snap4n6 0.4.1

Rebuild Elastic Block Storage (EBS) direct API blocks into a DD forensic image generated by Snap4n6 Serverless Imager.

Snap4n6 CLI

Rebuild Elastic Block Storage (EBS) direct API blocks into a DD forensic image generated by Snap4n6 Serverless Imager.

Permissions

• s3:GetBucketLocation
• s3:GetObject
• s3:ListBucket
• ssm:GetParameter

Installation

pip install snap4n6

Help

Snap4n6 v0.4.0

optional arguments:
  -h, --help       show this help message and exit

Required:
  --region REGION  us-east-2
  --snapid SNAPID  snap-0f3e60199f11889da

Optional:
  --ext4           Rebuild EXT4 File System

Command

Microsoft Windows Snapshots contain the NTFS File System necessary to rebuild a forensic image.

Linux Snapshots require the creation of Superblocks for the EXT4 File System using: mkfs.ext4

snap4n6 --region us-east-2 --snapid snap-0f3e60199f11889da --ext4

Output

Snap4n6 v0.4.0


Region:         us-east-2
Snapshot:       snap-0f3e60199f11889da
Ext4 Fs:        True

0+0 records in
0+0 records out
0 bytes (0 B) copied, 0.000209499 s, 0.0 kB/s
mke2fs 1.42.9 (28-Dec-2013)
snap-0f3e60199f11889da.dd is not a block special device.
Proceed anyway? (y,n) Discarding device blocks: done                            
Filesystem label=
OS type: Linux
Block size=4096 (log=2)
Fragment size=4096 (log=2)
Stride=0 blocks, Stripe width=0 blocks
65536 inodes, 262144 blocks
13107 blocks (5.00%) reserved for the super user
First data block=0
Maximum filesystem blocks=268435456
8 block groups
32768 blocks per group, 32768 fragments per group
8192 inodes per group
Superblock backups stored on blocks: 
        32768, 98304, 163840, 229376

Allocating group tables: done                            
Writing inode tables: done                            
Creating journal (8192 blocks): done
Writing superblocks and filesystem accounting information: done

  4%|██▌                       | 4/104 [00:05<02:07,  1.28s/it]

Local Development

$ python setup.py install --user

Alternatives

• aws-snap-io - https://github.com/forensicmatt/aws-snap-io
• coldsnap - https://github.com/awslabs/coldsnap