Acquiring Linux VPS via SSH

Scenario: compromised VPS instance (through a provider such as BinaryLane, Linode, Vultr, etc) which is no longer live, and requires remote acquisition for examination/analysis.

In this scenario we're acquiring an image of an entire virtual disk over SSH, using the Finnix Recovery CD provided by BinaryLane through their VPS management portal.

Libewf is not available via the default repositories, and hasn't been compiled/installed in this example.

1. Prepare remote host for acquisition by rebooting into Finnix Recovery CD.

2. Select 64bit (or appropriate architecture type) and wait for console to appear.

3. Identify local disk you wish to acquire

$ fdisk -l

4. Enable root login via SSH

$ nano /etc/ssh/sshd_config

# PermitRootLogin yes

5. Restart SSH

$ /etc/init.d/ssh restart

6. Acquire via SSH

Note: If you're using WSL/WSL2, you may need to install dd (if it's not installed already) which is a part of the coreutils package.

$ ssh root@remoteIP "dd if=/dev/vda" | dd of=filename.dd
OR with compression
$ ssh root@remoteIP "dd if=/dev/vda | gzip -1 -" | dd of=filename.gz