Installation of Volatility on Windows XP

Transcription

1 In order to use Volatility, you must first install Python, which is easily obtained from You should get version 2.6 for Windows. When you download the file, double-click to install and you will see the following security message. Just click Run. Figure 1: Security Warning Choose the appropriate install options. Most likely you will want to install for all users on the machine: Figure 2: Account Install Options

2 The installer will ask you where you would like to install the Python files, the default under C:\Python26 should be fine: Figure 3: Install Path The installer will then give you the option for more advanced install options. Unless you know what you are doing, it will be best to leave all options enabled:

3 Hit Next and Python will now install. Hit Finish when installation completes: Figures 5: Installation Figure 6: Installation Complete

4 After Python is installed, you should make sure that the Python extensions are registered. If you have a regular start menu, click on start and then right click on My Computer and choose properties. If you have the classic start menu, just click on My Computer and choose properties. You should see the following (some personal details removed): Figures 7 and 8: System Properties Click on the Advanced tab and then click on Environmental Variables :

5 Click on the Path system variable towards the bottom of the window and click the Edit button (Figure 9). At this point another window should pop up (Figure 10). We will append the path of our Python installation to the end of the existing Path variable. Where it says Variable Value go to the end of the line and add the following: ;C:\Python26 The semicolon separates our new Path location from the current values. If the location of your Python installation is different from the above, type the appropriate folder location instead. (Above) Figure 9: Edit of Path variable (Left) Figure 10: Adding the location of our Python installation

6 Now we are ready to test that we have set up everything correctly. Open a command prompt by clicking on the Start Menu and clicking on Run. You should see a window pop up (Figure 11) type cmd and press OK : Figure 11: Running the Command Prompt You should see the command prompt at this point. Now we will see if our Path variable has been correctly configured by typing path and testing to see that Python is correctly installed by asking for its version python -V (Figure 12): Figure 12: Testing of path variable and Python installation

7 Now we are ready for the installation of Volatility. You can get the latest package from the website at: If you scroll down to the Downloads section, you can find the latest package in various formats. Most machines have an archiving application installed, if you do not have such an application you can get 7zip, which handles most compression and archiving formats, for free at Figure 13: Volatility Website Here we will choose the zip archive format for our installation. Now the files need to be extracted and placed in a location that can be found. If you unzip the zip file you'll notice that you have a folder named Volatility-1.3_Beta which contains all of the files you need for Volatility. The easiest way to install Volatility might be to place this folder on root of the file system, for most systems this will be directly under C:\. To accomplish this, simply copy the folder and explore the file system and drop the folder under C:\ (Figure 14). If you have another location in mind for your installation place the folder there instead.

8 Figure 14: Volatility folder

9 In order to use Volatility you will need to open the command line application again. Do the same as before, by going to Start, choosing Run and typing cmd. Now you will have to navigate to the Volatility folder shown above using the command line. If you have never used the command line before, here are a few commands that will be useful for you (Figure 15): Figure 15: Basic DOS Commands In the above commands anything that is in brackets [ ] should be replaced with the desired value. In this case we will change location to the Volatility folder using the cd command. Simply type the following and press Enter : cd C:\Volatility-1.3_Beta

10 The main script of Volatility is named just that volatility. To run it you just type the following: python volatility and you should see the help message (Figure 16). You are now installed and ready to go! Figure 16: Volatility Help Message