Using foorep part 1 - Installing

foorep, your personal forensic repository. In this article I will show you how to install foorep on different versions of Ubuntu and on SIFT Workstation.
The second post in this series will be all about using the CLI interface!

For an overview of what foorep is and why I created it, take a look at my earlier blogpost.

Ubuntu 12.04 and 12.10

On Ubuntu 12.04 and 12.10 all the dependencies are available from the apt sources. In 3 simple steps, you will be up and running.

1. Install mongodb
$ sudo apt-get install mongodb
2. Install support for parsing exif
$ sudo apt-get install python-pyexiv2
3. Install foorep
$ sudo pip install foorep



Ubuntu 10.04 and SIFT Workstation 2.14 (Ubuntu 9.10)

The provided version of mongodb in older Ubuntu is lacking some features that we depend on, so we need to install mongodb from 10gens repository. Also the package python-magic is too old. We fix all this with some additional steps.

1. Uninstall old mongodb
$ sudo apt-get remove mongodb
2. Add 10gen Ubuntu repository to sources.list
$ sudo echo "deb http://downloads-distro.mongodb.org/repo/ubuntu-upstart dist 10gen" >> /etc/apt/sources.list
3. Add 10gen key
$ sudo apt-key adv --keyserver keyserver.ubuntu.com --recv 7F0CEB10
4. Update apt
$ sudo apt-get update
5. Install mongodb
$ sudo apt-get install mongodb-10gen
6. Install support for parsing exif
$ sudo apt-get install python-pyexiv2
7. Remove python-magic, the version bundled with Ubuntu is too old.
$ sudo apt-get remove python-magic
8. Install foorep
$ sudo pip install foorep



Play

After you have installed foorep, you are ready to fill it with content. I will write about this in the next post, but for the inpatient:

• foorep add /pat/to/malware
• foorep list
• foorep dump id
• foorepd (start the built in webserver)
• Browse to http://127.0.0.1:4780

Happy hacking!