[GH-ISSUE #1195] Memory Capture / Remote Drive #878

New issue

Open

opened 2026-02-27 15:52:13 +03:00 by kerem · 2 comments

kerem commented

2026-02-27 15:52:13 +03:00

Owner

Originally created by @conorarmstrong on GitHub (Jul 15, 2023).
Original GitHub issue: https://github.com/quasar/Quasar/issues/1195

Problem description

There are a couple of digital forensic tools out there eg Encase that allow a remote memory dump and to image a remote drive.

Proposal

It would be good to add similar functionality to Quasar as there are no easy open source tools that allow these features, and very expensive paid products.
This would open the world of digital forensics to Quasar.

Additional context

No response

Originally created by @conorarmstrong on GitHub (Jul 15, 2023). Original GitHub issue: https://github.com/quasar/Quasar/issues/1195 ### Problem description There are a couple of digital forensic tools out there eg Encase that allow a remote memory dump and to image a remote drive. ### Proposal It would be good to add similar functionality to Quasar as there are no easy open source tools that allow these features, and very expensive paid products. This would open the world of digital forensics to Quasar. ### Additional context _No response_

kerem added the

enhancement

label

2026-02-27 15:52:13 +03:00

kerem commented

2026-02-27 15:52:14 +03:00

Author

Owner

@BurntDog commented on GitHub (Jul 15, 2023):

I can't se this being added do to security risk, but we'll have to wait and see.

@BurntDog commented on GitHub (Jul 15, 2023): I can't se this being added do to security risk, but we'll have to wait and see.

kerem commented

2026-02-27 15:52:14 +03:00

Author

Owner

@conorarmstrong commented on GitHub (Jul 18, 2023):

I wouldn't imagine it would be any greater risk than what is already there. theoretically, something like winpmem could be uploaded and executed on the server/target to make an acquisition. it would just be very convenient to add to make this a type of core functionality. similarly to make a drive acquisition.

the usefulness of this utility would be greatly increased together with its standing in the industry by allowing easy forensic acquisitions of a machine for analysis.

currently, there are some commercial programs that provide this VERY basic type of functionality for pretty steep costs. a lot of the ancillary functionality is already present in this tool to make acquisitions a simple add on.

@conorarmstrong commented on GitHub (Jul 18, 2023): I wouldn't imagine it would be any greater risk than what is already there. theoretically, something like winpmem could be uploaded and executed on the server/target to make an acquisition. it would just be very convenient to add to make this a type of core functionality. similarly to make a drive acquisition. the usefulness of this utility would be greatly increased together with its standing in the industry by allowing easy forensic acquisitions of a machine for analysis. currently, there are some commercial programs that provide this VERY basic type of functionality for pretty steep costs. a lot of the ancillary functionality is already present in this tool to make acquisitions a simple add on.