install

dev

sudo apt install wxhexeditor tmux most libscca-utils galculator

IDA

sudo apt-get install libc6-i686:i386 libexpat1:i386 libffi7:i386 libfontconfig1:i386 libfreetype6:i386 libgcc1:i386 libglib2.0-0:i386 libice6:i386 libpcre3:i386 libpng16-16:i386 libsm6:i386 libstdc++6:i386 libuuid1:i386 libx11-6:i386 libxau6:i386 libxcb1:i386 libxdmcp6:i386 libxext6:i386 libxrender1:i386 zlib1g:i386 libx11-xcb1:i386 libdbus-1-3:i386 libxi6:i386 libsm6:i386 libcurl4:i386

conf

sudo swapoff -av
sudo sh -c 'echo vm.swappiness=5 > /etc/sysctl.d/99-swappiness.conf'

volatility

https://github.com/volatilityfoundation/volatility/wiki/Installation

pip

# pip for user installation
#pip=pip2
# pip for root installation
pip="sudo -H pip2"

$pip install -U pip setuptools
$pip install pycrypto distorm3 yara-python ujson openpyxl pytz ipython

libforensic1394.so.2

sudo apt install -y cmake

cd /tmp
git clone https://github.com/FreddieWitherden/libforensic1394
cd libforensic1394
mkdir build && cd build
cmake -G"Unix Makefiles" ../
sudo make install
cd ../python
sudo python setup.py install
cd
sudo rm -fR /tmp/libforensic1394

sudo ln -sv /usr/local/lib/libforensic1394.so.2 /usr/lib/libforensic1394.so.2

volatility 2.6

cd /opt
sudo [ -d volatility ] && sudo rm -fR volatility
sudo git clone https://github.com/volatilityfoundation/volatility.git
cd volatility
sudo rm -fR .git
sudo python setup.py install

cd /usr/local/bin
sudo [ -e vol2 ] && sudo rm vol2
sudo ln -sv vol.py vol2
vol2 -h

# host
cp /home/shared/dev/install-desktop/conf/cuckoo/vol2 /vms/share/
#guest
file=/usr/share/bash-completion/completions/vol2
sudo mv /share/vol2 ${file}
opts=$(vol2 --info|sed -n '/^Plugins/,/^$/ p'|tail -n+3|cut -f1 -d' '|xargs)
sudo sed -i "/^ *opts=/ s|=.*|='${opts}'|" ${file}
grep opts= ${file}
exec bash

bash completion

sudo cp -a /home/shared/dev/install-desktop/conf/cuckoo/vol2 /usr/share/bash-completion/completions/
opts=$(vol2 --info|sed -n '/^Plugins/,/^$/ p'|tail -n+3|cut -f1 -d' '|xargs)
sudo sed -i "s|^\( *opts=\).*$|\1'${opts}'|" /usr/share/bash-completion/completions/vol2

exec bash # reload completions

trick

df -h ; sudo find / -type d -name .git -exec rm -fR {} \; df -h