TLDR

Does not work at the moment

Idea

Playing with Timesketch (timesketch.org) for a while I was wondering if it is possible to install Timesketch on a Raspberry Pi 3 to do some basic analysis, no heavy GB plaso imports and such.

A raspberry Pi is around 40 $, so pretty cheap and can be ordered almost everywhere on the planet, and you might already have some PIs from previous projects like:

• https://www.alexanderjaeger.de/raspberry-pi-eyefi-server/
• https://www.alexanderjaeger.de/raspberry-pi-nagios-open-monitoring-distribution/
• https://www.alexanderjaeger.de/raspberry-cam-pi-cam-howto/
• https://www.alexanderjaeger.de/fhem-with-homematic-ccu2/
• https://www.alexanderjaeger.de/kippo-honeypot-stop/

I have also written about Timesketch / and or maintaining the following Github repositories:

• https://www.alexanderjaeger.de/timesketch-tools/

Basic installation

I used the Noobs Image to install the raspberry using a 128 GB Micro SD card to have enough storage.

Java

Trying to install Java will cause some Java issues because you need to install it manually, follow:

https://www.raspberrypi.org/forums/viewtopic.php?t=101543

• https://www.raspinews.com/installing-oracle-java-jdk-8-on-raspberry-pi/

sudo mv /usr/lib/jvm/java-8-openjdk-armhf/jre/lib/arm/client /usr/lib/jvm/java-8-openjdk-armhf/jre/lib/arm/server

Installing Elastic Search

Follow that article:

• https://logz.io/blog/elk-stack-raspberry-pi/

Installing Timesketch

Simple, SSH to your raspberry pi and follow:

• https://github.com/google/timesketch/blob/master/docs/Installation.md

When installed elasticsearch:

vi /etc/elasticsearch/elasticsearch.yml

Add the following:

network.bind_host: 127.0.0.1

pycipher

This one is a bit tricky because it might fail with:

Collecting pycypher==0.5.9
Could not find a version that satisfies the requirement pycypher==0.5.9 (from versions: )
No matching distribution found for pycypher==0.5.9

Docker

https://medium.freecodecamp.org/the-easy-way-to-set-up-docker-on-a-raspberry-pi-7d24ced073ef

Docker-compose

sudo apt-get install docker-compose

So pycypher does kill the posibility to use Timesketch on a raspberry at the moment:

 Getting page https://www.piwheels.org/simple/pycypher/
   Looking up "https://www.piwheels.org/simple/pycypher/" in the cache
   Current age based on date: 30
   Freshness lifetime from request max-age: 600
   The response is "fresh", returning cached response
   600 > 30
   Analyzing links from page https://www.piwheels.org/simple/pycypher/
   Could not find a version that satisfies the requirement pycypher (from versions: )
 Cleaning up...
 No matching distribution found for pycypher