Do I need inbound SSH or a VPN to the target network?

No. Both sides dial out and a relay bridges NAT. The sshfs pattern needs inbound SSH, and Windows hosts do not run sshd by default.

Is this a replacement for forensic imaging?

No. Bit for bit imaging with a write blocker remains the standard for evidence intended for court. This is for triage, hunting, and analyst to analyst distribution.

Remote triage without a VPN

Q: What gets installed on the evidence machine?

One user space binary. The evidence side runs in no-FUSE mode, so the filesystem driver installs only on the analyst workstation, which is the side that mounts.

Q: Can the analyst write to the evidence tree?

On a read only share the origin refuses every write, delete, rename and attribute change arriving from the peer. The analyst mount can also be read only so tools fail fast with EROFS.

Mount the evidence. Move only what you extract.

By Marius-Florin Cristian · 18 August 2026

KEIBIDROP mounts a remote evidence share as a local folder. Reads pull only the bytes they touch, so a 500 GB tree can cost a 500 MB extract.

The evidence machine runs one user space binary. No FUSE, no WinFsp, no kernel driver, no reboot. The filesystem driver goes on the analyst workstation, which is the only side that mounts.

No inbound port on either side. Read only enforced at the source.

Built for the way triage already works

Your tools, unchanged

KAPE, YARA, grep, a hex editor. The mount is a path, so --tsource takes it directly.

No inbound port

Both sides dial out. No VPN to stand up, no firewall change, no sshd on the target.

Read only at the source

The origin refuses every write, delete, rename and attribute change from the peer.

Modes and times preserved

Permission bits, mtime and atime applied to the received file. Serving a read leaves the origin's access time as it was.

Driver on one side only

WinFsp, fuse3 or macFUSE on the analyst workstation. The evidence machine needs none of them.

Chunk-level resume

A dropped link picks up at the chunk it reached.

Against the usual options

	KEIBIDROP	sshfs	scp / rsync	Collector + SFTP
Needs inbound access	No	SSH	SSH	Usually
Works on a Windows target	Yes	Needs sshd	Needs sshd	Yes
Answer before the copy finishes	Yes	Yes	No	No
Second question costs nothing	Yes	Yes	New copy	New collection
Resume after a drop	Per chunk	Reconnects	Per file	Restarts
Read only enforced at source	Yes	Client flag	n/a	n/a
Runs on an appliance with no shell	No	Yes	Yes	No

Measured

Timisoara VPS reading a Singapore Windows Server, clean datacenter link, about 200 ms round trip.

Read path	Throughput	Trials
sshfs, 100 MB file	1.32 to 1.34 MB/s, median 1.33	n=10
sshfs, 1 GB file	1.33 MB/s	n=5
KEIBIDROP on demand, same link	20 to 30 MB/s

The sshfs rate holds at 1.33 MB/s at both file sizes. That is a latency bound: about 326 KB crosses per round trip whatever the file size.

On a 358 file, 43 MB triage tree over loopback: tree walk 33 ms, cold read of every file header 2.9 s, 310 file extract verified by hash against the source. Loopback shows the work per operation. A wide area link adds round trips to each one, and the byte count stays the same.

Limits

Scope is triage. Triage, hunting, and analyst to analyst distribution. Evidence intended for court still needs a bit for bit image.
Locked hives and shadow copies need a collector. Reads go through normal file APIs, so keep KAPE or CyLR on the box for those and move the output over the mount.
Appliances need a jump host. ESXi and network appliances run no new binaries. Mount the datastore on a Linux box you can run on, and share that out.
Custody recording stays your process. Verifiable here: byte exact transfer, sha256 both ends, origin enforced read only, and preserved mode, mtime and atime.
Birth time and change time stay local. Birth time crosses the wire and shows through the mount, though the copy on disk keeps its own. Change time is kernel-maintained everywhere.

Common questions

Do I need inbound SSH or a VPN?

No. Both sides dial out and a relay bridges NAT.

What gets installed on the evidence machine?

One user space binary, run and done.

Can the analyst write to the evidence tree?

On a read only share the origin refuses every write, delete and rename.

Does KAPE work against the mount?

Yes. Point --tsource at the mount and run it as usual.

Compared with sshfs · Share a folder read only · Install