Avi's blog

 Before starting this lab, we need to first mount the image. See my this blog: https://mahimfiroj.blogspot.com/2026/08/disk-acquisition-and-access.html Step 1: Creating working directories. mkdir -p /images/case cd /images/case Now you need to confirm that the image is already mounted. See the above blog post. Step 2: Creating body files. Root filesystem (LVM): fls -r -m / /dev/VulnOSv2-vg/root | gzip > bodyfile-root.gz Boot / other raw partitions (offset required): fls -r -m /boot -o 2048 /mnt/case/img/ewf1 | gzip > bodyfile-boot.gz -r for recursive and -m for mount point, -o for offset. gz is done to save the space. Step 3: Building filtered timeline. zcat bodyfile-* | mactime -d <YYYY-MM-DD> | grep -v deleted-realloc > timeline.csv wc -l timeline.csv 3327 timeline.csv Avi

 Goal for this lab is after we acquire the disk in .E01 format then how can we mount this to linux system for analysis.  দুইটা scenario cover করছি: (A) simple E01 + LVM (single disk), (B) E01 + Software RAID + LVM (multi-disk, যেমন disk1/disk2) From the linux analysis vm like sansforensic vm, you need to run the following commands.  We need to first create the working directories : mkdir -p /mnt/case/img /mnt/case/data E01 + LVM (single disk) - First case. Step 1 — E01 mount: ewfmount Webserver.E01 /mnt/case/img ls -lh  /mnt/case/img total 0  -r--r--r-- 1 root root 32G Feb 16 18:21 ewf1 Ewf1 is a raw disk image. It's size and main disk size are same. This is in read-only mode. See the permission. Step 2 — See the partition layout : mmls /mnt/case/img/ewf1 কোন offset-এ কোন partition আছে (boot, lvm ইত্যাদি) note করুন। RAID sign ( 0xfd ) আছে কিনা খেয়াল করুন — থাকলে Scenario B তে যান। lvscan | grep VulnOSv2-vg mount -o ro,noexec /dev/VulnOSv2-vg/root /mnt/case/dat...

 We will see how we can take forensic images in different format of windows and linux system.  The reason of taking image is we cannot work on the system where malicious activity has happened. We may inadvertently spoil the evidence. Also for team distribution work, we need multiple copies of images for collaboration.  One option is if the machine is physical/virtual windows --> We can use Microsoft's Sysinternal's tool Disk2vhd. Using this tool we can take vhd or vhdx format image. We can take C drive or whole drive image.  For Hyper-V VM --> Shutdown the VM then go to the VM folder to collect .vhdx forensic copy of the hard drive. After taking snapshot you can export VHDX.  For VMware VM --> Native disk format is vmdk. You can use StarWind V2V converter to convert vmdk file to vhd/vhdx. You can also use qemu-img tool to convert the same. qemu-img convert -O vpc disk.vmdk disk.vhd VirtualBox --> VBoxManage clonehd disk.vdi disk.vhd --format VHD Fo...

 Making volatility 3 profile - 20/08/2026 Let's assume we are dealing with the compromised system.  We first need to find the debugging kernel. This kernel had must been compiled with debugging symbols (volatility 3 need these to find out info) and after compilation, it should not be stripped. Please note, due to the huge size of this file, these are not generally comes now with the OS. On the compromised system run this command: find / -name vmlinu\* -size +100M 2>/dev/null You may get the following: /usr/lib/debug/boot/vmlinux-5.10.0-21-amd64  --> If you find this then this means it is the debugging version.  /boot/vmlinuz-5.10.0-21-amd64 --> and if you find this then it is kernel version file /usr/lib/debug/boot/vmlinux-5.10.0-21-amd64   /usr/lib/debug/boot/vmlinux-5.10.0-21-amd64: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, BuildID[sha1]=5e5d3209033f927baa64…,  with debug_info, not stripped --> This on...