maride/hacktricks
1
0
Fork 0
mirror of https://github.com/HackTricks-wiki/hacktricks.git synced 2025-10-10 18:36:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

Translated ['src/generic-methodologies-and-resources/basic-forensic-meth

Browse Source
This commit is contained in:
Translator 2025-08-19 17:02:54 +00:00
parent ef0e6da05e
commit 0e05199a09
1 changed files with 4 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
src/generic-methodologies-and-resources/basic-forensic-methodology/image-acquisition-and-mount.md
View File

@ -1,4 +1,4 @@
# Aquisição e Montagem de Imagem # Aquisição de Imagem & Montagem
{{#include ../../banners/hacktricks-training.md}} {{#include ../../banners/hacktricks-training.md}}
@ -40,7 +40,7 @@ sudo aff4imager acquire /dev/nvme0n1 /evidence/nvme.aff4 --hash sha256
# Velociraptor can also acquire AFF4 images remotely # Velociraptor can also acquire AFF4 images remotely
velociraptor --config server.yaml frontend collect --artifact Windows.Disk.Acquire --args device="\\.\\PhysicalDrive0" format=AFF4 velociraptor --config server.yaml frontend collect --artifact Windows.Disk.Acquire --args device="\\.\\PhysicalDrive0" format=AFF4
``` ```
### FTK Imager (Windows e Linux) ### FTK Imager (Windows & Linux)
Você pode [baixar o FTK Imager](https://accessdata.com/product-download) e criar imagens **raw, E01 ou AFF4**: Você pode [baixar o FTK Imager](https://accessdata.com/product-download) e criar imagens **raw, E01 ou AFF4**:
```bash ```bash
@ -58,12 +58,7 @@ sudo ewfacquire /dev/sdb -u evidence -c 1 -d "Seizure 2025-07-22" -e 1 -X examin
aws ec2 create-snapshot --volume-id vol-01234567 --description "IR-case-1234 web-server 2025-07-22" aws ec2 create-snapshot --volume-id vol-01234567 --description "IR-case-1234 web-server 2025-07-22"
# Copy the snapshot to S3 and download with aws cli / aws snowball # Copy the snapshot to S3 and download with aws cli / aws snowball
``` ```
*Azure* – use `az snapshot create` e exporte para uma URL SAS. Veja a página do HackTricks: *Azure* – use `az snapshot create` e exporte para uma URL SAS.
{{#ref}}
../../cloud/azure/azure-forensics.md
{{#endref}}
## Montar ## Montar
@ -128,7 +123,7 @@ sudo mount -o ro /mnt/bitlocker/dislocker-file /mnt/evidence
sudo kpartx -av disk.img # creates /dev/mapper/loop0p1, loop0p2 … sudo kpartx -av disk.img # creates /dev/mapper/loop0p1, loop0p2 …
mount -o ro /dev/mapper/loop0p2 /mnt mount -o ro /dev/mapper/loop0p2 /mnt
``` ```
### Erros comuns de montagem & correções ### Erros comuns de montagem e correções
| Erro | Causa Típica | Correção | | Erro | Causa Típica | Correção |
|-------|---------------|-----| |-------|---------------|-----|