Avi's blog

 Avoiding duplicate lvm name issues.  Scenario : Let's say 5-10 systems are compromised and all of those systems are spawned up from a pre-configured template i.e. AMI - amazon machine image. Using that you can launch new EC2 instance.  Template‑এ থাকে: OS (Linux/Windows) Pre‑installed packages Configuration settings Now when you try to bring all the images of those host machines and try to mount on your analyst vm, it will refuse to work due to same lvm group name, uuid etc. We are here to fix that problem.  First note the checksum: host1/disk1.raw and  host1/disk1.raw --> We have this directory structure where images are present.  md5sum host*/* e3b85cad126731e76955b2240b69f39d  host1/disk1.raw e3b85cad126731e76955b2240b69f39d  host2/disk1.raw You can see that the checksum is same.  Pre-requisite necessary tool installation: apt install xmount Step 1 — দুইটার জন্যই xmount cache + loopback সেটআপ: mkdir -p /mnt/host1/xmount/disk1 mkdir -...

 Before starting this lab, we need to first mount the image. See my this blog: https://mahimfiroj.blogspot.com/2026/08/disk-acquisition-and-access.html Step 1: Creating working directories. mkdir -p /images/case cd /images/case Now you need to confirm that the image is already mounted. See the above blog post. Step 2: Creating body files. fls is a tool from sleuthkit.  apt install sleuthkit -y Root filesystem (LVM): fls -r -m / /dev/VulnOSv2-vg/root | gzip > bodyfile-root.gz Boot / other raw partitions (offset required): fls -r -m /boot -o 2048 /mnt/case/img/ewf1 | gzip > bodyfile-boot.gz -r for recursive and -m for mount point, -o for offset. gz is done to save the space. Step 3: Building filtered timeline. zcat bodyfile-* | mactime -d <YYYY-MM-DD> | grep -v deleted-realloc > timeline.csv wc -l timeline.csv 3327 timeline.csv Another Way of doing this: fls -r  -m "/" /media/Avi/USB/yamato.raw > timeline.body (This file name and extension does not need t...

 Goal for this lab is after we acquire the disk in .E01 format then how can we mount this to linux system for analysis.  দুইটা scenario cover করছি: (A) simple E01 + LVM (single disk), (B) E01 + Software RAID + LVM (multi-disk, যেমন disk1/disk2) From the linux analysis vm like sansforensic vm, you need to run the following commands.  We need to first create the working directories : mkdir -p /mnt/case/img /mnt/case/data E01 + LVM (single disk) - First case. Step 1 — E01 mount: ewfmount Webserver.E01 /mnt/case/img ls -lh  /mnt/case/img total 0  -r--r--r-- 1 root root 32G Feb 16 18:21 ewf1 Ewf1 is a raw disk image. It's size and main disk size are same. This is in read-only mode. See the permission. Step 2 — See the partition layout : mmls /mnt/case/img/ewf1 কোন offset-এ কোন partition আছে (boot, lvm ইত্যাদি) note করুন। RAID sign ( 0xfd ) আছে কিনা খেয়াল করুন — থাকলে Scenario B তে যান। lvscan | grep VulnOSv2-vg mount -o ro,noexec /dev/VulnOSv2-vg/root /mnt/case/dat...