Portable Collection...
 
Notifications
Clear all

Portable Collection Tools for Targeted Logical Acquisitions on a WinPE Boot Stick

thegrandmadness
(@thegrandmadness)
New Member

I've been trawling the net for weeks now trying to find something to fit this particular collection profile but so far, coming up pretty short.

In summary, I'm looking for a tool that I can stage on a WinPE boot drive and create locked down collection profiles for a full forensic E01 AND a logical targeted collection with some specific parameters included.

The logical collection profile ideally would give me the option to exclude either / or file types and folder paths. e.g. I want to collect everything EXCEPT say .dll .log files and exclude the Windows directory entirely.

NUIX Collector has some functionality to allow that by recoding the XML job file that it spits out but other than that I've not seen anything else remotely close to it.

OSForensics has an option to create a USB key and might allow me to pass it certain exclusion based conditions via some creative Python scripts but its a long way off from what I was looking for if I can help it.

Anyone know of any tools that allow that sort of functionality?

TIA

Andy

Quote
Topic starter Posted : 09/08/2021 6:59 pm
ThePM
(@thepm)
Active Member

You should take a look at KAPE. I'm still learning about it, but from what I've seen in my SANS FOR500 class, it looks pretty awesome for targeted collection.

ReplyQuote
Posted : 09/08/2021 8:09 pm
Sunnych
(@sunnych)
New Member

there is such an old but working project

MistyPE (mistyprojects.co.uk)

experimentally selected the latest distribution on which the entire assembly is correctly assembled - "Windows 10 Version 1709 Redstone3 build 16299" x32

and inside you will collect with X-WAYS Forensics, if you have one, but maybe it will give a new direction for thinking

ReplyQuote
Posted : 10/08/2021 12:56 pm
Bunnysniper
(@bunnysniper)
Active Member

You can make your very own Windows PE and put in what you like. This article (written by me) is > 4 years old, but still valid. Only version numbers changed. Last time I made such a Forensic PE for myself was last year - and it works smoothly.

Windows 10 PE for Digital Forensics - Forensic Focus

regards,

Robin

ReplyQuote
Posted : 11/08/2021 10:31 am
thommyy
(@thommyy)
New Member

Have you looked at Rocket? www.rocketdatacollections.com

ReplyQuote
Posted : 17/08/2021 5:12 pm
Share: