Velociraptor Dead-Disk Forensics

The Problem (and the solution)

So you need to perform dead-disk forensics on a Windows host, but post acquisition (which may typically be preceded by access to the host (live) or via an offline-collector) you want to continue with your standard way of working.

I did too, and fortunately Velociraptor has the ability to emulate a live client from dead disk images, meaning we can simply point our instance to the physically acquired disk and perform the investigation as normal.

In this quick post, I intend to show the steps after you have acquired the image.

Before starting I'd recommend reading the below link; this covers this capability in a lot more detail than I'm providing here in this quick 101 - and it will help you understand the negatives.

https://docs.velociraptor.app/blog/2022/2022-03-22-deaddisk/

But what's most important to us for right now is:

Velociraptor currently supports the following 4 disk image formats via built-in accessors:

- EWF: Expert Witness Compression Format, sometimes called “E01 images”
- VMDK: virtual hard drive format introduced by VMware
- VHDX: virtual hard drive format introduced by Microsoft
- raw format: bit-by-bit copy of a hard drive, also know as “DD” or “flat” format

Practical Example

For this example, I've taken an image dump of my machine's C Drive (500gb) in .e01 format using FTK Imager. Note: With fragmentation set to 0.

FTK Destination Folder

Downloading and setting up Velociraptor

Head to: https://github.com/Velocidex/velociraptor/releases/tag/v0.74 and download the binary.

Create a directory for storing your config file, I've chosen to create one inside the same directory containing my image file as seen below - named temp

Directory example

Run the following command (relevant to your file names and directories of choice) to create the remapping config file.

Windows:
velociraptor-v0.74.2-windows-amd64.exe -v deaddisk --add_windows_disk D:\DISK_OUTPUT\c_out.E01 D:\DISK_OUTPUT\temp\remapping.yaml

Linux:
velociraptor-linux-amd64 -v deaddisk --add_windows_disk /disk/path.dd /tmp/remapping.yaml
As per the documentation you can review the outputs and config files.

Expected command output

It won't create the output directory for you.

Then start the Velociraptor instance with:

Windows:
velociraptor-v0.74.2-windows-amd64.exe --remap ..\DISK_OUTPUT\temp\remapping.yaml gui -v

Linux:
velociraptor-v0.6.4-linux-amd64 --remap /tmp/remapping.yaml gui -v

And now you should be able to see your disk inside Velociraptor.

Client Display

Results

So at this point, you're likely seeing a familiar face (or GUI), from here you can interact with the disk as if it were a system.

In case you're unfamiliar, hit enter inside the 'Search Clients' search bar and you should be presented with the clients screen.

And now we can run relevant hunts against said 'client'.

Hunts example

Additionally, as stated in the documentation and above, we can also review the file system in the VFS (alongside all other things Velociraptor :) )

VFS example