# Acquiring Linux VPS via SSH

In this scenario we're acquiring an image of an entire virtual disk over SSH, using the Finnix Recovery CD provided by BinaryLane through their VPS management portal.

Libewf is not available via the default repositories, and hasn't been compiled/installed in this example. 

1. Prepare remote host for acquisition by rebooting into Finnix Recovery CD.

![](/files/ZeWgqUrbGwHIuKoDBOaU)

2\. Select 64bit (or appropriate architecture type) and wait for console to appear.

![](/files/ZF3lcP0svAXFN2mAMngq)

3\. Identify local disk you wish to acquire

```
$ fdisk -l
```

![](/files/7QIrAqmdV7KdqSYZG252)

4\. Enable root login via SSH

```
$ nano /etc/ssh/sshd_config

# PermitRootLogin yes
```

5\. Restart SSH

```
$ /etc/init.d/ssh restart
```

6\. Acquire via SSH

Note: If you're using WSL/WSL2, you may need to install dd (if it's not installed already) which is a part of the **coreutils** package.

```
$ ssh root@remoteIP "dd if=/dev/vda" | dd of=filename.dd
OR with compression
$ ssh root@remoteIP "dd if=/dev/vda | gzip -1 -" | dd of=filename.gz
```


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://www.iblue.team/incident-response-1/acquiring-linux-vps-via-ssh.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.