diff --git a/src/generic-methodologies-and-resources/basic-forensic-methodology/image-acquisition-and-mount.md b/src/generic-methodologies-and-resources/basic-forensic-methodology/image-acquisition-and-mount.md index 5a059c8bf..eb4ae6b6e 100644 --- a/src/generic-methodologies-and-resources/basic-forensic-methodology/image-acquisition-and-mount.md +++ b/src/generic-methodologies-and-resources/basic-forensic-methodology/image-acquisition-and-mount.md @@ -58,7 +58,9 @@ sudo ewfacquire /dev/sdb -u evidence -c 1 -d "Seizure 2025-07-22" -e 1 -X examin aws ec2 create-snapshot --volume-id vol-01234567 --description "IR-case-1234 web-server 2025-07-22" # Copy the snapshot to S3 and download with aws cli / aws snowball ``` -*Azure* – 使用 `az snapshot create` 并导出到 SAS URL。请参见 HackTricks 页面 {{#ref}} +*Azure* – 使用 `az snapshot create` 并导出到 SAS URL。请参阅 HackTricks 的页面: + +{{#ref}} ../../cloud/azure/azure-forensics.md {{#endref}} @@ -143,7 +145,7 @@ kpartx -dv /dev/loop0 # or qemu-nbd --disconnect /dev/nbd0 ``` ## 参考 -- AFF4 成像工具公告与规格: https://github.com/aff4/aff4 +- AFF4 成像工具公告与规范: https://github.com/aff4/aff4 - qemu-nbd 手册页(安全挂载磁盘映像): https://manpages.debian.org/qemu-system-common/qemu-nbd.1.en.html {{#include ../../banners/hacktricks-training.md}}