google / google/cloud-forensics-utils
Ability to create traditional forensic images
Open
AWS
- Dominant language
- Python
- Stars
- 507
- Forks
- 93
- Avg merge
- 10m
- Merged PRs (30d)
- 2
Description
The current code/examples stop at attaching volumes to forensic instances. Since not all forensicators would be analyzing the attached volumes from within the forensic instances, having the ability to create a traditional forensic image (e.g. via `dd` , `ewfacquire` etc.) would be valuable.
There're some obvious limitations to this approach (e.g. inability to automount some attached volumes) but any help in being able to automatically handle some % of the use cases would be beneficial.
Regarding AWS, a typical scenario would be to image said attached volume then copy it to an S3 bucket, which would require #135
Contributor guide
Assessment
This issue has not been assessed yet.