From d66eff6637c2f25deba3661e7555b2cd4bc767ab Mon Sep 17 00:00:00 2001 From: Translator Date: Tue, 19 Aug 2025 15:50:18 +0000 Subject: [PATCH] Translated ['src/generic-methodologies-and-resources/basic-forensic-meth --- .../image-acquisition-and-mount.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/generic-methodologies-and-resources/basic-forensic-methodology/image-acquisition-and-mount.md b/src/generic-methodologies-and-resources/basic-forensic-methodology/image-acquisition-and-mount.md index 5a059c8bf..eb4ae6b6e 100644 --- a/src/generic-methodologies-and-resources/basic-forensic-methodology/image-acquisition-and-mount.md +++ b/src/generic-methodologies-and-resources/basic-forensic-methodology/image-acquisition-and-mount.md @@ -58,7 +58,9 @@ sudo ewfacquire /dev/sdb -u evidence -c 1 -d "Seizure 2025-07-22" -e 1 -X examin aws ec2 create-snapshot --volume-id vol-01234567 --description "IR-case-1234 web-server 2025-07-22" # Copy the snapshot to S3 and download with aws cli / aws snowball ``` -*Azure* – 使用 `az snapshot create` 并导出到 SAS URL。请参见 HackTricks 页面 {{#ref}} +*Azure* – 使用 `az snapshot create` 并导出到 SAS URL。请参阅 HackTricks 的页面： + +{{#ref}} ../../cloud/azure/azure-forensics.md {{#endref}} @@ -143,7 +145,7 @@ kpartx -dv /dev/loop0 # or qemu-nbd --disconnect /dev/nbd0 ``` ## 参考 -- AFF4 成像工具公告与规格: https://github.com/aff4/aff4 +- AFF4 成像工具公告与规范: https://github.com/aff4/aff4 - qemu-nbd 手册页（安全挂载磁盘映像）: https://manpages.debian.org/qemu-system-common/qemu-nbd.1.en.html {{#include ../../banners/hacktricks-training.md}}