Memory Capture / Remote Drive

[conorarmstrong]

Problem description

There are a couple of digital forensic tools out there eg Encase that allow a remote memory dump and to image a remote drive.

Proposal

It would be good to add similar functionality to Quasar as there are no easy open source tools that allow these features, and very expensive paid products.
This would open the world of digital forensics to Quasar.

Additional context

No response

[BurntDog]

I can't se this being added do to security risk, but we'll have to wait and see.

[conorarmstrong]

I wouldn't imagine it would be any greater risk than what is already there. theoretically, something like winpmem could be uploaded and executed on the server/target to make an acquisition. it would just be very convenient to add to make this a type of core functionality. similarly to make a drive acquisition.

the usefulness of this utility would be greatly increased together with its standing in the industry by allowing easy forensic acquisitions of a machine for analysis.

currently, there are some commercial programs that provide this VERY basic type of functionality for pretty steep costs. a lot of the ancillary functionality is already present in this tool to make acquisitions a simple add on.