Social Icons

Tuesday, September 22, 2015

Volatility-Advanced Memory Forensics Framework : Installation@Ubuntu

1.   The Volatility Framework is a completely open collection of tools, implemented in Python for the extraction of digital artifacts from volatile memory (RAM) samples. Volatility is a memory forensics framework, to analyse ram memory dumps for Windows, Linux, and Mac. In order to analyse a operating system’s RAM memory in Volatility, you need to build the corresponding operating system’s profile.The extraction techniques are performed completely independent of the system being investigated but offer unprecedented visibility into the runtime state of the system. The framework is intended to introduce people to the techniques and complexities associated with extracting digital artifacts from volatile memory samples and provide a platform for further work into this exciting area of research.Vide this post, I am sharing how to install volatility in Ubuntu 12.04 in a step wise manner.The post includes screen-shots and ready to shoot terminal commands for installing other dependent libraries.

Firstly : Installing Dependencies

sudo apt-get install subversion pcregrep libpcre++-dev python-dev -y

Secondly : Installing PyCrypto

First download PyCRypto from

Go to ~/..../Downloads/

tar -zxvf pycrypto-2.6.1.tar.gz

cd pycrypto-2.6.1

python build

sudo python build install

Thirdly: Installing Distrom
Distrom ,a disassemble library for x86/AMD64 can be downloaded from

Goto downloads where the file is likely downloaded :


cd distorm3/

python build

python build install

Fourthly: Installing Yara 

Volatility needs another important dependency known as Yara,that can be installed as follows:


tar -zxvf yara-1.4.tar.gz

cd yara-1.4/

sudo ./configure

sudo make

sudo make install

Fifthly : Installing Yara-Python

Download the tar.gz from

tar -zxvf yara-python-1.4a.tar.gz

cd yara-python-1.4a/

python build

python build install

sudo echo “/usr/local/lib” >> /etc/

sudo ldconfig
Now through with the installation of dependencies,we go ahead to install Volatility after we download the tar ball from

~/Desktop/F0r3ns1c5/Memory_Forensics/New/volatility-2.3.1$ python build

~/Desktop/F0r3ns1c5/Memory_Forensics/New/volatility-2.3.1$ python build install

The installation is complete now and you should get a similar screen as seen below on running the command python -h


Post a Comment