This recipe requires the installation of four third-party modules to function: pytsk3, pyewf, pyesedb, and unicodecsv. Refer to Chapter 8, Working with Forensic Evidence Container Recipes, for a detailed explanation on installing the pytsk3 and pyewf modules. Likewise, refer to the Getting started section in the Parsing prefetch files recipe for details on installing unicodecsv. All other libraries used in this script are present in Python's standard library.

Navigate to the GitHub repository and download the desired release for each library. This recipe was developed using the libesedb-experimental-20170121 release. Once the contents of the release are extracted, open a terminal, navigate to the extracted directory, and execute the following commands:

./synclibs.sh
./autogen.sh
sudo python setup.py install