search

quasar / Quasar

Remote Administration Tool for Windows
MIT License
8.35k stars 2.38k forks source link

Memory Capture / Remote Drive #1195

Open conorarmstrong opened 11 months ago

conorarmstrong commented 11 months ago

Problem description

There are a couple of digital forensic tools out there eg Encase that allow a remote memory dump and to image a remote drive.

Proposal

It would be good to add similar functionality to Quasar as there are no easy open source tools that allow these features, and very expensive paid products.
This would open the world of digital forensics to Quasar.

Additional context

No response

BurntDog commented 11 months ago

I can't se this being added do to security risk, but we'll have to wait and see.

conorarmstrong commented 11 months ago

I wouldn't imagine it would be any greater risk than what is already there. theoretically, something like winpmem could be uploaded and executed on the server/target to make an acquisition. it would just be very convenient to add to make this a type of core functionality. similarly to make a drive acquisition.

the usefulness of this utility would be greatly increased together with its standing in the industry by allowing easy forensic acquisitions of a machine for analysis.

currently, there are some commercial programs that provide this VERY basic type of functionality for pretty steep costs. a lot of the ancillary functionality is already present in this tool to make acquisitions a simple add on.