diff --git a/sleuthkit-4.6.7.tar.gz b/sleuthkit-4.6.7.tar.gz
new file mode 100644
index 0000000..9604539
Binary files /dev/null and b/sleuthkit-4.6.7.tar.gz differ
diff --git a/sleuthkit.spec b/sleuthkit.spec
new file mode 100644
index 0000000..5d649ee
--- /dev/null
+++ b/sleuthkit.spec
@@ -0,0 +1,84 @@
+Name:           sleuthkit
+Version:        4.6.7
+Release:        2
+Summary:        Tools for file system and volume forensic analysis
+License:        CPL and IBM and GPLv2+
+URL:            http://www.sleuthkit.org
+Source0:        https://github.com/sleuthkit/sleuthkit/releases/download/sleuthkit-%{version}/sleuthkit-%{version}.tar.gz
+
+BuildRequires:  gcc-c++ afflib-devel >= 3.3.4 libewf-devel perl-generators sqlite-devel
+
+%{?_with_java:
+BuildRequires:  java-devel >= 1:1.6.0 jpackage-utils
+Requires:       java >= 1:1.6.0 jpackage-utils
+}
+
+Requires:       file mac-robber
+
+Provides:  %{name}-libs = %{version}-%{release}
+Obsoletes: %{name}-libs < %{version}-%{release}
+
+%description
+The Sleuth Kit (previously known as TASK) is a collection of UNIX-based command
+line file system forensic tools that allow an investigator to examine NTFS,
+FAT, FFS, EXT2FS, EXT3FS and ExFAT file systems of a suspect computer in a
+non-intrusive fashion. The  tools have a layer-based design and can extract
+data from internal file system structures. Because the tools do not rely on the
+operating system to process the file systems, deleted and hidden content is
+shown.
+
+%package        devel
+Summary:    Provides development files for %{name}
+Requires:   %{name} = %{version}-%{release}
+Requires:   sqlite-devel
+
+%description    devel
+This package provides the development files for %{name}.
+
+%package        help
+Summary:Help Document for %{name}
+
+%description    help
+The help package contains manual pages and other related files for %{name}.
+
+%prep
+%autosetup -n %{name}-%{version} -p1
+
+%build
+%configure --disable-static  %{!?_with_java:--disable-java}
+
+sed -i.rpath 's|^hardcode_libdir_flag_spec=.*|hardcode_libdir_flag_spec=""|g' libtool
+sed -i.rpath 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' libtool
+
+%make_build
+
+%install
+%make_install
+%delete_la
+%post -p /sbin/ldconfig
+%postun -p /sbin/ldconfig
+
+%files
+%doc ChangeLog.txt NEWS.txt licenses/*
+%{_bindir}/{blkcalc,blkcat,blkls,blkstat}
+%exclude %{_bindir}/fcat
+%{_bindir}/{ffind,fiwalk,fls,fsstat,hfind,icat}
+%{_bindir}/{ifind,ils,img_cat,img_stat,istat,jcat,sorter}
+%{_bindir}/{jpeg_extract,jls,mactime,mmcat,mmls,mmstat,sigfind}
+%{_bindir}/{srch_strings,tsk_comparedir,tsk_gettimes,tsk_loaddb,tsk_recover,usnjls}
+%exclude %{_mandir}/man1/fcat.1*
+%dir %{_datadir}/tsk
+%{_datadir}/tsk/sorter/
+%{_libdir}/*.so.*
+
+%files devel
+%{_includedir}/tsk/
+%{_libdir}/*.so
+
+%files help
+%{_mandir}/man1/*
+
+%changelog
+* Fri Feb 21 2020 wangzhishun <wangzhishun1@huawei.com> - 4.6.7-2
+- Package init
+