On 2013-04-03 14:40, Michael Hale Ligh wrote:

Hi James, 

It looks like you might have a semi-broken installation. In your
output I see "/usr/local/bin/vol.py" and also "/opt/volatility-2.2".
When you installed, did you run setup.py or did you just extract the
archive you downloaded

from https://code.google.com/p/volatility/downloads/list [3] and copy

vol.py to /usr/local/bin? Is this the only version of volatility you
installed or have you used older versions in the past that might not
have been removed properly?

Im positive the error doesnt occur in "normal" installations. You

might try running "make clean" inside the /opt/volatility-2.2
directory to remove any stale/old compiled .pyc files and then
re-running yarascan. 

Let us know how it goes, 
MHL

Thanks Michael for the quick response.  I suspect I have a hosed install.  I have an old version, but I've never done the setup part.  I've done setup and make clean, and here's my next response:

Traceback (most recent call last):

  File "./vol.py", line 5, in <module>
    pkg_resources.run_script('volatility==2.2', 'vol.py')
  File "/usr/lib/python2.7/dist-packages/pkg_resources.py", line 499, in run_script
    self.require(requires)[0].run_script(script_name, ns)
  File "/usr/lib/python2.7/dist-packages/pkg_resources.py", line 1229, in run_script
    raise ResolutionError("No script named %r" % script_name)
pkg_resources.ResolutionError: No script named 'vol.py'

Looks like I'm having a bad go of it today...thank you.

James