google / google/cloud-forensics-utils

Ability to create traditional forensic images

Open
#147 1 comment 0 reactions 0 assignees View on GitHub
AWS
Dominant language
Python
Stars
507
Forks
93
Avg merge
10m
Merged PRs (30d)
2

Description

The current code/examples stop at attaching volumes to forensic instances. Since not all forensicators would be analyzing the attached volumes from within the forensic instances, having the ability to create a traditional forensic image (e.g. via `dd` , `ewfacquire` etc.) would be valuable.

There're some obvious limitations to this approach (e.g. inability to automount some attached volumes) but any help in being able to automatically handle some % of the use cases would be beneficial.

Regarding AWS, a typical scenario would be to image said attached volume then copy it to an S3 bucket, which would require #135

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.