KeibiDrop Lets Investigators Browse Remote Files Without VPN or Full Disk Copy
KeibiDrop is a tool that mounts a remote computer's folder as a local read-only filesystem, allowing forensic examiners to browse, search, and selectively copy files without setting up a VPN or transferring an entire disk. Only the bytes actually accessed travel over the network, with a demo showing just 606 MB transferred out of 19.9 GB available on a remote Mac. Standard forensic tools such as KAPE work with the mount without any modification, and no kernel driver is required on the remote machine. In a test conducted in Bucharest over a shared internet connection relayed through Timisoara, file hashes matched on both sides and no metadata on the source machine was altered. The approach is intended to cut waiting time at the start of remote incident response or digital triage work.
This is an AI-generated summary. ShortSingh links to the original source for the complete article.
Discussion (0)
Log in to join the discussion and vote.
Log in