Skip to content

Commit 65a02d9

Browse files
authored
Merge pull request #1764 from volatilityfoundation/issues/make-quickstart-quicker
Documentation: Improve the readme to make quickstart the first thing …
2 parents 6eb95ca + ac8a110 commit 65a02d9

File tree

1 file changed

+31
-27
lines changed

1 file changed

+31
-27
lines changed

README.md

Lines changed: 31 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -14,10 +14,33 @@ technical and performance challenges associated with the original
1414
code base that became apparent over the previous 10 years. Another benefit
1515
of the rewrite is that Volatility 3 could be released under a custom
1616
license that was more aligned with the goals of the Volatility community,
17-
the Volatility Software License (VSL). See the
18-
[LICENSE](https://www.volatilityfoundation.org/license/vsl-v1.0) file for
17+
the Volatility Software License (VSL). See the
18+
[LICENSE](https://www.volatilityfoundation.org/license/vsl-v1.0) file for
1919
more details.
2020

21+
## Quick Start
22+
23+
1. Install the required dependencies:
24+
25+
```shell
26+
pip install --user -e ".[full]"
27+
```
28+
29+
2. See available options:
30+
31+
```shell
32+
vol -h
33+
```
34+
35+
3. To get more information on a Windows memory sample and to make sure Volatility supports that sample type, run `vol -f <imagepath> windows.info`:
36+
37+
```shell
38+
vol -f /home/user/samples/stuxnet.vmem windows.info
39+
```
40+
41+
4. Run some other plugins. The `-f` or `--single-location` is not strictly required, but most plugins expect a single sample.
42+
Some also require/accept other options. Run `vol <plugin> -h` for more information on a particular command.
43+
2144
## Installing
2245

2346
Volatility 3 requires Python 3.8.0 or later and is published on the [PyPi registry](https://pypi.org/project/volatility3).
@@ -38,38 +61,19 @@ python3 -m venv venv && . venv/bin/activate
3861
pip install -e ".[dev]"
3962
```
4063

41-
## Quick Start
42-
43-
1. Install Volatility 3 as documented in the Installing section of the readme.
44-
45-
2. See available options:
46-
47-
```shell
48-
vol -h
49-
```
50-
51-
3. To get more information on a Windows memory sample and to make sure Volatility supports that sample type, run `vol -f <imagepath> windows.info`:
52-
53-
```shell
54-
vol -f /home/user/samples/stuxnet.vmem windows.info
55-
```
56-
57-
4. Run some other plugins. The `-f` or `--single-location` is not strictly required, but most plugins expect a single sample.
58-
Some also require/accept other options. Run `vol <plugin> -h` for more information on a particular command.
59-
6064
## Symbol Tables
6165

6266
Symbol table packs for the various operating systems are available for download at:
6367

64-
<https://downloads.volatilityfoundation.org/volatility3/symbols/windows.zip>
65-
<https://downloads.volatilityfoundation.org/volatility3/symbols/mac.zip>
66-
<https://downloads.volatilityfoundation.org/volatility3/symbols/linux.zip>
68+
<https://downloads.volatilityfoundation.org/volatility3/symbols/windows.zip>
69+
<https://downloads.volatilityfoundation.org/volatility3/symbols/mac.zip>
70+
<https://downloads.volatilityfoundation.org/volatility3/symbols/linux.zip>
6771

6872
The hashes to verify whether any of the symbol pack files have downloaded successfully or have changed can be found at:
6973

70-
<https://downloads.volatilityfoundation.org/volatility3/symbols/SHA256SUMS>
71-
<https://downloads.volatilityfoundation.org/volatility3/symbols/SHA1SUMS>
72-
<https://downloads.volatilityfoundation.org/volatility3/symbols/MD5SUMS>
74+
<https://downloads.volatilityfoundation.org/volatility3/symbols/SHA256SUMS>
75+
<https://downloads.volatilityfoundation.org/volatility3/symbols/SHA1SUMS>
76+
<https://downloads.volatilityfoundation.org/volatility3/symbols/MD5SUMS>
7377

7478
Symbol tables zip files must be placed, as named, into the `volatility3/symbols` directory (or just the symbols directory next to the executable file).
7579

0 commit comments

Comments
 (0)