How To Install volatility on Debian 9

In this tutorial we learn how to install volatility on Debian 9. volatility is advanced memory forensics framework

Introduction

In this tutorial we learn how to install volatility on Debian 9.

What is volatility

volatility is:

The Volatility Framework is a completely open collection of tools for the extraction of digital artifacts from volatile memory (RAM) samples. It is useful in forensics analysis. The extraction techniques are performed completely independent of the system being investigated but offer unprecedented visibility into the runtime state of the system.

Volatility supports memory dumps from all major 32- and 64-bit Windows versions and service packs. Whether your memory dump is in raw format, a Microsoft crash dump, hibernation file, or virtual machine snapshot, Volatility is able to work with it.

Linux memory dumps in raw or LiME format are supported too. There are several plugins for analyzing memory dumps from 32- and 64-bit Linux kernels and relevant distributions such as Debian, Ubuntu, openSUSE, RedHat, Fedora, CentOS, Mandriva, etc.

Volatility also support several versions of Mac OSX memory dumps, both 32- and 64-bit. Android phones with ARM processors are also supported.

These are some of the data that can be extracted from a memory image: - Image information (date, time, CPU count); - Running processes; - Open network sockets and connections; - OS kernel modules loaded; - Memory maps for each process; - Executables samples; - Command history; - Suspicious process mappings (i.e. injected code); - Passwords, as LM/NTLM hashes and LSA secrets; - Cached Truecrypt passphrases; - Others.

Current version (2.6) supports investigations of the memory images from the following operational systems: - 32-bit Windows XP Service Pack 2 and 3 - 32-bit Windows 2003 Server Service Pack 0, 1, 2 - 32-bit Windows Vista Service Pack 0, 1, 2 - 32-bit Windows 2008 Server Service Pack 1, 2 (there is no SP0) - 32-bit Windows 7 Service Pack 0, 1 - 32-bit Windows 8, 8.1, and 8.1 Update 1 - 32-bit Windows 10 (initial support) - 64-bit Windows XP Service Pack 1 and 2 (there is no SP0) - 64-bit Windows 2003 Server Service Pack 1 and 2 (there is no SP0) - 64-bit Windows Vista Service Pack 0, 1, 2 - 64-bit Windows 2008 Server Service Pack 1 and 2 (there is no SP0) - 64-bit Windows 2008 R2 Server Service Pack 0 and 1 - 64-bit Windows 7 Service Pack 0 and 1 - 64-bit Windows 8, 8.1, and 8.1 Update 1 - 64-bit Windows Server 2012 and 2012 R2 - 64-bit Windows 10 (including at least 10.0.14393) - 64-bit Windows Server 2016 (including at least 10.0.14393.0) - 32-bit Linux kernels 2.6.11 to 4.2.3 - 64-bit Linux kernels 2.6.11 to 4.2.3 - 32-bit 10.5.x Leopard (the only 64-bit 10.5 is Server, which isn’t supported) - 32-bit 10.6.x Snow Leopard - 64-bit 10.6.x Snow Leopard - 32-bit 10.7.x Lion - 64-bit 10.7.x Lion - 64-bit 10.8.x Mountain Lion (there is no 32-bit version) - 64-bit 10.9.x Mavericks (there is no 32-bit version) - 64-bit 10.10.x Yosemite (there is no 32-bit version) - 64-bit 10.11.x El Capitan (there is no 32-bit version) - 64-bit 10.12.x Sierra (there is no 32-bit version)

Volatility supports a variety of sample file formats: - Raw linear sample (dd) - Hibernation file (from Windows 7 and earlier) - Crash dump file - VirtualBox ELF64 core dump - VMware saved state and snapshot files - EWF format (E01) - LiME format - Mach-O file format - QEMU virtual machine dumps - Firewire - HPAK (FDPro)

There are three methods to install volatility on Debian 9. We can use apt-get, apt and aptitude. In the following sections we will describe each method. You can choose one of them.

Install volatility Using apt-get

Update apt database with apt-get using the following command.

sudo apt-get update

After updating apt database, We can install volatility using apt-get by running the following command:

sudo apt-get -y install volatility

Install volatility Using apt

Update apt database with apt using the following command.

sudo apt update

After updating apt database, We can install volatility using apt by running the following command:

sudo apt -y install volatility

Install volatility Using aptitude

If you want to follow this method, you might need to install aptitude first since aptitude is usually not installed by default on Debian. Update apt database with aptitude using the following command.

sudo aptitude update

After updating apt database, We can install volatility using aptitude by running the following command:

sudo aptitude -y install volatility

How To Uninstall volatility on Debian 9

To uninstall only the volatility package we can use the following command:

sudo apt-get remove volatility

Uninstall volatility And Its Dependencies

To uninstall volatility and its dependencies that are no longer needed by Debian 9, we can use the command below:

sudo apt-get -y autoremove volatility

Remove volatility Configurations and Data

To remove volatility configuration and data from Debian 9 we can use the following command:

sudo apt-get -y purge volatility

Remove volatility configuration, data, and all of its dependencies

We can use the following command to remove volatility configurations, data and all of its dependencies, we can use the following command:

sudo apt-get -y autoremove --purge volatility

Dependencies

volatility have the following dependencies:

References

Summary

In this tutorial we learn how to install volatility package on Debian 9 using different package management tools: apt, apt-get and aptitude.