log2timeline / dftimewolf

A framework for orchestrating forensic collection, processing and data export
Apache License 2.0
296 stars 72 forks source link

gcp_turbinia_disk_copy_ts recipe "--create_analysis_vm" option #920

Open jkppr opened 1 month ago

jkppr commented 1 month ago

The --create_analysis_vm option for the gcp_turbinia_disk_copy_ts recipe does not work as expected.

The recipe lists --create_analysis_vm as an option with default value True. So I would expect the command dftimewolf gcp_turbinia_disk_copy_ts <source_project> <df_project> --turbinia_zone europe-west2-b --incident_id turbinia-vm1investigation --disks <disk> --create_analysis_vm False to work. However, I get an dftimewolf: error: unrecognized arguments: False error. Using the option as a bool flag like this: dftimewolf gcp_turbinia_disk_copy_ts <source_project> <df_project> --turbinia_zone europe-west2-b --incident_id turbinia-vm1investigation --disks <disk> --create_analysis_vm does not raise any error but still creates a new analysis VM.

I think creating the analysis VM by default makes sense, but it would be good to have the option to disable this function.