Install Volatility 2 and its Python dependencies Sudo python2 -m pip install -U setuptools wheel Install pip for Python 2 sudo apt install -y python2 python2.7-dev libpython2-dev

Install system dependencies sudo apt install -y build-essential git libdistorm3-dev yara libraw1394-11 libcapstone-dev capstone-tool tzdata However, Volatility 3 currently does not have anywhere near the same number of plugins/features as Volatility 2, so is is best to install both versions side-by-side and use whichever version is best suited for a particular task, which for now is most likely Volatility 2. Volatility 3 is written for Python 3, and is much faster. Python 2 reached End of Life (EOL) in 2020. Unfortunately, most of these features/plugins only apply to memory captures of systems running Windows. With Volatility, you can read memory/RAM captures and determine all sorts of things about the state of a system when the memory capture was made, including, but not limited to: This guide will show you how to install Volatility 2 and Volatility 3 on Debian and Debian-based Linux distributions, such as Ubuntu and Kali Linux. Volatility is a powerful memory forensics tool.

Kali linux on mac