Install Volatility on Debian, Ubuntu & Mint

Oct 7, 2020 by Thibault | 443 views

Sysadmin Forensics

In this blog post we show how to install the latest (GIT) version of Volatility memory forensics framework on Debian, Ubuntu or Mint.


The 'stable' version of Volatility requires python 2. There is a port for python 3, but at the time of writing it is still under development:

So for now the requirements for installing volatility are:

  • python 2
  • distorm3

python 2

First, check the installed version of python:

python --version

If it's not python 2, you will have to install it:

sudo apt install python2.7


To install distorm3, we will first need pip, and a few other tools and libraries:

sudo apt install python-pip python-setuptools build-essential python-dev

Now we can install distorm3, but we need version 3.4.4 because more recent versions (3.5) do not support volatility anymore:

sudo pip install distorm3==3.4.4


To install you can simply clone the GIT repository of Volatility:

sudo apt install git
git clone
chmod +x volatility/

I like to have my manually installed apps in /opt, so I will move volatility there, and create a symlink to make it globally available:

sudo mv volatility /opt
sudo ln -s /opt/volatility/ /usr/bin/

Test --info