2. How to Generate Support Package from the MetaDefender Drive?

OPSWAT added a script on the Forensic Drive used to capture files and configurations, this was designed to assist Support and Engineering teams in diagnosing problems.

There are four parts to these instructions:

  1. Running the Support Package

  2. Copying the Support Package to another system over a Network (if available)

  3. Copying the Support Package to a second USB drive (typical when no network is available and requires a second USB on the computer)

  4. What do I do with the Support Package?

1. Running the Support Package

  • Launch Terminal by using the hotkey CTRL-ALT-T

  • Use the command /usr/bin/ometascan-collect-support-data.sh

  • The support package should be saved in the local user folder

    • Use the command ls to check if the file exists with a name similar to ometascan-support-NNNNNNNN.tar (N is a digit)

2. Copying the Support Package to another system over a Network

If the computer was able to successfully connect to a network, it may be possible to copy the Support Package output to another computer.

  • The scp command (secure copy) on the Forensic Drive system can be used if the laptop/device is connected to a good network.

  • The target computer must already have an scp server to receive the connection and space to store it (installing and configuring scp or winscp is beyond the scope of this document).

3. Copying the Support Package to a second USB drive

  • Plugin the second USB drive

  • Run the command in the Terminal sudo dmesg

    • Find the second USB drive near the end of the output on the screen. In this example, located at /dev/sdc1

    • Create a folder named SupportPackage in the existing /mnt folder

      • mkdir /mnt/SupportPackage

    • Mount the second USB Drive to the SupportPackage Folder

      • mount -o rw /dev/sdc1 /mnt/SupportPackage

    • Now copy the support package to the USB

      • cp -r ~/ometascan-support-.zip /mnt/SupportPackage

      • sudo sync

4. What do I do with the Support Package?

  • If done correctly, you should be able to take the second USB Flash Drive to another computer for further investigation or send the file to OPSWAT Support.

  • If you are filing a ticket using the OPSWAT Support Portal, please select the "Other" product category, at the bottom of the product classification list.