Comments (4)
Hi @boingomw,
This is a fantastic question! TL;DR you've already found the recommended solution
Why does it work?
It works because the -v
volume mount creates a link between the container and the host machine. If it's a folder then everything in the folder can be seen by the container while if it's a file then only that file can be seen. So the CDQR helper script does -v /tmp/cfreds_2015_data_leakage_pc.E01:/tmp/cfreds_2015_data_leakage_pc.E01
which is just the file but -v /tmp/:/tmp:
shares everything in the /tmp
folder.
I don't have all of the details but I can take a guess that there is more than one file in that disk image (E01, E02, E03, E0x, etc). The CDQR helper script makes the assumption that what is passed with in:<file or folder>
is a file or folder. Now this creates a problem for multiple file disk images as Plaso must be pointed at the first file in the chain, such as filename.E01
, for it to process it as a disk image but it is actually comprised of multiple files. If it is pointed at the folder then Plaso assumes it's not a disk image and does basic filestat information on each file in the folder (not really what is wanted in your case by any means but exactly how Plaso should behave). This results in the helper script not being able to handle the request in the way the user is would like.
ALL HOPE IS NOT LOST!
The CDQR helper scripts cannot account for every situation and the reason it prints the docker commands to stdout
is to enable everyone to learn how to use the aorlikoski/cdqr
docker image in more advanced ways by using the native docker commands when there is a situation it cannot handle.
I'm really happy to see that has helped get you to this point as learning how to use the Docker commands opens amazing and new ways to use aorlikoski/cdqr
. You've already found the solution I would recommend and it is something that can be turned into a custom script for personal use (or create a script for the community or add it into the helper script and file a PR to this repo to share with the community!). I'm all about supporting those who want to learn so please keep in touch and happy to help.
from skadi.
I also see that this was based off an example I have in the wiki. I'll take an action to go update that too. In the mean time try this wiki https://github.com/orlikoski/Skadi/wiki/Analyzing-Data-in-Three-Easy-Steps
from skadi.
@boingomw based off the info @orlikoski provided above did it answer your question? We will still work on getting that wiki updated.
Thanks
from skadi.
Yup. it helped, thanks.
from skadi.
Related Issues (20)
- Using CDQR Docker instead of cdqr.py HOT 2
- 100% Containers HOT 2
- Skadi 2019.2: Create OVA, Vagrant Box, and Sign Build Script HOT 1
- Add Threat Intell Component HOT 2
- Investigate Using Secured ELK stack HOT 1
- Store all configuration files in orchestration engine HOT 1
- Allow Console/shell access for Portainer HOT 1
- TimeSketch
- Using docker-compose, yeti-beat keep on exiting HOT 3
- Using cdqr in latest skadi OVA system can't see zip file HOT 2
- Configuring static ip address in the Skadi VM HOT 1
- Issues with cloning HOT 4
- Issue #124 still occurring
- Trouble converting zip file output to csv
- Update Secure Networking Add-on pack HOT 2
- Ubuntu Build Script Fails to Generate Passwords HOT 10
- Make ES Heap Size ENV Var HOT 2
- CyLR fails to load shared libraries when run from a compute engine HOT 1
- Update Build to use Python 3 for TimeSketch
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from skadi.