Example: qcow-forensic

• Inputs
• Profile
• Report outputs
  • Triage report (converted from triage_report.json)
  • CSV outputs
    • errors.csv
    • files.csv
    • pattern_matches.csv
    • signature_matches.csv
    • unique_files.csv

Inputs

• examples/inputs/qcow-forensic-samples/README.md
• examples/inputs/qcow-forensic-samples/sample.qcow2

Profile

# QCOW Forensic Image Example Profile
# Demonstrates analysis of QCOW (QEMU Copy On Write) forensic disk images

decode = ["base64"]

max-file-size = 104857600  # 100 MiB

tag = "qcow-forensic"

# Patterns to match in QCOW images and extracted partitions
[[patterns]]
  name = "QCOW Signature"
  pattern = "51:46:49:FB"  # "QFI\xfb" at header (QCOW/QCOW2/QCOW3)
  type = "bytes"

[[patterns]]
  name = "AWS Access Key"
  pattern = "AKIA[0-9A-Z]{16}"
  type = "regex"

[[patterns]]
  name = "AWS Secret Key"
  pattern = "(?i)aws.{0,20}secret.{0,20}['\"][0-9a-zA-Z/+=]{40}['\"]"
  type = "regex"

[[patterns]]
  name = "SSH Private Key"
  pattern = "-----BEGIN.*PRIVATE KEY-----"
  type = "regex"

[[patterns]]
  name = "Password in Config"
  pattern = "password\\s*=\\s*['\"]?[^'\"\\s]+"
  type = "regex"

[[patterns]]
  name = "Database Connection String"
  pattern = "jdbc:[a-zA-Z0-9]+://[^\\s]+password=[^\\s&;]+"
  type = "regex"

[[patterns]]
  name = "MBR Boot Signature"
  pattern = "55:AA"
  type = "bytes"

[[patterns]]
  name = "GPT Signature"
  pattern = "45:46:49:20:50:41:52:54"  # "EFI PART"
  type = "bytes"

[[patterns]]
  name = "NTFS Signature"
  pattern = "4E:54:46:53"  # "NTFS"
  type = "bytes"

[[patterns]]
  name = "Email Address"
  pattern = "[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}"
  type = "regex"

Report outputs

Triage report (converted from triage_report.json)

top_scores

CSV outputs

errors.csv

Empty CSV

files.csv

pattern_matches.csv

signature_matches.csv

Empty CSV

unique_files.csv