not able to get the sift command to work

[dheckart]

i have followed all of the steps outlined in your read me file for Ubuntu 16.0.4 and i get the step 6 and it does not look like it is working then when i type in the command sift --help it tells me that there is no such command. sot sure what to do to fix this i have tried this three different times

[ekristen]

@dheckart can you please use http://asciinema.org/ to record your terminal or copy/paste all your commands into a comment.

[dheckart]

dheckart@ubuntu:~$ gpg --keyserver pgp.mit.edu --recv-keys 22598A94
gpg: requesting key 22598A94 from hkp server pgp.mit.edu
gpg: key 22598A94: "SANS Investigative Forensic Toolkit <sift@computer-forensics.sans.org>" not changed
gpg: Total number processed: 1
gpg:              unchanged: 1
dheckart@ubuntu:~$ cd Downloads
dheckart@ubuntu:~/Downloads$ gpg --keyserver pgp.mit.edu --recv-keys 22598A94
gpg: requesting key 22598A94 from hkp server pgp.mit.edu
gpg: key 22598A94: "SANS Investigative Forensic Toolkit <sift@computer-forensics.sans.org>" not changed
gpg: Total number processed: 1
gpg:              unchanged: 1
dheckart@ubuntu:~/Downloads$ gpg --verify sift-cli-linux.sha256.asc
gpg: Signature made Sat 08 Jul 2017 12:36:26 PM PDT using DSA key ID 22598A94
gpg: Good signature from "SANS Investigative Forensic Toolkit <sift@computer-forensics.sans.org>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 5D29 135B 3798 3CAC 6097  9623 15B9 AD71 2259 8A94
dheckart@ubuntu:~/Downloads$ shasum -a 256 -c sift-cli-linux.sha256.asc OR sha256sum -c sift-cli-linux.sha256.asc
sift-cli-linux: OK
shasum: WARNING: 10 lines are improperly formatted
shasum: OR: No such file or directory
dheckart@ubuntu:~/Downloads$ mv sift-cli-linux /usr/local/bin/sift
mv: cannot move 'sift-cli-linux' to '/usr/local/bin/sift/sift-cli-linux': Permission denied
dheckart@ubuntu:~/Downloads$ sudo mv sift-cli-linux /usr/local/bin/sift
[sudo] password for dheckart: 
dheckart@ubuntu:~/Downloads$ cd
dheckart@ubuntu:~$ sudo chmos 755 /usr/local/bin/sift
sudo: chmos: command not found
dheckart@ubuntu:~$ sudo chmod 755 /usr/local/bin/sift
dheckart@ubuntu:~$ cd /usr/local/local/bin
bash: cd: /usr/local/local/bin: No such file or directory
dheckart@ubuntu:~$ cd /
dheckart@ubuntu:/$ cd usr/local/bin
dheckart@ubuntu:/usr/local/bin$ cd sift
dheckart@ubuntu:/usr/local/bin/sift$ cd..
cd..: command not found
dheckart@ubuntu:/usr/local/bin/sift$ cd
dheckart@ubuntu:~$ cd /
dheckart@ubuntu:/$ cd usr/local/bin
dheckart@ubuntu:/usr/local/bin$ sudo mv sift-cli-linux /usr/local/bin
mv: cannot stat 'sift-cli-linux': No such file or directory
dheckart@ubuntu:/usr/local/bin$ cd sift
dheckart@ubuntu:/usr/local/bin/sift$ sudo mv sift-cli-linux /usr/local/bin
dheckart@ubuntu:/usr/local/bin/sift$ cd usr/local/bin
bash: cd: usr/local/bin: No such file or directory
dheckart@ubuntu:/usr/local/bin/sift$ cd
dheckart@ubuntu:~$ cd /
dheckart@ubuntu:/$ cd usr/local/bin
dheckart@ubuntu:/usr/local/bin$ remdir sift
No command 'remdir' found, did you mean:
 Command 'rmdir' from package 'coreutils' (main)
 Command 'redir' from package 'redir' (universe)
remdir: command not found
dheckart@ubuntu:/usr/local/bin$ rmdir sift
rmdir: failed to remove 'sift': Permission denied
dheckart@ubuntu:/usr/local/bin$ sudo rmdir sift
dheckart@ubuntu:/usr/local/bin$ cd
dheckart@ubuntu:~$ sudo chmod 755 /usr/local/bin/sift
chmod: cannot access '/usr/local/bin/sift': No such file or directory
dheckart@ubuntu:~$ sift
No command 'sift' found, did you mean:
 Command 'swift' from package 'python3-swiftclient' (universe)
 Command 'swift' from package 'python-swiftclient' (main)
 Command 'gift' from package 'gnuift' (universe)
 Command 'lift' from package 'lift' (universe)
sift: command not found
dheckart@ubuntu:~$ sudo chmod 755 /usr/local/bin
dheckart@ubuntu:~$ sift
No command 'sift' found, did you mean:
 Command 'swift' from package 'python-swiftclient' (main)
 Command 'swift' from package 'python3-swiftclient' (universe)
 Command 'lift' from package 'lift' (universe)
 Command 'gift' from package 'gnuift' (universe)
sift: command not found
dheckart@ubuntu:~$ sudo
usage: sudo -h | -K | -k | -V
usage: sudo -v [-AknS] [-g group] [-h host] [-p prompt] [-u user]
usage: sudo -l [-AknS] [-g group] [-h host] [-p prompt] [-U user] [-u user]
            [command]
usage: sudo [-AbEHknPS] [-r role] [-t type] [-C num] [-g group] [-h host] [-p
            prompt] [-u user] [VAR=value] [-i|-s] [<command>]
usage: sudo -e [-AknS] [-r role] [-t type] [-C num] [-g group] [-h host] [-p
            prompt] [-u user] file ...
dheckart@ubuntu:~$ sudo sift-instal
sudo: sift-instal: command not found
dheckart@ubuntu:~$ sudo sift-install
sudo: sift-install: command not found
dheckart@ubuntu:~$ cd /
dheckart@ubuntu:/$ cd usr/local/bin
dheckart@ubuntu:/usr/local/bin$ sift --help
No command 'sift' found, did you mean:
 Command 'gift' from package 'gnuift' (universe)
 Command 'lift' from package 'lift' (universe)
 Command 'swift' from package 'python-swiftclient' (main)
 Command 'swift' from package 'python3-swiftclient' (universe)
sift: command not found
dheckart@ubuntu:/usr/local/bin$ cd
dheckart@ubuntu:~$ sudo sha256sum -c sift-clilinux.sha256.asc
sha256sum: sift-clilinux.sha256.asc: No such file or directory
dheckart@ubuntu:~$ cd/ 
bash: cd/: No such file or directory
dheckart@ubuntu:~$ cd /
dheckart@ubuntu:/$ cd
dheckart@ubuntu:~$ cd Downloads
dheckart@ubuntu:~/Downloads$ sudo sha256sum -c sift-clilinux.sha256.asc
sha256sum: sift-clilinux.sha256.asc: No such file or directory
dheckart@ubuntu:~/Downloads$ cd
dheckart@ubuntu:~$ cd /
dheckart@ubuntu:/$ cd usr/local/bin
dheckart@ubuntu:/usr/local/bin$ sudo sha256sum -c sift-clilinux.sha256.asc
sha256sum: sift-clilinux.sha256.asc: No such file or directory
dheckart@ubuntu:/usr/local/bin$ 

[dheckart]

here are the commands you asked for

[ekristen]

Unfortunately @dheckart I'm not really sure what happened there. It sorta seems like you follow the directions mostly right, but sift in /usr/local/bin shouldn't be a directory. so I'm not sure where things went wrong. I would suggest starting over. I know these instructions work.

[dheckart]

okay if i follow those instruction when i get the point were is says to move the sift.cli.linux to the sift folder it says no such directory not sure what to do

[ekristen]

You aren't moving it to the SIFT folder, you are renaming sift-cli-linux from its current path to /usr/local/bin directory as sift. /usr/local/bin needs to exist, which by default it should.

[dheckart]

okay but the command you have in your instructions says v sift-cli-linux /usr/local/bin/sift witch tells me that i am moving it to a folder called sift

[ekristen]

@dheckart your understanding is only correct if the /usr/local/bin/sift directory already exists, which if it does, it means you've created it ahead of time (which was not in your shell history you provided me, nor is it in the instructions to create that directory.

The command mv sift-cli-linux /usr/local/bin/sift should be moving the file to the /usr/local/bin directory and renaming it to sift in the same operation.

[dheckart]

okay when i tried that command it did not rename anything it just kept giving me and error saying no such directory so maybe i am doing something wrong but i will go back and try again and send you the terminal commands in here

[ekristen]

Verify that /usr/local/bin is a directory. Verify that /usr/local/bin/sift does NOT exist in any form.

Then follow the instructions and all should work out just fine.

[dheckart]

I have and it does bot

Sent via the Samsung Galaxy S® 6, an AT&T 4G LTE smartphone

-------- Original message -------- From: Erik Kristensen notifications@github.com Date: 9/22/17 10:36 AM (GMT-05:00) To: sans-dfir/sift sift@noreply.github.com Cc: Deryl Heckart dheckart@arenewedmindservices.org, Mention mention@noreply.github.com Subject: Re: [sans-dfir/sift] not able to get the sift command to work (#183)

Verify that /usr/local/bin is a directory. Verify that /usr/local/bin/sift does NOT exist in any form.

Then follow the instructions and all should work out just fine.

- You are receiving this because you were mentioned. Reply to this email directly, view it on GitHubhttps://github.com/sans-dfir/sift/issues/183#issuecomment-331464895, or mute the threadhttps://github.com/notifications/unsubscribe-auth/AetOy_xEmSVq1RotbquJo12f6LbUn4-gks5sk8XcgaJpZM4PgsAN.

[dheckart]

not sure what i did different but no i have made it passed step 6

[dheckart]

okay now sift is installing hopefully all is going to work right now

[ekristen]

Great to hear. Have a great day.

[ragalasiva91]

I am getting below error while running command: gpg --verify sift-cli-linux.sha256.asc gpg: no valid OpenPGP data found. gpg: the signature could not be verified. Please remember that the signature file (.sig or .asc) should be the first file given on the command line. Can you help me on this?