A computer somewhere else on the internet holds files you need to look at. Today that usually means one of two things. Somebody arranges a VPN into that network, which takes days and a change request. Or somebody copies the whole disk out and sends it over, which starts a transfer with an ETA measured in hours. Either way, you wait before you can look at anything.
With KeibiDrop, the folder on that computer shows up on yours as a normal folder. You can browse it, search it, and copy out the files you want. Only the bytes you actually read travel across the link.
This is what it looks like in a terminal
$ ls K:\host1\Windows\System32\winevt\Logs
Application.evtx Security.evtx System.evtx ...
$ grep -rl "ATTACKER-IOC" K:\host1\inetpub\logs
K:\host1\inetpub\logs\LogFiles\W3SVC1\u_ex260715_042.log
$ robocopy K:\host1\Windows\System32\config C:\evidence\config /E
These are all commands an examiner already runs every day. KAPE accepts the mount with --tsource and needs no changes to work with it. The mount behaves like a real filesystem, so there is nothing to import and no new application to learn.
The video is one run from beginning to end, and none of the commands are cut out of it.
A Mac is holding 2,683 files that come to 19.9 GB, and a Windows laptop mounts that folder read only. You can watch the tree get listed, then a grep go through every log in it, then robocopy pull out the artifact set, and at the end both machines hash the same two registry hives and compare them.
Over the whole session, 606 MB crossed the link against the 19.9 GB that was sitting on the Mac, which works out at 34 times less data. We take that 606 MB off the network card, so it includes the grep, which had to read every log in the tree to answer the question. The artifacts that ended up on disk came to 382 MB. Both machines were in the same apartment in Bucharest on one Vodafone line that gives 498 Mbps down and 50 Mbps up at 27 ms, and the traffic was relayed through Timisoara and back, so the two of them were sharing the same uplink the whole time. The hashes matched on both sides, nothing on the Mac changed, and the access times stayed where they were.
Do not read the clock in that video as a speed you would get. Pulling the artifact set took just over seven minutes, and it was slow because there were 2,174 separate files in it and every one of them waited for its own round trip to Timisoara and back. We have rewritten that part since the recording, and there is a write-up with the measurements. The evidence tree you see was generated for the demo, so the file names look right and a real parser rejects the contents.
You see the whole folder before any file content moves
The file listing is sent first, and it is small. It costs about 73 bytes for each file, so a folder holding 10,000 files announces itself in about 732 KB. That measurement took 116 ms, on a loopback pair with both programs running in one process. Over a real network link, add roughly one round trip for every 256 files. The cost per file stays the same.
This is what lets you look before you fetch. You can see everything that is there, and then decide which files are worth opening. On a link with 17 ms of round trip time, opening a file from the mount took between 30 and 40 ms.
Read only is enforced on the computer holding the files
Turn on share_read_only there and it refuses every write coming from the other side, before anything reaches the disk.
This setting works even with the filesystem driver switched off. That matters here, because it means the computer holding the files runs one ordinary program in user space. There is no kernel driver to install on it, and no reboot.
On the receiving side, turn on preserve_metadata and the files you copy out keep the permission bits, modification time and access time they had on the source.
| Attribute | What happens to it |
|---|---|
| Permission bits | Applied to the file you receive |
| Modification time | Applied to the file you receive |
| Access time | Applied. On Linux and Windows, serving a read leaves the access time on the source alone |
| Birth time | Travels across the link and is visible through the mount. Most systems do not allow writing it to disk |
| Change time | The kernel maintains this one. No tool can set it |
The access time row works differently on macOS, which has no per-handle equivalent of the Linux O_NOATIME flag. There the volume decides, so it depends on how the volume was mounted. We measured this and wrote up the mount option that keeps access times unchanged.
Neither side needs an inbound port
Both computers connect outbound and find each other that way. You do not have to open a port on the firewall in front of the source, and you do not have to install an SSH server on a Windows host. When there is no direct path between the two, the traffic goes through a relay instead. The relay cannot read any of it, because the session is encrypted end to end.
We built this for triage and for passing evidence between analysts
Forensic imaging is a different job and it stays with the tools that do it. Locked registry hives and Volume Shadow Copies need raw NTFS reads, so the collectors that run on the machine itself still handle those.
Appliances are a separate case. ESXi and network gear will not run a new program at all. To reach one of those, mount its datastore on a Linux host where you can run software, and share that folder instead.
This needs a FUSE driver on the machine doing the reading
The mount uses FUSE, and it goes on the analyst's computer. Install WinFsp on Windows or macFUSE on macOS, and on Linux libfuse3 is usually there already. The computer holding the files needs none of it.
I build KeibiDrop, so read the numbers with that in mind. It is open source and the measurements above are reproducible.
Remote triage guide · Compared with sshfs · Install guide · Source
Top comments (0)