acquire

import os from acquire import AcquireBinary, DiskCollection # --- Configuration --- # IMPORTANT: Replace '/path/to/your/image.e01' with an actual path to a forensic image file. # If you don't have one, this example for DiskCollection will fail. # For a real run, ensure this path exists and is accessible. image_path = os.environ.get('ACQUIRE_IMAGE_PATH', '/tmp/example_image.e01') output_dir = os.environ.get('ACQUIRE_OUTPUT_DIR', './acquired_artifacts') # Ensure the output directory exists os.makedirs(output_dir, exist_ok=True) try: # Initialize AcquireBinary. The 'acquire' C++ executable should be in PATH # or installed alongside the Python package via pip. acq_binary = AcquireBinary() # For disk image acquisition collection = DiskCollection( binary=acq_binary, source_path=image_path, output_path=output_dir, collection_id="my-disk-collection", case_id="my-case" ) print(f"Starting collection from disk image: {image_path} to {output_dir}") collection.start() print("Disk image acquisition complete.") # For live acquisition, use LiveCollection: # from acquire import LiveCollection # live_collection = LiveCollection(binary=acq_binary, output_path=output_dir) # live_collection.start() # Note: Live collection often requires elevated privileges. except Exception as e: print(f"An error occurred: {e}") print("Please ensure:") print("1. The 'acquire' C++ binary is installed and in your system's PATH.") print("2. For DiskCollection, ACQUIRE_IMAGE_PATH points to a valid and accessible image file.") print("3. The output directory has write permissions.")