Cloud Forensics Utils

No entries match these filters. Clear filters

1. 20260916 Sep 16, 2026 · issue 076

   cloud-forensics-utils adds a zone parameter to ExportImage, container explorer deps, and updates the compute-image-import reference.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 20260916 https://github.com/google/cloud-forensics-utils.git
   # already have the repo? check out this version:
   $ git checkout 20260916

   └──▷ USE IT
   Export a GCP compute image to a specific zone rather than accepting the default us-central1-a — useful when your GCS bucket and build resources are in a different region.
   python copy

   image.ExportImage(
       gcs_output_folder='gs://my-forensics-bucket/exports/',
       image_format='qcow2',
       output_name='disk-export',
       zone='europe-west1-b'
   )

   • Adds zone parameter (default 'us-central1-a') to the ExportImage method, allowing callers to specify the zone for Cloud Build imaging instances.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds libbtrfs-dev and libgpgme-dev to the forensics packages startup script, expanding container explorer support in imaging instances.
   • Adds zone parameter (default 'us-central1-a') to the ExportImage method, allowing callers to specify the zone for Cloud Build imaging instances.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 more in Everything

2. 20260505 May 5, 2026 · release notes

   StartAnalysisVm now accepts a machine_type parameter and supports region-level blocking operations.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 20260505 https://github.com/google/cloud-forensics-utils.git
   # already have the repo? check out this version:
   $ git checkout 20260505

   └──▷ USE IT
   Start a forensics analysis VM with a specific machine configuration (e.g., high-memory instance).
   shell copy

   cfu start_analysis_vm --machine_type 'n1-highmem-4' <disk_id>

   Invoke the API directly with the new machine_type field.
   python copy

   import cloud_forensics_utils as cfu
   cfu.StartAnalysisVm(disk_id='disk-123', machine_type='n1-standard-4')

   • StartAnalysisVm gains a new machine_type parameter to control the VM instance size.
   • Blocking operation behavior is expanded to support region-level execution.

   2 details in Everything

3. 20260415 Apr 14, 2026 · release notes

   GCP Compute module gains ListSnapshots, zone-arg support for CreateDiskFromSnapshot, and analysis VM package passthrough.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 20260415 https://github.com/google/cloud-forensics-utils.git
   # already have the repo? check out this version:
   $ git checkout 20260415

   └──▷ USE IT
   Create a disk in a specific zone and project from an existing snapshot.
   python copy

   cfu.gcp.compute.CreateDiskFromSnapshot(snapshot_name='my-snap', project='forensics-prod', zone='us-central1-a')

   Spin up an analysis VM with custom forensics packages.
   python copy

   cfu.gcp.analysis.GetOrCreateAnalysisVm(project='forensics-prod', packages=['volatility3'])

   List all snapshots in a specific GCP project.
   python copy

   cfu.gcp.compute.ListSnapshots(project='forensics-prod')

   • CreateDiskFromSnapshot now accepts explicit project and zone arguments.
   • GetOrCreateAnalysisVm passes through the packages argument for custom dependencies.
   • Disks and instances can now be created in explicitly provided zones instead of only defaults.
   • New ListSnapshots method added to the GCP Compute module.

   4 details in Everything

4. 20250721 Jul 23, 2025 · release notes

   Cloud Forensics Utils adds image format support for GCS exports

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 20250721 https://github.com/google/cloud-forensics-utils.git
   # already have the repo? check out this version:
   $ git checkout 20250721

   • Enables exporting disk images in supported formats when transferring to Google Cloud Storage

   1 detail in Everything

5. 20250116 Jan 16, 2025 · release notes

   Adds Suspend() command for VM instances and container-explorer support in analysis VM startup

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 20250116 https://github.com/google/cloud-forensics-utils.git
   # already have the repo? check out this version:
   $ git checkout 20250116

6. 20241207 Dec 10, 2024 · release notes

   Adds CloudResourceManager OrgPolicy support for organizational policy management

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 20241207 https://github.com/google/cloud-forensics-utils.git
   # already have the repo? check out this version:
   $ git checkout 20241207

7. 20241205 Dec 5, 2024 · release notes

   Adds the get_project_metadata library function to retrieve GCP project details.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 20241205 https://github.com/google/cloud-forensics-utils.git
   # already have the repo? check out this version:
   $ git checkout 20241205

   └──▷ USE IT
   Retrieve details like creation time and labels for a specific Google Cloud project.
   python copy

   from cloud_forensics.utils import get_project_metadata
   metadata = get_project_metadata('my-gcp-project-id')

8. 20220114 Jan 14, 2022 · release notes

   Cloud Forensics Utils adds BigQueryBigQueryA serverless, cloud-hosted analytical database from Google that runs SQL queries across massive datasets without managing infrastructure, giving cyber tools scalable storage and fast querying over large volumes of log or event data. Jobs support and IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. policy retrieval for GCP cloudresourcemanager.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 20220114 https://github.com/google/cloud-forensics-utils.git
   # already have the repo? check out this version:
   $ git checkout 20220114

   • BigQuery.Jobs module added to manage BigQuery jobs
   • getIamPolicy method added to cloudresourcemanager module

   2 details in Everything