{"action":"created","issue":{"url":"https://api.github.com/repos/sans-dfir/sift/issues/252","repository_url":"https://api.github.com/repos/sans-dfir/sift","labels_url":"https://api.github.com/repos/sans-dfir/sift/issues/252/labels{/name}","comments_url":"https://api.github.com/repos/sans-dfir/sift/issues/252/comments","events_url":"https://api.github.com/repos/sans-dfir/sift/issues/252/events","html_url":"https://github.com/sans-dfir/sift/issues/252","id":312931777,"number":252,"title":"[CLI] Installation on Ubuntu desktop fails","user":{"login":"TheZonks","id":38252552,"avatar_url":"https://avatars2.githubusercontent.com/u/38252552?v=4","gravatar_id":"","url":"https://api.github.com/users/TheZonks","html_url":"https://github.com/TheZonks","followers_url":"https://api.github.com/users/TheZonks/followers","following_url":"https://api.github.com/users/TheZonks/following{/other_user}","gists_url":"https://api.github.com/users/TheZonks/gists{/gist_id}","starred_url":"https://api.github.com/users/TheZonks/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/TheZonks/subscriptions","organizations_url":"https://api.github.com/users/TheZonks/orgs","repos_url":"https://api.github.com/users/TheZonks/repos","events_url":"https://api.github.com/users/TheZonks/events{/privacy}","received_events_url":"https://api.github.com/users/TheZonks/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2018-04-10T13:50:57Z","updated_at":"2018-04-13T23:06:12Z","closed_at":null,"author_association":"NONE","body":"Hello,\r\n\r\ni tried to install sift workstation on several ubuntu installations, all with the same result. \r\nwhat i have done is:\r\ninstalling a clean ubuntu vm with virtualbox.\r\ncreated user siftadmin\r\nrunning apt-get update\r\nrunning apt-get upgrade\r\nrunning apt-get dist-upgrade\r\nused versions: ubuntu server 16.04.04 LTS minimal (no unity)\r\nubuntu desktop 16.04.04 LTS with unitiy\r\n\r\nEnvironment (from the last test):\r\nDistributor ID:\tUbuntu\r\nDescription:\tUbuntu 16.04.4 LTS\r\nRelease:\t16.04\r\nCodename:\txenial\r\n\r\nLinux siftworkstation 4.13.0-38-generic #43~16.04.1-Ubuntu SMP Wed Mar 14 17:48:43 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux\r\n\r\nConsole-Log:\r\n> downloading v2018.08.0\r\n>> downloading sift-saltstack-v2018.08.0.tar.gz.asc\r\n>> downloading sift-saltstack-v2018.08.0.tar.gz.sha256\r\n>> downloading sift-saltstack-v2018.08.0.tar.gz.sha256.asc\r\n>> downloading sift-saltstack-v2018.08.0.tar.gz\r\n> validating file sift-saltstack-v2018.08.0.tar.gz\r\n> validating signature for sift-saltstack-v2018.08.0.tar.gz.sha256\r\n> extracting update sift-saltstack-v2018.08.0.tar.gz\r\n> performing update v2018.08.0\r\n>> Log file: /var/cache/sift/cli/v2018.08.0/saltstack.log\r\n\r\n>> Running: python-software-properties\r\n>> Running: apt-transport-https\r\n>> Running: deb https://apt.dockerproject.org/repo ubuntu-xenial main\r\n>> Running: sift-gift-dev\r\n>> Running: gift\r\n>> Running: sift-dev\r\n>> Running: sift-repo\r\n>> Running: software-properties-common\r\n>> Running: noobslab-themes\r\n>> Running: noobslab-icons\r\n>> Running: openjdk-repo\r\n>> Running: deb http://archive.ubuntu.com/ubuntu/ xenial multiverse\r\n>> Running: deb http://archive.ubuntu.com/ubuntu/ xenial-security multiverse\r\n>> Running: deb http://archive.ubuntu.com/ubuntu/ xenial universe\r\n>> Running: ubuntutweak\r\n>> Running: sift-repos\r\n>> Running: binplist\r\n>> Running: unity-webapps-common\r\n>> Running: aeskeyfind\r\n>> Running: afflib-tools\r\n>> Running: afterglow\r\n>> Running: aircrack-ng\r\n>> Running: apache2\r\n>> Running: arp-scan\r\n>> Running: autopsy\r\n>> Running: bcrypt\r\n>> Running: bitpim\r\n>> Running: bitpim-lib\r\n>> Running: bkhive\r\n>> Running: bless\r\n>> Running: blt\r\n>> Running: build-essential\r\n>> Running: bulk-extractor\r\n>> Running: cabextract\r\n>> Running: ccrypt\r\n>> Running: cifs-utils\r\n>> Running: clamav\r\n>> Running: cmospwd\r\n>> Running: cryptcat\r\n>> Running: cryptsetup\r\n>> Running: curl\r\n>> Running: dc3dd\r\n>> Running: dcfldd\r\n>> Running: dconf-tools\r\n>> Running: docker-engine\r\n>> Running: driftnet\r\n>> Running: dsniff\r\n>> Running: dumbpig\r\n>> Running: e2fslibs-dev\r\n>> Running: ent\r\n>> Running: epic5\r\n>> Running: etherape\r\n>> Running: ettercap-graphical\r\n>> Running: exfat-fuse\r\n>> Running: exfat-utils\r\n>> Running: exif\r\n>> Running: extundelete\r\n>> Running: fdupes\r\n>> Running: feh\r\n>> Running: flasm\r\n>> Running: flex\r\n>> Running: foremost\r\n>> Running: g++\r\n>> Running: gawk\r\n>> Running: gcc\r\n>> Running: gdb\r\n>> Running: gddrescue\r\n>> Running: ghex\r\n>> Running: git\r\n>> Running: graphviz\r\n>> Running: gthumb\r\n>> Running: gzrt\r\n>> Running: hexedit\r\n>> Running: htop\r\n>> Running: hydra\r\n>> Running: hydra-gtk\r\n>> Running: ipython\r\n>> Running: jq\r\n>> Running: kdiff3\r\n>> Running: knocker\r\n>> Running: kpartx\r\n>> Running: lft\r\n>> Running: libafflib-dev\r\n>> Running: libafflib0v5\r\n>> Running: libbde\r\n>> Running: libbde-tools\r\n>> Running: libesedb\r\n>> Running: libesedb-tools\r\n>> Running: libevt\r\n>> Running: libevt-tools\r\n>> Running: libevtx\r\n>> Running: libevtx-tools\r\n>> Running: libewf\r\n>> Running: libewf-dev\r\n>> Running: libewf-python\r\n>> Running: libewf-tools\r\n>> Running: libffi-dev\r\n>> Running: libfuse-dev\r\n>> Running: libfvde\r\n>> Running: libfvde-tools\r\n>> Running: liblightgrep\r\n>> Running: libmsiecf\r\n>> Running: libncurses5-dev\r\n>> Running: libnet1\r\n>> Running: libolecf\r\n>> Running: libparse-win32registry-perl\r\n>> Running: libpff\r\n>> Running: libpff-dev\r\n>> Running: libpff-python\r\n>> Running: libpff-tools\r\n>> Running: libplist-utils\r\n>> Running: libregf\r\n>> Running: libregf-dev\r\n>> Running: libregf-python\r\n>> Running: libregf-tools\r\n>> Running: libssl-dev\r\n>> Running: libtext-csv-perl\r\n>> Running: libvmdk\r\n>> Running: libvshadow\r\n>> Running: libvshadow-dev\r\n>> Running: libvshadow-python\r\n>> Running: libvshadow-tools\r\n>> Running: libxml2-dev\r\n>> Running: libxslt-dev\r\n>> Running: md5deep\r\n>> Running: nbd-client\r\n>> Running: nbtscan\r\n>> Running: netcat\r\n>> Running: netpbm\r\n>> Running: netsed\r\n>> Running: netwox\r\n>> Running: nfdump\r\n>> Running: ngrep\r\n>> Running: nikto\r\n>> Running: okular\r\n>> Running: open-iscsi\r\n>> Running: openjdk-7-jdk\r\n>> Running: ophcrack\r\n>> Running: ophcrack-cli\r\n>> Running: outguess\r\n>> Running: p0f\r\n>> Running: p7zip-full\r\n>> Running: pdftk\r\n>> Running: perl\r\n>> Running: perl -MCPAN -e 'my $c = \"CPAN::HandleConfig\"; $c->load(doit => 1, autoconfig => 1); $c->edit(prerequisites_policy => \"follow\"); $c->edit(build_requires_install_policy => \"yes\"); $c->commit'\r\n>> Running: pev\r\n>> Running: phonon\r\n>> Running: pkg-config\r\n>> Running: python-plaso\r\n>> Running: python-dfvfs\r\n>> Running: python3-xlsxwriter\r\n>> Running: python-xlsxwriter\r\n>> Running: python-dfvfs\r\n>> Running: python-plaso\r\n>> Running: plaso-tools\r\n>> Running: /var/cache/sift/archives/powershell_6.0.0-alpha.13-1ubuntu1.16.04.1_amd64.deb\r\n>> Running: sift-powershell\r\n>> Running: pv\r\n>> Running: pyew\r\n>> Running: python\r\n>> Running: python-dev\r\n>> Running: python-flowgrep\r\n>> Running: python-fuse\r\n>> Running: python-nids\r\n>> Running: python-ntdsxtract\r\n>> Running: python-pefile\r\n>> Running: python-pip\r\n>> Running: pytsk3\r\n>> Running: python-pytsk3\r\n>> Running: python-qt4\r\n>> Running: python-tk\r\n>> Running: python-virtualenv\r\n>> Running: colorama\r\n>> Running: construct\r\n>> Running: dpapick\r\n>> Running: distorm3\r\n>> Running: haystack\r\n>> Running: pefile\r\n>> Running: pycoin\r\n>> Running: pysocks\r\n>> Running: simplejson\r\n>> Running: yara-python\r\n>> Running: python-volatility\r\n>> Running: /usr/lib/python2.7/dist-packages/volatility/plugins/sift/\r\n>> Running: /usr/lib/python2.7/dist-packages/volatility/plugins/malprocfind.py\r\n>> Running: /usr/lib/python2.7/dist-packages/volatility/plugins/idxparser.py\r\n>> Running: /usr/lib/python2.7/dist-packages/volatility/plugins/chromehistory.py\r\n>> Running: /usr/lib/python2.7/dist-packages/volatility/plugins/mimikatz.py\r\n>> Running: /usr/lib/python2.7/dist-packages/volatility/plugins/openioc_scan.py\r\n>> Running: /usr/lib/python2.7/dist-packages/volatility/plugins/pstotal.py\r\n>> Running: /usr/lib/python2.7/dist-packages/volatility/plugins/firefoxhistory.py\r\n>> Running: /usr/lib/python2.7/dist-packages/volatility/plugins/autoruns.py\r\n>> Running: /usr/lib/python2.7/dist-packages/volatility/plugins/malfinddeep.py\r\n>> Running: /usr/lib/python2.7/dist-packages/volatility/plugins/prefetch.py\r\n>> Running: /usr/lib/python2.7/dist-packages/volatility/plugins/baseline.py\r\n>> Running: /usr/lib/python2.7/dist-packages/volatility/plugins/ssdeepscan.py\r\n>> Running: /usr/lib/python2.7/dist-packages/volatility/plugins/uninstallinfo.py\r\n>> Running: /usr/lib/python2.7/dist-packages/volatility/plugins/trustrecords.py\r\n>> Running: /usr/lib/python2.7/dist-packages/volatility/plugins/usnparser.py\r\n>> Running: /usr/lib/python2.7/dist-packages/volatility/plugins/apihooksdeep.py\r\n>> Running: /usr/lib/python2.7/dist-packages/volatility/plugins/editbox.py\r\n>> Running: /usr/lib/python2.7/dist-packages/volatility/plugins/javarat.py\r\n>> Running: python-yara\r\n>> Running: qemu\r\n>> Running: qemu-utils\r\n>> Running: radare2\r\n>> Running: rar\r\n>> Running: readpst\r\n>> Running: rsakeyfind\r\n>> Running: safecopy\r\n>> Running: samba\r\n>> Running: samdump2\r\n>> Running: scalpel\r\n>> Running: sleuthkit\r\n>> Running: socat\r\n>> Running: ssdeep\r\n>> Running: ssldump\r\n>> Running: sslsniff\r\n>> Running: stunnel4\r\n>> Running: system-config-samba\r\n>> Running: tcl\r\n>> Running: tcpflow\r\n>> Running: tcpick\r\n>> Running: tcpreplay\r\n>> Running: tcpslice\r\n>> Running: tcpstat\r\n>> Running: tcptrace\r\n>> Running: tcptrack\r\n>> Running: tcpxtract\r\n>> Running: testdisk\r\n>> Running: tofrodos\r\n>> Running: transmission\r\n>> Running: unity-control-center\r\n>> Running: unrar\r\n>> Running: upx-ucl\r\n>> Running: vbindiff\r\n>> Running: vim\r\n>> Running: virtuoso-minimal\r\n>> Running: vmfs-tools\r\n>> Running: winbind\r\n>> Running: dpkg --add-architecture i386\r\n>> Running: sift-wine-apt-update\r\n>> Running: wine\r\n>> Running: wireshark\r\n>> Running: xdot\r\n>> Running: xfsprogs\r\n>> Running: xmount\r\n>> Running: xpdf\r\n>> Running: zenity\r\n>> Running: analyzemft\r\n>> Running: argparse\r\n>> Running: bitstring\r\n>> Running: docopt\r\n>> Running: geoip2\r\n>> Running: pip\r\n>> Running: python-dateutil >= 2.4.2\r\n>> Running: python-evtx\r\n>> Running: python-magic\r\n>> Running: python-registry\r\n>> Running: setuptools\r\n>> Running: wheel\r\n>> Running: /opt/rekall\r\n>> Running: rekall\r\n>> Running: six\r\n>> Running: timesketch\r\n>> Running: unicodecsv\r\n>> Running: usnparser\r\n>> Running: virustotal-api\r\n>> Running: windowsprefetch\r\n>> Running: /usr/local/src/densityscout/densityscout_build_45_linux\r\n>> Running: /usr/local/bin/densityscout-build-45\r\n>> Running: /usr/local/bin/densityscout\r\n>> Running: /usr/local/bin/sift\r\n>> Running: https://github.com/cheeky4n6monkey/4n6-scripts.git\r\n>> Running: /usr/local/bin/WP8_AppPerms.py\r\n>> Running: /usr/local/bin/bing-bar-parser.pl\r\n>> Running: /usr/local/bin/chunkymonkey.py\r\n>> Running: /usr/local/bin/dextract.def\r\n>> Running: /usr/local/bin/dextract.py\r\n>> Running: /usr/local/bin/docx-font-extractor.pl\r\n>> Running: /usr/local/bin/exif2map.pl\r\n>> Running: /usr/local/bin/fbmsg-extractor.py\r\n>> Running: /usr/local/bin/gis4cookie.pl\r\n>> Running: /usr/local/bin/google-ei-time.py\r\n>> Running: /usr/local/bin/imgcache-parse-mod.py\r\n>> Running: /usr/local/bin/imgcache-parse.py\r\n>> Running: /usr/local/bin/json-printer.pl\r\n>> Running: /usr/local/bin/msoffice-pic-extractor.py\r\n>> Running: /usr/local/bin/plist2db.py\r\n>> Running: /usr/local/bin/print_apk_perms.py\r\n>> Running: /usr/local/bin/s2-cellid2latlong.py\r\n>> Running: /usr/local/bin/s2-latlong2cellid.py\r\n>> Running: /usr/local/bin/sms-grep-sample-config.txt\r\n>> Running: /usr/local/bin/sms-grep.pl\r\n>> Running: /usr/local/bin/sqlite-base64-decode.py\r\n>> Running: /usr/local/bin/sqlite-blob-dumper.py\r\n>> Running: /usr/local/bin/sqlite-parser.pl\r\n>> Running: /usr/local/bin/squirrelgripper-README.txt\r\n>> Running: /usr/local/bin/squirrelgripper.pl\r\n>> Running: /usr/local/bin/timediff32.pl\r\n>> Running: /usr/local/bin/vmail-db-2-html.pl\r\n>> Running: /usr/local/bin/wp8-1-callhistory.py\r\n>> Running: /usr/local/bin/wp8-1-contacts.py\r\n>> Running: /usr/local/bin/wp8-1-mms-filesort.py\r\n>> Running: /usr/local/bin/wp8-1-mms.py\r\n>> Running: /usr/local/bin/wp8-1-sms.py\r\n>> Running: /usr/local/bin/wp8-callhistory.py\r\n>> Running: /usr/local/bin/wp8-contacts.py\r\n>> Running: /usr/local/bin/wp8-fb-msg.py\r\n>> Running: /usr/local/bin/wp8-sha256-pin-finder.py\r\n>> Running: /usr/local/bin/wp8-sms.py\r\n>> Running: /usr/local/bin/wwf-chat-parser.py\r\n>> Running: /usr/local/bin/amcache.py\r\n>> Running: /usr/local/bin/amcache.py\r\n>> Running: /usr/local/bin/dump-mft-entry.pl\r\n>> Running: /usr/local/bin/dump-mft-entry.pl\r\n>> Running: /usr/local/bin/imageMounter.py\r\n>> Running: /usr/local/bin/idx_parser.py\r\n>> Running: /usr/local/bin/jobparser.py\r\n>> Running: https://github.com/keydet89/Tools.git\r\n>> Running: /usr/local/bin/bodyfile.pl\r\n>> Running: /usr/local/bin/bodyfile.pl\r\n>> Running: /usr/local/bin/evtparse.pl\r\n>> Running: /usr/local/bin/evtparse.pl\r\n>> Running: /usr/local/bin/evtrpt.pl\r\n>> Running: /usr/local/bin/evtrpt.pl\r\n>> Running: /usr/local/bin/evtxparse.pl\r\n>> Running: /usr/local/bin/evtxparse.pl\r\n>> Running: /usr/local/bin/fb.pl\r\n>> Running: /usr/local/bin/fb.pl\r\n>> Running: /usr/local/bin/ff.pl\r\n>> Running: /usr/local/bin/ff.pl\r\n>> Running: /usr/local/bin/ff_signons.pl\r\n>> Running: /usr/local/bin/ff_signons.pl\r\n>> Running: /usr/local/bin/ftkparse.pl\r\n>> Running: /usr/local/bin/ftkparse.pl\r\n>> Running: /usr/local/bin/idx.pl\r\n>> Running: /usr/local/bin/idx.pl\r\n>> Running: /usr/local/bin/idxparse.pl\r\n>> Running: /usr/local/bin/idxparse.pl\r\n>> Running: /usr/local/bin/jl.pl\r\n>> Running: /usr/local/bin/jl.pl\r\n>> Running: /usr/local/bin/jobparse.pl\r\n>> Running: /usr/local/bin/jobparse.pl\r\n>> Running: /usr/local/bin/lfle.pl\r\n>> Running: /usr/local/bin/lfle.pl\r\n>> Running: /usr/local/bin/lnk.pl\r\n>> Running: /usr/local/bin/lnk.pl\r\n>> Running: /usr/local/bin/mft.pl\r\n>> Running: /usr/local/bin/mft.pl\r\n>> Running: /usr/local/bin/parse.pl\r\n>> Running: /usr/local/bin/parse.pl\r\n>> Running: /usr/local/bin/parsei30.pl\r\n>> Running: /usr/local/bin/parsei30.pl\r\n>> Running: /usr/local/bin/parseie.pl\r\n>> Running: /usr/local/bin/parseie.pl\r\n>> Running: /usr/local/bin/pie.pl\r\n>> Running: /usr/local/bin/pie.pl\r\n>> Running: /usr/local/bin/pref.pl\r\n>> Running: /usr/local/bin/pref.pl\r\n>> Running: /usr/local/bin/rawie.pl\r\n>> Running: /usr/local/bin/rawie.pl\r\n>> Running: /usr/local/bin/recbin.pl\r\n>> Running: /usr/local/bin/recbin.pl\r\n>> Running: /usr/local/bin/regslack.pl\r\n>> Running: /usr/local/bin/regslack.pl\r\n>> Running: /usr/local/bin/regtime.pl\r\n>> Running: /usr/local/bin/regtime.pl\r\n>> Running: /usr/local/bin/rfc.pl\r\n>> Running: /usr/local/bin/rfc.pl\r\n>> Running: /usr/local/bin/rlo.pl\r\n>> Running: /usr/local/bin/rlo.pl\r\n>> Running: /usr/local/bin/tln.pl\r\n>> Running: /usr/local/bin/tln.pl\r\n>> Running: /usr/local/bin/usnj.pl\r\n>> Running: /usr/local/bin/usnj.pl\r\n>> Running: /usr/local/bin/packerid.py\r\n>> Running: /usr/local/bin/packerid.py\r\n>> Running: /usr/local/bin\r\n>> Running: /usr/local/bin/parseusn.py\r\n>> Running: /usr/local/bin\r\n>> Running: /usr/local/bin/pecarve.py\r\n>> Running: /usr/local/bin/pecarve.py\r\n>> Running: /usr/local/bin/pescanner.py\r\n>> Running: https://github.com/keydet89/RegRipper2.8.git\r\n>> Running: /usr/share/regripper\r\n>> Running: /usr/share/regripper/rip.pl\r\n>> Running: /usr/share/regripper/plugins\r\n>> Running: /usr/local/bin/rip.pl\r\n>> Running: grep -R \"my %config = (hive\" /usr/share/regripper/plugins | grep \"All\" | cut -f1 -d: | xargs -n1 -I{} basename {} | sed 's/.pl$//' > /usr/share/regripper/plugins/all\r\n>> Running: grep -R \"my %config = (hive\" /usr/share/regripper/plugins | grep \"All\" | cut -f1 -d: | xargs -n1 -I{} basename {} | sed 's/.pl$//' > /usr/share/regripper/plugins/all\r\n>> Running: grep -R \"my %config = (hive\" /usr/share/regripper/plugins | grep \"NTUSER\" | cut -f1 -d: | xargs -n1 -I{} basename {} | sed 's/.pl$//' > /usr/share/regripper/plugins/ntuser\r\n>> Running: grep -R \"my %config = (hive\" /usr/share/regripper/plugins | grep \"NTUSER\" | cut -f1 -d: | xargs -n1 -I{} basename {} | sed 's/.pl$//' > /usr/share/regripper/plugins/ntuser\r\n>> Running: grep -R \"my %config = (hive\" /usr/share/regripper/plugins | grep \"USRCLASS\" | cut -f1 -d: | xargs -n1 -I{} basename {} | sed 's/.pl$//' > /usr/share/regripper/plugins/usrclass\r\n>> Running: grep -R \"my %config = (hive\" /usr/share/regripper/plugins | grep \"USRCLASS\" | cut -f1 -d: | xargs -n1 -I{} basename {} | sed 's/.pl$//' > /usr/share/regripper/plugins/usrclass\r\n>> Running: grep -R \"my %config = (hive\" /usr/share/regripper/plugins | grep \"SAM\" | cut -f1 -d: | xargs -n1 -I{} basename {} | sed 's/.pl$//' > /usr/share/regripper/plugins/sam\r\n>> Running: grep -R \"my %config = (hive\" /usr/share/regripper/plugins | grep \"SAM\" | cut -f1 -d: | xargs -n1 -I{} basename {} | sed 's/.pl$//' > /usr/share/regripper/plugins/sam\r\n>> Running: grep -R \"my %config = (hive\" /usr/share/regripper/plugins | grep \"Security\" | cut -f1 -d: | xargs -n1 -I{} basename {} | sed 's/.pl$//' > /usr/share/regripper/plugins/security\r\n>> Running: grep -R \"my %config = (hive\" /usr/share/regripper/plugins | grep \"Security\" | cut -f1 -d: | xargs -n1 -I{} basename {} | sed 's/.pl$//' > /usr/share/regripper/plugins/security\r\n>> Running: grep -R \"my %config = (hive\" /usr/share/regripper/plugins | grep \"Software\" | cut -f1 -d: | xargs -n1 -I{} basename {} | sed 's/.pl$//' > /usr/share/regripper/plugins/software\r\n>> Running: grep -R \"my %config = (hive\" /usr/share/regripper/plugins | grep \"Software\" | cut -f1 -d: | xargs -n1 -I{} basename {} | sed 's/.pl$//' > /usr/share/regripper/plugins/software\r\n>> Running: grep -R \"my %config = (hive\" /usr/share/regripper/plugins | grep \"System\" | cut -f1 -d: | xargs -n1 -I{} basename {} | sed 's/.pl$//' > /usr/share/regripper/plugins/system\r\n>> Running: grep -R \"my %config = (hive\" /usr/share/regripper/plugins | grep \"System\" | cut -f1 -d: | xargs -n1 -I{} basename {} | sed 's/.pl$//' > /usr/share/regripper/plugins/system\r\n>> Running: /usr/local/bin/set-display-scale\r\n>> Running: /usr/local/bin/ShimCacheParser.py\r\n>> Running: /usr/local/bin/ShimCacheParser.py\r\n>> Running: /usr/share/sift/resources\r\n>> Running: /usr/share/sift/images\r\n>> Running: /usr/share/sift/audio\r\n>> Running: /usr/share/sift/other\r\n>> Running: /usr/share/sift/scripts\r\n>> Running: /usr/share/sift\r\n>> Running: /usr/share/tsk/sorter\r\n>> Running: /usr/share/tsk/sorter\r\n>> Running: /usr/local/bin/sqlparser.py\r\n>> Running: /usr/local/bin/sqlparser.py\r\n>> Running: /usr/local/bin/usbdeviceforensics.py\r\n>> Running: /usr/local/bin/usbdeviceforensics.py\r\n>> Running: /usr/local/src/virustotal-search-v0.1.4\r\n>> Running: /usr/local/bin/virustotal-search.py\r\n>> Running: /usr/local/src/virustotal-submit-v0.0.3\r\n>> Running: /usr/local/bin/virustotal-submit.py\r\n>> Running: /usr/local/bin/vshot\r\n>> Running: sift-scripts\r\n>> Running: /etc/hostname\r\n>> Running: hostnamectl set-hostname siftworkstation\r\n>> Running: siftworkstation\r\n>> Running: siftadmin\r\n>> Running: /home/siftadmin/.bash_aliases\r\n>> Running: /home/siftadmin/.bash_aliases\r\n>> Running: /root/.bash_aliases\r\n>> Running: /home/siftadmin/.bashrc\r\n>> Running: /home/siftadmin/.bashrc\r\n>> Running: /home/siftadmin/.bashrc\r\n>> Running: /home/siftadmin/.bashrc\r\n>> Running: /root/.bashrc\r\n>> Running: /root/.bashrc\r\n>> Running: /root/.bashrc\r\n>> Running: /home/siftadmin/.config/autostart\r\n>> Running: /home/siftadmin/Desktop/Network-Forensics-Poster.pdf\r\n>> Running: /home/siftadmin/Desktop/DFIR-Threat-Intel-Poster.pdf\r\n>> Running: /home/siftadmin/Desktop/SIFT-REMnux-Poster.pdf\r\n>> Running: /home/siftadmin/Desktop/Memory-Forensics-Poster.pdf\r\n>> Running: /home/siftadmin/Desktop/Rekall-Cheatsheet.pdf\r\n>> Running: /home/siftadmin/Desktop/DFIR-Smartphone-Forensics-Poster.pdf\r\n>> Running: /home/siftadmin/Desktop/Windows-Forensics-Poster.pdf\r\n>> Running: /home/siftadmin/Desktop/Find-Evil.pdf\r\n>> Running: /home/siftadmin/Desktop/SIFT-Cheatsheet.pdf\r\n>> Running: /home/siftadmin/Desktop/Linux-Shell-Survival-Guide.pdf\r\n>> Running: /home/siftadmin/Desktop/Windows-to-Unix-Cheatsheet.pdf\r\n>> Running: /home/siftadmin/Desktop/Volatility-Cheatsheet.pdf\r\n>> Running: /home/siftadmin/Desktop/Hex-File-Regex-Cheatsheet.pdf\r\n>> Running: /home/siftadmin/Desktop\r\n>> Running: /home/siftadmin/Desktop/mount_points\r\n>> Running: /home/siftadmin/Desktop/cases\r\n>> Running: /usr/share/sift/terminal-profiles.txt\r\n>> Running: dconf load /org/gnome/terminal/ < /usr/share/sift/terminal-profiles.txt\r\n>> Running: arc-icons\r\n>> Running: arc-theme\r\n>> Running: gsettings set org.gnome.desktop.interface gtk-theme Arc\r\n>> Running: gsettings set org.gnome.desktop.interface icon-theme Arc-Icons\r\n>> Running: /usr/share/backgrounds\r\n>> Running: /usr/share/backgrounds/warty-final-ubuntu.png\r\n>> Running: /usr/share/unity-greeter\r\n>> Running: /usr/share/unity-greeter/logo.png\r\n>> Running: /home/siftadmin/.config/autostart/\r\n>> Running: /home/siftadmin/.config/autostart/gnome-terminal.desktop\r\n>> Running: gsettings set com.canonical.Unity.Launcher launcher-position Bottom\r\n>> Running: gsettings set com.canonical.Unity.Lenses disabled-scopes \"['more_suggestions-amazon.scope', 'more_suggestions-u1ms.scope', 'more_suggestions-populartracks.scope', 'music-musicstore.scope', 'more_suggestions-ebay.scope', 'more_suggestions-ubuntushop.scope', 'more_suggestions-skimlinks.scope']\"\r\n>> Running: gsettings set com.canonical.Unity.Launcher favorites \"['application://gnome-terminal.desktop', 'application://firefox.desktop', 'application://org.gnome.Nautilus.desktop', 'application://unity-control-center.desktop', 'unity://running-apps', 'unity://expo-icon', 'unity://devices']\"\r\n>> Running: dconf write /org/compiz/profiles/unity/plugins/unityshell/icon-size 32\r\n>> Running: dconf write /org/compiz/profiles/unity/plugins/unityshell/launcher-minimize-window true\r\n>> Running: Etc/UTC\r\n>> Running: /cases\r\n>> Running: /mnt/usb\r\n>> Running: /mnt/vss\r\n>> Running: /mnt/shadow_mount\r\n>> Running: /mnt/windows_mount\r\n>> Running: /mnt/ewf_mount\r\n>> Running: /mnt/e01\r\n>> Running: /mnt/aff\r\n>> Running: /mnt/ewf\r\n>> Running: /mnt/bde\r\n>> Running: /mnt/iscsi\r\n>> Running: /mnt/windows_mount1\r\n>> Running: /mnt/windows_mount2\r\n>> Running: /mnt/windows_mount3\r\n>> Running: /mnt/windows_mount4\r\n>> Running: /mnt/windows_mount5\r\n>> Running: /mnt/shadow_mount/vss1\r\n>> Running: /mnt/shadow_mount/vss2\r\n>> Running: /mnt/shadow_mount/vss3\r\n>> Running: /mnt/shadow_mount/vss4\r\n>> Running: /mnt/shadow_mount/vss5\r\n>> Running: /mnt/shadow_mount/vss6\r\n>> Running: /mnt/shadow_mount/vss7\r\n>> Running: /mnt/shadow_mount/vss8\r\n>> Running: /mnt/shadow_mount/vss9\r\n>> Running: /mnt/shadow_mount/vss10\r\n>> Running: /mnt/shadow_mount/vss11\r\n>> Running: /mnt/shadow_mount/vss12\r\n>> Running: /mnt/shadow_mount/vss13\r\n>> Running: /mnt/shadow_mount/vss14\r\n>> Running: /mnt/shadow_mount/vss15\r\n>> Running: /mnt/shadow_mount/vss16\r\n>> Running: /mnt/shadow_mount/vss17\r\n>> Running: /mnt/shadow_mount/vss18\r\n>> Running: /mnt/shadow_mount/vss19\r\n>> Running: /mnt/shadow_mount/vss20\r\n>> Running: /mnt/shadow_mount/vss21\r\n>> Running: /mnt/shadow_mount/vss22\r\n>> Running: /mnt/shadow_mount/vss23\r\n>> Running: /mnt/shadow_mount/vss24\r\n>> Running: /mnt/shadow_mount/vss25\r\n>> Running: /mnt/shadow_mount/vss26\r\n>> Running: /mnt/shadow_mount/vss27\r\n>> Running: /mnt/shadow_mount/vss28\r\n>> Running: /mnt/shadow_mount/vss29\r\n>> Running: /mnt/shadow_mount/vss30\r\n>> Running: salt-minion\r\n>> Running: /etc/samba/smb.conf\r\n>> Running: smbd\r\n>> Running: nmbd\r\n>> Running: /etc/foremost.conf\r\n>> Running: /usr/local/etc/foremost.conf\r\n>> Running: sift-config-tools\r\n\r\n>> Completed with Failures -- Success: 514, Failure: 18\r\n\r\n\r\nsift version gives me:\r\n/usr/local/bin$ sift version\r\n> sift-cli@1.5.2-master.2035949\r\n> sift-version: notinstalled\r\n\r\nBTW: i would prefer not to use unity or gnome or kde. i would like to use some more lightweight like xfce, lubuntu or similar from a minimal-installation of ubuntu. is there any chance in the future for this?\r\n\r\nthank you"},"comment":{"url":"https://api.github.com/repos/sans-dfir/sift/issues/comments/381280935","html_url":"https://github.com/sans-dfir/sift/issues/252#issuecomment-381280935","issue_url":"https://api.github.com/repos/sans-dfir/sift/issues/252","id":381280935,"user":{"login":"crrfx","id":38365713,"avatar_url":"https://avatars3.githubusercontent.com/u/38365713?v=4","gravatar_id":"","url":"https://api.github.com/users/crrfx","html_url":"https://github.com/crrfx","followers_url":"https://api.github.com/users/crrfx/followers","following_url":"https://api.github.com/users/crrfx/following{/other_user}","gists_url":"https://api.github.com/users/crrfx/gists{/gist_id}","starred_url":"https://api.github.com/users/crrfx/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/crrfx/subscriptions","organizations_url":"https://api.github.com/users/crrfx/orgs","repos_url":"https://api.github.com/users/crrfx/repos","events_url":"https://api.github.com/users/crrfx/events{/privacy}","received_events_url":"https://api.github.com/users/crrfx/received_events","type":"User","site_admin":false},"created_at":"2018-04-13T23:06:12Z","updated_at":"2018-04-13T23:06:12Z","author_association":"NONE","body":"[saltstack.log](https://github.com/sans-dfir/sift/files/1909706/saltstack.log)\r\n\r\nThe Problem seems to be very similar if not identical to my current issue on Ubuntu 16.04.4 LTS."}}
{"actor":{"display_login":"crrfx"}}