Skip to content

10. Evidence Image System Restore (Linux)

  1. Restore image: qemu-img convert -f raw <input>.raw -O vmdk <output>.vmdk (QEMU download)
  2. Modify VM configuration: select use existing disk
  3. Change password: at boot screen press e → single-user mode → change ro to rw init=/bin/bash → delete cloud-init → passwd
  4. Modify network: ip a → dhclient eth0 → network set to host-only
  5. Reconnaissance: check command history / check services / files corresponding to services