Triage a remote machine without a VPN
A computer somewhere else on the internet holds files you need to look at. Today that usually means one of two things. Somebody arranges a VPN into that network, which takes days and a change request. Or somebody copies the whole disk out and sends it over, which starts a transfer with an ETA measured in hours. Either way, you wait before you can look at anything.
With KEIBIDROP, the folder on that computer shows up on yours as a normal folder. You can browse it, search it, and copy out the files you want. Only the bytes you actually read travel across the link.
What this looks like in practice
$ ls K:\host1\Windows\System32\winevt\Logs
Application.evtx Security.evtx System.evtx ...
$ grep -rl "ATTACKER-IOC" K:\host1\inetpub\logs
K:\host1\inetpub\logs\LogFiles\W3SVC1\u_ex260715_042.log
$ robocopy K:\host1\Windows\System32\config C:\evidence\config /E
These are all commands an examiner already runs every day. KAPE accepts the mount with --tsource and needs no changes to work with it. The mount behaves like a real filesystem, so there is nothing to import and no new application to learn.
You see the whole folder before any file content moves
The file listing is sent first, and it is small. It costs about 73 bytes for each file, so a folder holding 10,000 files announces itself in about 732 KB. That measurement took 116 ms, on a loopback pair with both programs running in one process. Over a real network link, add roughly one round trip for every 256 files. The cost per file stays the same.
This is what lets you look before you fetch. You can see everything that is there, and then decide which files are worth opening. On a link with 17 ms of round trip time, opening a file from the mount took between 30 and 40 ms.
Read only is enforced on the computer holding the files
Turn on share_read_only there and it refuses every write coming from the other side, before anything reaches the disk.
This setting works even with the filesystem driver switched off. That matters here, because it means the computer holding the files runs one ordinary program in user space. There is no kernel driver to install on it, and no reboot.
On the receiving side, turn on preserve_metadata and the files you copy out keep the permission bits, modification time and access time they had on the source.
| Attribute | What happens to it |
|---|---|
| Permission bits | Applied to the file you receive |
| Modification time | Applied to the file you receive |
| Access time | Applied. On Linux and Windows, serving a read leaves the access time on the source alone |
| Birth time | Travels across the link and is visible through the mount. Most systems do not allow writing it to disk |
| Change time | The kernel maintains this one. No tool can set it |
The access time row works differently on macOS, which has no per-handle equivalent of the Linux O_NOATIME flag. There the volume decides, so it depends on how the volume was mounted. We measured this and wrote up the mount option that keeps access times unchanged.
Neither side needs an inbound port
Both computers connect outbound and find each other that way. You do not have to open a port on the firewall in front of the source, and you do not have to install an SSH server on a Windows host. When there is no direct path between the two, the traffic goes through a relay instead. The relay cannot read any of it, because the session is encrypted end to end.
What this is built for
This is a tool for triage, and for passing evidence between analysts. Forensic imaging is a different job and it stays with the tools that do it. Locked registry hives and Volume Shadow Copies need raw NTFS reads, so the collectors that run on the machine itself still handle those.
Appliances are a separate case. ESXi and network gear will not run a new program at all. To reach one of those, mount its datastore on a Linux host where you can run software, and share that folder instead.
Requirements
The mount uses FUSE, and it goes on the analyst's computer. On Windows, install WinFsp. On macOS, install macFUSE. On Linux, libfuse3 is usually there already. The computer holding the files needs none of it.