> For the complete documentation index, see [llms.txt](https://www.iblue.team/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.iblue.team/incident-response-1/acquiring-linux-vps-via-ssh.md).

# Acquiring Linux VPS via SSH

In this scenario we're acquiring an image of an entire virtual disk over SSH, using the Finnix Recovery CD provided by BinaryLane through their VPS management portal.

Libewf is not available via the default repositories, and hasn't been compiled/installed in this example. 

1. Prepare remote host for acquisition by rebooting into Finnix Recovery CD.

![](/files/ZeWgqUrbGwHIuKoDBOaU)

2\. Select 64bit (or appropriate architecture type) and wait for console to appear.

![](/files/ZF3lcP0svAXFN2mAMngq)

3\. Identify local disk you wish to acquire

```
$ fdisk -l
```

![](/files/7QIrAqmdV7KdqSYZG252)

4\. Enable root login via SSH

```
$ nano /etc/ssh/sshd_config

# PermitRootLogin yes
```

5\. Restart SSH

```
$ /etc/init.d/ssh restart
```

6\. Acquire via SSH

Note: If you're using WSL/WSL2, you may need to install dd (if it's not installed already) which is a part of the **coreutils** package.

```
$ ssh root@remoteIP "dd if=/dev/vda" | dd of=filename.dd
OR with compression
$ ssh root@remoteIP "dd if=/dev/vda | gzip -1 -" | dd of=filename.gz
```