pl conf/paths.pl.debian
+
+ $(MAKE) tidy
+ chmod 0755 debian/rules
+
+ mv conf/paths.pl.debian conf/paths.pl
+
+ for SCRIPT in bin/mactime bin/grave-robber bin/strip_tct_home extras/bdf extras/realpath extras/ils2mac lazarus/lazarus; \
+ do \
+ sed -i -e 's|^#!/usr/bin/perl.*$$|#!/usr/bin/perl5|' $$SCRIPT; \
+ done
+
+ dh_clean
+
+override_dh_auto_build:
+ dh_auto_build -- OPT="$(CFLAGS)" DEBUG=-g
--- tct-1.19.orig/debian/tct.examples
+++ tct-1.19/debian/tct.examples
@@ -0,0 +1 @@
+debian/examples/*
--- tct-1.19.orig/debian/tct.dirs
+++ tct-1.19/debian/tct.dirs
@@ -0,0 +1 @@
+/var/cache/tct/data
--- tct-1.19.orig/debian/tct.links
+++ tct-1.19/debian/tct.links
@@ -0,0 +1,2 @@
+/usr/bin/icat /usr/bin/inode-cat
+/usr/share/man/man1/icat.1.gz /usr/share/man/man1/inode-cat.1.gz
--- tct-1.19.orig/debian/examples/md5_image_maker.sh
+++ tct-1.19/debian/examples/md5_image_maker.sh
@@ -0,0 +1,23 @@
+#!/bin/sh
+
+# md5_image_maker: Produce raw images of partitions and store their appropriate
+# md5 sums in a separate file.
+# 2001-2002 Yotam Rubin <yotam@makif.omer.k12.il>
+#
+# Usage: md5_image_maker <partition> <partition> ...
+
+MD5SUM="/usr/bin/md5sum"
+
+if [ -z "${1}" ]
+then
+ echo "Usage: ${0} PARTITION [PARTITON ...]"
+ exit 1
+fi
+
+touch md5sums
+
+for PARTITION in ${@}
+do
+ dd if=/dev/${PARTITION} of=${PARTITION}.bin
+ ${MD5SUM} ${PARTITION}.bin >> md5sums
+done
--- tct-1.19.orig/debian/patches/02-seconds.patch
+++ tct-1.19/debian/patches/02-seconds.patch
@@ -0,0 +1,52 @@
+Author: Sami Liedes <sliedes@cc.hut.fi> + Aron Griffis <agriffis@n01se.net>
+Description:
+ Adding support for fractions of seconds for timeout (Closes: #412923).
+ Fix "does not exit until timeout when launched in a cgi" (Closes: #532342).
+
+diff -Naurp tct.orig/src/misc/timeout.c tct/src/misc/timeout.c
+--- tct.orig/src/misc/timeout.c 2009-05-28 19:05:34.000000000 +0000
++++ tct/src/misc/timeout.c 2009-05-28 20:48:29.000000000 +0000
+@@ -39,6 +39,8 @@
+ #include <stdlib.h>
+ #include <unistd.h>
+ #include <stdio.h>
++#include <sys/time.h>
++#include <sys/wait.h>
+
+ extern int optind;
+
+@@ -69,10 +71,11 @@ int main(argc, argv)
+ int argc;
+ char **argv;
+ {
+- int time_to_run;
++ double time_to_run;
+ pid_t pid;
+ pid_t child_pid;
+ int status;
++ struct itimerval itv;
+
+ progname = argv[0];
+
+@@ -83,7 +86,7 @@ char **argv;
+ if ((kill_signal = atoi(*argv + 1)) <= 0)
+ usage();
+
+- if (argc < 2 || (time_to_run = atoi(argv[0])) <= 0)
++ if (argc < 2 || (time_to_run = atof(argv[0])) <= 0)
+ usage();
+
+ commandname = argv[1];
+@@ -105,7 +108,11 @@ char **argv;
+ (void) signal(SIGQUIT, terminate);
+ (void) signal(SIGTERM, terminate);
+ (void) signal(SIGALRM, terminate);
+- alarm(time_to_run);
++ itv.it_value.tv_sec = (long)time_to_run;
++ itv.it_value.tv_usec = (time_to_run-itv.it_value.tv_sec)*1000000;
++ itv.it_interval.tv_sec = 0;
++ itv.it_interval.tv_usec = 0;
++ (void) setitimer(ITIMER_REAL, &itv, NULL);
+ while ((pid = wait(&status)) != -1 && pid != child_pid)
+ /* void */ ;
+ return (pid == child_pid ? WEXITSTATUS(status) | WTERMSIG(status) : -1);
--- tct-1.19.orig/debian/patches/01-conglomeration.patch
+++ tct-1.19/debian/patches/01-conglomeration.patch
@@ -0,0 +1,487 @@
+Author: n/a
+Description: Needs to be broken out (FIXME).
+
+diff -Naurp tct.orig/bin/grave-robber tct/bin/grave-robber
+--- tct.orig/bin/grave-robber 2007-01-21 22:18:00.000000000 +0000
++++ tct/bin/grave-robber 2008-11-28 07:58:27.000000000 +0000
+@@ -1,4 +1,4 @@
+-#!/usr/bin/perl5
++#!/usr/bin/perl
+
+ #
+ # Usage: $0 [-filmnpstvDEFIMOPVS] [-b body_file] [-c corpse_dir]
+@@ -118,7 +118,7 @@ else {
+ $TCT_HOME = "";
+ }
+
+-@INC = ("$TCT_HOME/lib", "$TCT_HOME/conf", @INC);
++@INC = ("/etc/tct", "/usr/share/tct", @INC);
+
+ #
+ # get user input on what the program should do...
+@@ -415,10 +415,10 @@ print "going into grave_robber_init()\n"
+ #
+ &log_init_path($logfile);
+
+-$LIB = "$TCT_HOME/lib";
+-$BIN = "$TCT_HOME/bin";
+-$ETC = "$TCT_HOME/etc";
+-$CONFIG = "$TCT_HOME/conf";
++$LIB = "/usr/share/tct";
++$BIN = "/usr/bin";
++$ETC = "/etc";
++$CONFIG = "/etc/tct";
+
+ if (!$TCT_HOME) {
+ die "Can't find TCT_HOME - did you run reconfig?\n";
+diff -Naurp tct.orig/bin/mactime tct/bin/mactime
+--- tct.orig/bin/mactime 2007-01-21 22:18:00.000000000 +0000
++++ tct/bin/mactime 2008-11-28 07:58:27.000000000 +0000
+@@ -1,5 +1,5 @@
+-#!/usr/bin/perl5
+-#
++#!/usr/bin/perl
++
+ # A program that attempts to determine what files (taken from an already
+ # calculated DB; see the file "body") were mucked with at a given time...
+ # probably to match when a user was logged in, but since logs get smashed,
+@@ -97,7 +97,7 @@
+ BEGIN {
+ $running_under_grave_robber = 1;
+ $TCT_HOME = "";
+-require "$TCT_HOME/conf/coroner.cf";
++require "/etc/tct/coroner.cf";
+ }
+
+ require "body_init.pl";
+diff -Naurp tct.orig/bin/strip_tct_home tct/bin/strip_tct_home
+--- tct.orig/bin/strip_tct_home 2007-01-21 22:18:00.000000000 +0000
++++ tct/bin/strip_tct_home 2008-11-28 07:58:27.000000000 +0000
+@@ -1,4 +1,4 @@
+-#!/usr/bin/perl5
++#!/usr/bin/perl
+ #
+ # NOTE!!!
+ #
+diff -Naurp tct.orig/conf/coroner.cf tct/conf/coroner.cf
+--- tct.orig/conf/coroner.cf 2007-01-21 22:18:00.000000000 +0000
++++ tct/conf/coroner.cf 2008-11-28 07:58:27.000000000 +0000
+@@ -4,9 +4,9 @@
+
+ $TCT_HOME = "";
+
+-$ETC = "$TCT_HOME/etc" unless $ETC;
++$ETC = "/etc" unless $ETC;
+
+-@INC = ("$TCT_HOME/lib", "$TCT_HOME/conf", "$TCT_HOME", @INC);
++@INC = ("/etc/tct", "/usr/share/tct", @INC);
+
+ #
+ # Where all the full pathnames to the various shell binaries used live
+diff -Naurp tct.orig/conf/grave-robber.cf tct/conf/grave-robber.cf
+--- tct.orig/conf/grave-robber.cf 2007-01-21 22:18:00.000000000 +0000
++++ tct/conf/grave-robber.cf 2008-11-28 07:58:27.000000000 +0000
+@@ -9,7 +9,7 @@ $BIN = "$TCT_HOME/bin" unless $BIN;
+ $ETC = "$TCT_HOME/etc" unless $ETC;
+ $CONFIG = "$TCT_HOME/conf" unless $CONFIG;
+
+-@INC = ("$TCT_HOME/lib", "$TCT_HOME/conf", @INC);
++@INC = ("/etc/tct", "/usr/share/tct", @INC);
+
+ #
+ # Where all the full pathnames to the various shell binaries used live
+@@ -140,7 +140,7 @@ $strings_log = "strings_log";
+ #
+ # What tools/files do we want to investigate immediately?
+ #
+-$toolkit = "$CONFIG/look\@first";
++$toolkit = "/etc/tct/look\@first";
+
+ #
+ # I think BSD ps returns >= 12 fields (after header) when you do a ps -auxwwge
+diff -Naurp tct.orig/conf/look@first tct/conf/look@first
+--- tct.orig/conf/look@first 2000-07-30 23:39:20.000000000 +0000
++++ tct/conf/look@first 2008-11-28 07:58:27.000000000 +0000
+@@ -1,6 +1,6 @@
+ #
+ # These are dirs containing tools & files we want to investigate first,
+-# so we stat/whatever them first, and then we can fuck with them without
++# so we stat/whatever them first, and then we can muck with them without
+ # worrying about destroying forensic evidence.
+ #
+ # We automatically go through the $PATH variable of the user running
+diff -Naurp tct.orig/conf/paths.pl tct/conf/paths.pl
+--- tct.orig/conf/paths.pl 2007-01-21 22:18:00.000000000 +0000
++++ tct/conf/paths.pl 2008-11-28 07:58:27.000000000 +0000
+@@ -13,7 +13,7 @@ $CP="/bin/cp";
+
+ $CRONTAB="/usr/bin/crontab";
+ $DATE="/bin/date";
+-$DMESG="/sbin/dmesg";
++$DMESG="/bin/dmesg";
+ $DOMAINNAME="/bin/domainname";
+ $ECHO="/bin/echo";
+
+@@ -23,34 +23,34 @@ $IFCONFIG="/sbin/ifconfig";
+ $IPCS="/usr/bin/ipcs";
+ $LAST="/usr/bin/last";
+
+-$LSOF="/usr/local/sbin/lsof";
++$LSOF="/usr/bin/lsof";
+ $MKDIR="/bin/mkdir";
+-$NETSTAT="/usr/bin/netstat";
++$NETSTAT="/bin/netstat";
+ $PS="/bin/ps";
+ $PWD="/bin/pwd";
+
+ $RPCINFO="/usr/bin/rpcinfo";
+-$SHOWMOUNT="/usr/bin/showmount";
++$SHOWMOUNT="/sbin/showmount";
+ $STRINGS="/usr/bin/strings";
+-$SU="/usr/bin/su";
++$SU="/bin/su";
+ $SYNC="/bin/sync";
+ $TEE="/usr/bin/tee";
+
+ $TOP="/usr/bin/top";
+-$UNAME="/usr/bin/uname";
++$UNAME="/bin/uname";
+ $UPTIME="/usr/bin/uptime";
+ $W="/usr/bin/w";
+ $WHO="/usr/bin/who";
+
+-$XAUTH="/usr/X11R6/bin/xauth";
+-$XHOST="/usr/X11R6/bin/xhost";
++$XAUTH="/usr/bin/xauth";
++$XHOST="/usr/bin/xhost";
+ $YPCAT="/usr/bin/ypcat";
+
+ # suns...
+ $EEPROM="/usr/sbin/eeprom";
+ $FORMAT="/etc/format";
+ $SHOWREV="/bin/showrev";
+-$NFSSTAT="/usr/bin/nfsstat";
++$NFSSTAT="/usr/sbin/nfsstat";
+
+ # solaris
+ $SWAP="/etc/swap";
+@@ -61,7 +61,8 @@ $DEVINFO="/usr/sbin/devinfo";
+ $PSTAT="/usr/sbin/pstat";
+
+ # linux
+-$RPM="/usr/local/bin/rpm";
++$DPKG="/usr/bin/dpkg";
++$RPM="/usr/bin/rpm";
+ $KSYMS="/sbin/ksyms";
+ $LSMOD="/sbin/lsmod";
+
+@@ -77,12 +78,12 @@ $DF="/bin/df";
+ #
+ # our stuff
+ #
+-$FILE = "$TCT_HOME/bin/file";
+-$MD5 = "$TCT_HOME/bin/md5";
+-$PCAT = "$TCT_HOME/bin/pcat";
+-$ICAT = "$TCT_HOME/bin/icat";
+-$ILS = "$TCT_HOME/bin/ils";
+-$LASTCOMM = "$TCT_HOME/bin/lastcomm";
+-$MAJ_MIN = "$TCT_HOME/bin/major_minor";
+-$TIMEOUT = "$TCT_HOME/bin/timeout";
++$FILE = "/bin/file";
++$MD5 = "/bin/md5sum";
++$PCAT = "/bin/pcat";
++$ICAT = "/bin/icat";
++$ILS = "/bin/ils";
++$LASTCOMM = "/bin/lastcomm";
++$MAJ_MIN = "/bin/major_minor";
++$TIMEOUT = "/bin/timeout";
+
+diff -Naurp tct.orig/extras/bdf tct/extras/bdf
+--- tct.orig/extras/bdf 2007-01-21 22:18:00.000000000 +0000
++++ tct/extras/bdf 2008-11-28 07:58:27.000000000 +0000
+@@ -1,4 +1,4 @@
+-#!/usr/bin/perl5
++#!/usr/bin/perl
+
+ #
+ # Goes through text & binaries files, looking for executables
+diff -Naurp tct.orig/extras/ils2mac tct/extras/ils2mac
+--- tct.orig/extras/ils2mac 2007-01-21 22:18:00.000000000 +0000
++++ tct/extras/ils2mac 2008-11-28 07:58:27.000000000 +0000
+@@ -1,4 +1,4 @@
+-#!/usr/bin/perl5
++#!/usr/bin/perl
+
+ #
+ # Take a stream of time machine formatted data from ils and re-arrange
+@@ -17,7 +17,7 @@ $debug = 0;
+ $running_under_grave_robber = 1;
+
+ $TCT_HOME = "";
+-require "$TCT_HOME/conf/coroner.cf";
++require "/etc/tct/coroner.cf";
+ require "tm_misc.pl";
+ require "hostname.pl";
+ require "crunch.pl";
+diff -Naurp tct.orig/extras/realpath tct/extras/realpath
+--- tct.orig/extras/realpath 2007-01-21 22:18:00.000000000 +0000
++++ tct/extras/realpath 2008-11-28 07:58:27.000000000 +0000
+@@ -1,4 +1,4 @@
+-#!/usr/bin/perl5
++#!/usr/bin/perl
+
+ #
+ # Prints out the real pathname of file(s); usage:
+diff -Naurp tct.orig/lazarus/lazarus tct/lazarus/lazarus
+--- tct.orig/lazarus/lazarus 2007-01-21 22:18:00.000000000 +0000
++++ tct/lazarus/lazarus 2008-11-28 07:58:27.000000000 +0000
+@@ -1,4 +1,4 @@
+-#!/usr/bin/perl5
++#!/usr/bin/perl
+ #
+ # Lazarus - tries to revive things that have died and gone into the
+ # binary spirit world... deleted files, data in memory, swap, etc.
+@@ -66,6 +66,7 @@
+ # [...]
+ #
+
++@INC = ("/etc/tct", "/usr/share/tct", @INC);
+ $TCT_HOME = "";
+
+ $| = 1;
+@@ -77,7 +78,7 @@ if (!$TCT_HOME) {
+ die "Can't find TCT_HOME - did you run reconfig?\n";
+ }
+ else {
+- require "$TCT_HOME/conf/coroner.cf";
++ require "/etc/tct/coroner.cf";
+ }
+
+ require "lazarus.cf";
+diff -Naurp tct.orig/lib/linux.pl tct/lib/linux.pl
+--- tct.orig/lib/linux.pl 2001-03-16 19:25:04.000000000 +0000
++++ tct/lib/linux.pl 2008-11-28 07:58:27.000000000 +0000
+@@ -35,6 +35,7 @@ print "Running all sorts of commands on
+ &df();
+
+ &ipcs();
++&dpkg();
+ &rpm();
+ &lsmod();
+
+@@ -260,6 +261,22 @@ if (-x $IPCS) {
+ }
+ }
+
++sub dpkg {
++
++if (-x $DPKG ) {
++ if (!$CORPSE) {
++ &date_stamp("$COMM_OUT/dpkg");
++ &redirect_command($DPKG, "-l", ">>$COMM_OUT/dpkg");
++ &sign_it("$COMM_OUT/dpkg");
++ }
++ else {
++ &date_stamp("$COMM_OUT/dpkg");
++ &redirect_command($DPKG, "--root", "$CORPSE", "-l", ">>$COMM_OUT/dpkg");
++ &sign_it("$COMM_OUT/dpkg");
++ }
++ }
++}
++
+ sub rpm {
+
+ if (-x $RPM ) {
+diff -Naurp tct.orig/lib/ostype.pl tct/lib/ostype.pl
+--- tct.orig/lib/ostype.pl 2003-08-30 23:17:11.000000000 +0000
++++ tct/lib/ostype.pl 2008-11-28 07:58:27.000000000 +0000
+@@ -1,4 +1,3 @@
+-#!/bin/perl
+ #
+ # Simple test that uses uname to determine what we're running on...
+ #
+diff -Naurp tct.orig/lib/process_dirs.pl tct/lib/process_dirs.pl
+--- tct.orig/lib/process_dirs.pl 2000-07-30 23:39:20.000000000 +0000
++++ tct/lib/process_dirs.pl 2008-11-28 07:58:27.000000000 +0000
+@@ -1,4 +1,3 @@
+-#!/usr/local/bin/perl
+
+ #
+ # given a dir, suck in all the executable files in there
+diff -Naurp tct.orig/lib/save_the_files.pl tct/lib/save_the_files.pl
+--- tct.orig/lib/save_the_files.pl 2000-07-30 23:39:20.000000000 +0000
++++ tct/lib/save_the_files.pl 2008-11-28 07:58:27.000000000 +0000
+@@ -30,6 +30,7 @@ while (<STF>) {
+ print "next file: $files\n" if $debug;
+
+ while (<${files}>) {
++ next if (/^\Q$DATA\E/o);
+ print "Going into while...\n" if $debug;
+
+
+diff -Naurp tct.orig/lib/system_stubs.pl tct/lib/system_stubs.pl
+--- tct.orig/lib/system_stubs.pl 2000-07-30 23:39:20.000000000 +0000
++++ tct/lib/system_stubs.pl 2008-11-28 07:58:35.000000000 +0000
+@@ -1,4 +1,4 @@
+-#!/usr/local/bin/perl
++#!/usr/bin/perl
+
+ #
+ # a simple set of stub routines to call the real functions that do
+diff -Naurp tct.orig/lib/tree.pl tct/lib/tree.pl
+--- tct.orig/lib/tree.pl 2001-02-22 16:19:40.000000000 +0000
++++ tct/lib/tree.pl 2008-11-28 07:58:27.000000000 +0000
+@@ -150,9 +150,9 @@ sub do_first_looks {
+
+ print "\nStarting preprocessing paths and filenames on $hostname...\n";
+
+-die "Can't open $TCT_HOME/conf/paths.pl (in do_first_looks())!\n" unless open (PATHS, "$TCT_HOME/conf/paths.pl");
++die "Can't open $CONFIG/paths.pl (in do_first_looks())!\n" unless open (PATHS, "$CONFIG/paths.pl");
+
+-print "\tpreprocessing $TCT_HOME/conf/paths.pl\n" if $verbose;
++print "\tpreprocessing $CONFIG/paths.pl\n" if $verbose;
+
+ while (<PATHS>) {
+ next if (/^\s*#/ || /^\s*$/);
+diff -Naurp tct.orig/man/man1/timeout.1 tct/man/man1/timeout.1
+--- tct.orig/man/man1/timeout.1 2004-10-18 14:59:46.000000000 +0000
++++ tct/man/man1/timeout.1 2008-11-28 07:58:27.000000000 +0000
+@@ -20,16 +20,16 @@ Arguments:
+ .IP \fI-signal\fR
+ Specify an optional signal to send to the controlled process.
+ By default, \fBtimeout\fR sends SIGKILL, which cannot be caught
+-or ignored.
++or ignored. The signal must be provided in its numerical value.
+ .IP \fItime\fR
+-The elapsed time limit after which the command is terminated.
++The elapsed time limit in seconds after which the command is terminated.
+ .IP \fIcommand\fR
+ The command to be executed.
+ .SH DIAGNOSTICS
+ .ad
+ .fi
+-The command exit status is the exit status of the command
+-(status 1 in case of a usage error).
++timeout's exit status is the exit status of the specified command or 1 in
++case of a usage error.
+ .SH LICENSE
+ .na
+ .nf
+diff -Naurp tct.orig/reconfig tct/reconfig
+--- tct.orig/reconfig 2001-09-15 20:48:51.000000000 +0000
++++ tct/reconfig 2008-11-28 07:58:27.000000000 +0000
+@@ -39,7 +39,7 @@ $other_dirs="bin:/etc:/usr/ccs/bin:/bin:
+ "find", "ftp", "format", "ifconfig", "ipcs", "last", "ls", "lsof",
+ "lsmod", "modinfo", "modstat",
+ "mkdir", "mv", "netstat", "nfsstat", "nslookup", "pkginfo", "ping",
+- "ps", "pstat", "pwd", "rm", "rpm", "rpcinfo", "rusers", "sed", "sh",
++ "ps", "pstat", "pwd", "rm", "dpkg", "rpm", "rpcinfo", "rusers", "sed", "sh",
+ "showmount", "showrev", "sort", "strings", "su", "swap", "sync",
+ "test", "top", "touch", "uname", "uniq", "uudecode", "uptime",
+ "w", "who", "whoami", "xhost", "xauth", "ypcat", "ypwhich");
+@@ -81,7 +81,7 @@ print "\nPerl5 is in $PERL\n";
+
+ for (@perl5_src) { $perl5_src .= "$_ "; }
+ print "\nchanging the source in: $perl5_src\n";
+-system "$PERL -pi -e \"s@^#!.*/perl.*@#!$PERL@;\" $perl5_src";
++#system "$PERL -pi -e \"s@^#!.*/perl.*@#!$PERL@;\" $perl5_src";
+
+ # make sure things are executable...
+ system("chmod +x $perl5_src");
+@@ -94,7 +94,7 @@ for $command (@all_commands) {
+ # special case rsh/remsh; if we can find remsh, ignore rsh
+ if ($command eq "rsh") {
+ # print "looking for rsh/remsh ($dir/$command)\n";
+- if (-x "$dir/remsh") {
++ if (-x "$dir/remsh" and -f _) {
+ # this converts to upper case
+ ($upper = $command) =~ y/[a-z]/[A-Z]/;
+ $found="true";
+@@ -167,7 +167,7 @@ for $file (@files2reconfig) {
+ die "Can't open $file for reading\n" unless open(FILE, $file);
+ while (<FILE>) {
+ if (/^\s*\$TCT_HOME\s*=/ && !$done) {
+- $file{$n++} = "\$TCT_HOME = \"$cwd\";\n";
++ $file{$n++} = "\$TCT_HOME = \"/var/cache/tct\";\n";
+ $done = 1;
+ next;
+ }
+diff -Naurp tct.orig/src/file/compress.c tct/src/file/compress.c
+--- tct.orig/src/file/compress.c 2000-07-30 23:39:20.000000000 +0000
++++ tct/src/file/compress.c 2008-11-28 07:58:27.000000000 +0000
+@@ -11,6 +11,7 @@
+ #include <unistd.h>
+ #include <string.h>
+ #include <sys/wait.h>
++#include <errno.h>
+
+ #include "file.h"
+
+diff -Naurp tct.orig/src/file/file.c tct/src/file/file.c
+--- tct.orig/src/file/file.c 2000-07-30 23:39:20.000000000 +0000
++++ tct/src/file/file.c 2008-11-28 07:58:27.000000000 +0000
+@@ -36,6 +36,7 @@ static char *moduleid =
+ #include <sys/param.h> /* for MAXPATHLEN */
+ #include <sys/stat.h>
+ #include <fcntl.h> /* for open() */
++#include <errno.h>
+ #if (__COHERENT__ >= 0x420)
+ #include <sys/utime.h>
+ #else
+diff -Naurp tct.orig/src/file/fsmagic.c tct/src/file/fsmagic.c
+--- tct.orig/src/file/fsmagic.c 2000-07-30 23:39:20.000000000 +0000
++++ tct/src/file/fsmagic.c 2008-11-28 07:58:27.000000000 +0000
+@@ -31,6 +31,7 @@
+ #include <sys/stat.h>
+ #include <unistd.h>
+ #include <stdlib.h>
++#include <errno.h>
+ #ifndef major /* if `major' not defined in types.h, */
+ #include <sys/sysmacros.h> /* try this one. */
+ #endif
+diff -Naurp tct.orig/src/fstools/fs_tools.h tct/src/fstools/fs_tools.h
+--- tct.orig/src/fstools/fs_tools.h 2007-04-09 13:30:32.000000000 +0000
++++ tct/src/fstools/fs_tools.h 2008-11-28 07:58:27.000000000 +0000
+@@ -201,7 +201,7 @@ extern int optind;
+ */
+ #if defined(LINUX2)
+ #define SUPPORTED
+-#include <linux/ext2_fs.h>
++#include <ext2fs/ext2_fs.h>
+ #define HAVE_EXT2FS
+ #define HAVE_DTIME
+ #if (_FILE_OFFSET_BITS == 64)
+diff -Naurp tct.orig/src/fstools/mylseek.c tct/src/fstools/mylseek.c
+--- tct.orig/src/fstools/mylseek.c 2006-06-26 21:07:45.000000000 +0000
++++ tct/src/fstools/mylseek.c 2008-11-28 07:58:27.000000000 +0000
+@@ -30,9 +30,9 @@
+ * This is LINUX, live on the bleeding edge and watch your software break
+ * with the next release...
+ */
+-static _syscall5(int, _llseek, unsigned int, fd, unsigned long, offset_high,
+- unsigned long, offset_low, OFF_T *, result,
+- unsigned int, origin)
++#define _llseek(fd, offset_high, offset_low, result, origin) \
++ syscall(SYS__llseek, fd, offset_high, offset_low, result, origin)
++
+ /* mylseek - seek beyond the 32-bit barrier */
+
+ OFF_T mylseek(int fd, OFF_T offset, int whence)
+diff -Naurp tct.orig/src/lastcomm/sys_defs.h tct/src/lastcomm/sys_defs.h
+--- tct.orig/src/lastcomm/sys_defs.h 2003-08-30 23:18:31.000000000 +0000
++++ tct/src/lastcomm/sys_defs.h 2008-11-28 07:58:27.000000000 +0000
+@@ -77,10 +77,14 @@ extern int getopt();
+ #define NODEV 0xffff
+ #define HAVE_COMP_MAJOR_PFLTS
+ #define HAVE_COMP_EXIT_STATUS
++
++#ifndef __alpha__
+ #define HAVE_COMP_MEMORY_USAGE
+ #define HAVE_COMP_CHAR_IO_COUNT
+ #define HAVE_COMP_BLOCK_RW_COUNT
+ #define HAVE_COMP_SWAP_USAGE
++#endif
++
+ #define HAVE_EXIT_STATUS
+ #define PRINT_LINESIZE 8
+ #define PRINT_NAMESIZE 8
--- tct-1.19.orig/debian/patches/series
+++ tct-1.19/debian/patches/series
@@ -0,0 +1,2 @@
+01-conglomeration.patch
+02-seconds.patch
--- tct-1.19.orig/debian/manpages/ils2mac.1
+++ tct-1.19/debian/manpages/ils2mac.1
@@ -0,0 +1,25 @@
+.TH ILS2MAC 1 "2008-11-27" "1.18" "convert ils to mactime"
+
+.SH NAME
+ils2mac \- Convert ils output to mactime parsable data
+
+.SH SYNOPSIS
+\fBils2mac\fR \fIINPUT\fR \fIOUTPUT\fR
+
+.SH DESCRIPTION
+Take a stream of time machine formatted data from ils and re\-arrange the fields into the fixed order that mactime expects.
+.PP
+This program should not be necessary. The next version of mactime should understand time machine format instead of just pretending it does.
+.PP
+Kludge: if the first line is not in time machine format assume that we are looking at output from the grave\-robber which prepends a date line of its own (which is gross because time machine data already contains a time stamp, and the obvious fix is to fix grave\-robber).
+
+.SH OPTIONS
+ils2mac has no options.
+
+.SH HOMEPAGE
+More information about ils2mac and the The Coroner's Toolkit (TCT) project can be found at <\fIhttp://www.porcupine.org/forensics/tct.html\fR>.
+
+.SH AUTHOR
+ils2mac was written by Dan Farmer and Wietse Venema.
+.PP
+This manual page was written by Daniel Baumann <\fIdaniel@debian.org\fR>, for the Debian project (but may be used by others).
![[patchlogo]](http://patch-tracker.debian.org/static/img/swirlpatch.png)