QXJ6YW4/SimpleImager

# **SimpleImager** 此脚本旨在简化获取过程 运行脚本前需注意以下几点： ``` 1. Account used to log in to the machine should be Administrator account 2. Command Prompt (CMD) should be run as Administrator 3. USB ports should be enabled on the system to perform Imaging into an external drive or Mapped network drive 4. Run the D-Acquisition script 5. Once Acquisition complete and message is displayed close the script and dismount the drive carefully 6. When the script is executed it will collect information of the host device on which the script is executed. 7. Information such as the serial number of the host, serial number of the hard drive, details of peripherals connected to the host etc.. The collected information is available in DeviceInfo.txt 8. The script also collects information on the BitLocker Key if the host drive is encrypted with bitlocker ``` ### 执行命令 执行脚本的命令如下： ``` D-Acquisition.bat <"Drive letter where the image is to be collected OR the path where you want to store the image"> ``` ### **示例** ``` D-Acquisition.bat Z: D-Acquisition.bat D:\Work\Test_Image ``` ## **注意** 为了正常查看 'DeviceInfo.txt' 的信息，请在 Notepad++ 中执行替换操作，将 "\x00" 替换为 ""（空），并将搜索模式选择为 Extended，这样就能以正确的格式显示内容，而不包含 Null 字符

标签：库, 应急响应, 批处理脚本, 数字取证, 数据获取, 系统镜像, 自动化脚本