Loading...

A tool to quickly gather forensic artifacts from disk images or a live system into a lightweight container, aiding in digital forensic triage.

A tool to quickly gather forensic artifacts from disk images or a live system into a lightweight container, aiding in digital forensic triage.
Acquire is a tool to quickly gather forensic artifacts from disk images or a live system into a lightweight container. This makes acquire an excellent tool to, among others, speedup the process of digital forensic triage. It uses dissect to gather that information from the raw disk, if possible. Acquire gathers artifacts based on modules. These modules are paths or globs on a filesystem which acquire attempts to gather. Multiple modules can be executed at once, which have been collected together inside a profile. These profiles (used with --profile) are full, default, minimal, and none. Depending on what operating system gets detected, different artifacts are collected. The most basic usage of acquire is as follows: user@dissect~$ sudo acquire. The tool requires administrative access to read raw disk data instead of using the operating system for file access. However, there are some options available to use the operating system as a fallback option (e.g., --fallback or --force-fallback). For more information, please see the documentation. Requirements: This project is part of the Dissect framework and requires Python. Information on the supported Python versions can be found in the documentation.
Common questions about Acquire including features, pricing, alternatives, and user reviews.
Acquire is A tool to quickly gather forensic artifacts from disk images or a live system into a lightweight container, aiding in digital forensic triage.. It is a Security Operations solution designed to help security teams with Disk Image.
A read-only FUSE driver that enables Linux systems to mount and access Apple File System (APFS) volumes, including encrypted and fusion drives.
A library for read-only access to QEMU Copy-On-Write (QCOW) image files, supporting multiple versions and compression formats for digital forensics analysis.
DMG2IMG converts Apple compressed DMG archives to standard HFS+ image files supporting zlib, bzip2, and LZFSE compression formats.
Get strategic cybersecurity insights in your inbox