What is Acquire
A digital artifact extraction framework for extracting data from volatile memory (RAM) samples, providing visibility into the runtime state of a system.
Acquire: A Tool for Collecting Forensic Artifacts Efficiently
Acquire is a specialized tool that enables the rapid collection of forensic artifacts from disk images or live systems. It efficiently stores these artifacts in a lightweight container, facilitating easy access and analysis.
This makes Acquire an excellent tool for digital forensic triage
This makes Acquire an excellent tool for various purposes, including speeding up the process of digital forensic triage.
It uses dissect to gather information from raw disk data
It utilizes dissect to extract information from the raw disk whenever feasible. Acquire collects artifacts based on specific modules.
Understanding Module Paths and Profiles in Filesystems
These modules represent paths or globs within a filesystem that acquisition attempts are designed to gather. Multiple modules can be executed at the same time, and these modules are grouped together within a profile.
Understanding the Various Profiles Associated with --profile
The profiles associated with --profile include full, default, minimal, and none. Depending on the operating system that is detected, different artifacts are collected accordingly.
Basic Usage of the Acquire Command
To use the acquire command in its most straightforward form, type the following in your terminal: user@dissect~$ sudo acquire
The tool needs administrative access to operate correctly
The tool needs administrative access to directly read raw disk data instead of depending on the operating system for file access.
Alternative Options for Operating System Use
There are several options available to use the operating system as a backup solution. For instance, you can utilize the commands --fallback or --force-fallback.
For Additional Information, Please Refer to the Documentation
For additional information, please refer to the documentation for further insights and details.
Project Requirements Overview
This project is a part of the Dissect framework and requires the use of Python. For details about the supported Python versions, please refer to the documentation.
Acquire Reviews
No reviews yet.
