maride/hacktricks
1
0
Fork 0
mirror of https://github.com/HackTricks-wiki/hacktricks.git synced 2025-10-10 18:36:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

Translated ['src/generic-methodologies-and-resources/basic-forensic-meth

Browse Source
This commit is contained in:
Translator 2025-08-19 16:58:30 +00:00
parent 716938f680
commit 2a56c51d93
1 changed files with 6 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
src/generic-methodologies-and-resources/basic-forensic-methodology/image-acquisition-and-mount.md
View File

@ -58,12 +58,7 @@ sudo ewfacquire /dev/sdb -u evidence -c 1 -d "Seizure 2025-07-22" -e 1 -X examin
aws ec2 create-snapshot --volume-id vol-01234567 --description "IR-case-1234 web-server 2025-07-22" aws ec2 create-snapshot --volume-id vol-01234567 --description "IR-case-1234 web-server 2025-07-22"
# Copy the snapshot to S3 and download with aws cli / aws snowball # Copy the snapshot to S3 and download with aws cli / aws snowball
``` ```
*Azure* – tumia `az snapshot create` na uhamasishaji kwa URL ya SAS. Tazama ukurasa kutoka HackTricks: *Azure* – tumia `az snapshot create` na uhamasisha kwa URL ya SAS.
{{#ref}}
../../cloud/azure/azure-forensics.md
{{#endref}}
## Mount ## Mount
@ -128,13 +123,13 @@ sudo mount -o ro /mnt/bitlocker/dislocker-file /mnt/evidence
sudo kpartx -av disk.img # creates /dev/mapper/loop0p1, loop0p2 … sudo kpartx -av disk.img # creates /dev/mapper/loop0p1, loop0p2 …
mount -o ro /dev/mapper/loop0p2 /mnt mount -o ro /dev/mapper/loop0p2 /mnt
``` ```
### Makosa ya kawaida ya kuunganisha & suluhisho ### Makosa ya kawaida ya kuunganisha & marekebisho
| Kosa | Sababu ya Kawaida | Suluhisho | | Kosa | Sababu ya Kawaida | Marekebisho |
|-------|---------------|-----| |-------|---------------|-----|
| `cannot mount /dev/loop0 read-only` | FS iliyoandikwa (ext4) haijafungwa vizuri | tumia `-o ro,norecovery` | | `cannot mount /dev/loop0 read-only` | FS iliyorekodiwa (ext4) haijafungwa kwa usahihi | tumia `-o ro,norecovery` |
| `bad superblock …` | Offset mbaya au FS iliyoharibika | hesabu offset (`sector*size`) au endesha `fsck -n` kwenye nakala | | `bad superblock …` | Offset mbaya au FS iliyoharibika | hesabu offset (`sector*size`) au endesha `fsck -n` kwenye nakala |
| `mount: unknown filesystem type 'LVM2_member'` | Kontena la LVM | aktivisha kundi la volumu kwa `vgchange -ay` | | `mount: unknown filesystem type 'LVM2_member'` | Kontena la LVM | aktivisha kundi la kiasi kwa `vgchange -ay` |
### Safisha ### Safisha
@ -145,7 +140,7 @@ kpartx -dv /dev/loop0 # or qemu-nbd --disconnect /dev/nbd0
``` ```
## Marejeo ## Marejeo
- Tangazo la chombo cha picha za AFF4 & maelezo: https://github.com/aff4/aff4 - Tangazo la chombo cha picha za AFF4 & spesifikesheni: https://github.com/aff4/aff4
- Ukurasa wa mwongozo wa qemu-nbd (kuweka picha za diski kwa usalama): https://manpages.debian.org/qemu-system-common/qemu-nbd.1.en.html - Ukurasa wa mwongozo wa qemu-nbd (kuweka picha za diski kwa usalama): https://manpages.debian.org/qemu-system-common/qemu-nbd.1.en.html
{{#include ../../banners/hacktricks-training.md}} {{#include ../../banners/hacktricks-training.md}}