I am trying to develop a step-by-step guide for installation and use of Volatility and Python in Windows as many of our users have a different knowledge level.

 

I was wondering if anyone has any "best practice" guidelines for:

 

1.  If you install Python, would it be preferable to change the Path in Environment Variables to allow Python to be recognized by any directory?

 

2.  Where should I install Volatility to (Python directory, it's own directory)?  Should this directory be "pathed" as well?  I am trying to reduce the complexity of the command line to run the program.

 

3.  Is if preferable to have the memory image in any specific directory?

 

4.  I am getting a warning, although can still get an output. The error is:

"c:\python26\forensics\win32\crashdump.py:31:31: DeprecationWarning: the sha module is deprecated; use the hashlib module instead   

import sha    "

 

Any guidance would be appreciated.

 

Darren Sabourin

Forensic Analyst

Royal Canadian Mounted Police

Regina, Saskatchewan CANADA

ph. (306) 780-7334