Volatility-Advanced Memory Forensics Framework : Installation@Ubuntu

1.   The Volatility Framework is a completely open collection of tools, implemented in Python for the extraction of digital artifacts from volatile memory (RAM) samples. Volatility is a memory forensics framework, to analyse ram memory dumps for Windows, Linux, and Mac. In order to analyse a operating system’s RAM memory in Volatility, you need to build the corresponding operating system’s profile.The extraction techniques are performed completely independent of the system being investigated but offer unprecedented visibility into the runtime state of the system. The framework is intended to introduce people to the techniques and complexities associated with extracting digital artifacts from volatile memory samples and provide a platform for further work into this exciting area of research.Vide this post, I am sharing how to install volatility in Ubuntu 12.04 in a step wise manner.The post includes screen-shots and ready to shoot terminal commands for installing other dependent libraries.

Firstly : Installing Dependencies

sudo apt-get install subversion pcregrep libpcre++-dev python-dev -y

Secondly : Installing PyCrypto

First download PyCRypto from https://ftp.dlitz.net/pub/dlitz/crypto/pycrypto/pycrypto-2.6.1.tar.gz

Go to ~/..../Downloads/

tar -zxvf pycrypto-2.6.1.tar.gz

cd pycrypto-2.6.1

python setup.py build

sudo python setup.py build install

Thirdly: Installing Distrom
Distrom ,a disassemble library for x86/AMD64 can be downloaded from https://github.com/gdabah/distorm

Goto downloads where the file is likely downloaded :

unzip distorm3.zip

cd distorm3/

python setup.py build

python setup.py build install

Fourthly: Installing Yara 

Volatility needs another important dependency known as Yara,that can be installed as follows:

wget http://yara-project.googlecode.com/files/yara-1.4.tar.gz

tar -zxvf yara-1.4.tar.gz

cd yara-1.4/

sudo ./configure

sudo make

sudo make install

Fifthly : Installing Yara-Python





Download the tar.gz from https://yara-project.googlecode.com/files/yara-python-1.4a.tar.gz

tar -zxvf yara-python-1.4a.tar.gz

cd yara-python-1.4a/

python setup.py build

python setup.py build install

sudo echo “/usr/local/lib” >> /etc/ld.so.conf

sudo ldconfig

Now through with the installation of dependencies,we go ahead to install Volatility after we download the tar ball from https://code.google.com/p/volatility/downloads/detail?name=volatility-2.3.1.tar.gz&can=2&q=

~/Desktop/F0r3ns1c5/Memory_Forensics/New/volatility-2.3.1$ python setup.py build

~/Desktop/F0r3ns1c5/Memory_Forensics/New/volatility-2.3.1$ python setup.py build install

The installation is complete now and you should get a similar screen as seen below on running the command python vol.py -h

What's BUILD-ESSENTIAL equivalent in FEDORA ?

1.    Needing to install the equivalent of build-essential we require in Ubuntu for Fedora is given by this command line in root mode :

yum groupinstall "Development Tools" "Development Libraries"