Memory Analysis with SIFT 3.0

Having had a decent malware found running in memory of a Windows server, I thought it's a prefect sutuiation to document some forensic works.

First of all, I've installed a new debian 64bit client instance using VirtualBox.

Once the server is up and running, issue below command to initiate the SANS SIFT install...

wget --quiet -O - https://raw.github.com/sans-dfir/sift-bootstrap/master/bootstrap.sh | sudo bash -s -- -i -s -y 

* INFO: Welcome to the SIFT Bootstrap

* INFO: This script will now proceed to configure your system.

* INFO: You supplied the -y option, this script will not exit for any reason

* INFO: OS: Ubuntu

* INFO: Arch: 64

* INFO: Version: 14.04

* INFO: Updating your APT Repositories ...

* INFO: Installing Python Software Properies ...

* INFO: Enabling Universal Repository ...

* INFO: Enabling Elastic Repository ...

* INFO: Adding Ubuntu Tweak Repository

* INFO: Adding SIFT Repository: stable

* INFO: Updating Repository Package List ...

* INFO: Upgrading all packages to latest version ...

.

.

.

[be patient until install completes...]

The install had some errors:

* ERROR: Install Failure: mantaray (Error Code: 100)

* ERROR: Install Failure: regripper (Error Code: 100)

* ERROR: Install Failure: wine (Error Code: 100)

* ERROR: Install Failure: python-plaso (Error Code: 100)

And I had to add the programs manually, also to see why thei were not installed in the first place.

apt-get install python-plaso wine regripper mantary