Forensic Focus - Computer Forensics, Computer Forensic Training, Digital Forensics
LoginRegisterForumsColumnistsPapersEducationGraduatesReviewsInterviewsNewsletterJobsEventsBlogAdvertise
Search Forensic Focus
Custom Search

Find us on Facebook
Follow Forensic Focus on Twitter
Columnists
"I erred." "I was mistaken."
Craig Ball
Single Sign On
Simon Biles
Copyright and games console modification
Dan Gaskell
To GUI or not to GUI?
Chris Hargreaves
'Web 2.0' as evidence
Sean McLinden
Sometimes it’s all about timing
Sam Raincock
Avoiding common job application errors
David Sullivan
Scalability: A Big Headache
Dominik Weber
Graduate Recruitment

computer forensics graduate jobs

Main Menu
MY ACCOUNT
COMMUNITY
EMPLOYMENT
EDUCATION
RESOURCES
MISC
Follow Forensic Focus

Join newsletter

Join LinkedIn group

Follow on Twitter

Subscribe to news

Subscribe to forums

Subscribe to blog

Subscribe to tweets

Members' blogs

External feeds

Bookmark & share: Bookmark and Share

Computer Forensics Newsletter
Newsletter

You must be a
registered user
to receive our newsletter

Register Now!

Mounting an image
Go to page Previous  1, 2, 3, 4, 5, 6, 7  Next
Post new topic   Reply to topic   Printer Friendly Page     Forum Index -> General Discussion
View previous topic :: View next topic  
Author Message
Marat
Newbie


Joined: Mar 15, 2006
Posts: 31
Location: Russia

PostPosted: Tue Apr 03, 2007 3:37 am    Post subject: Re: Mounting an image Reply with quote

Harlan,
you can mount in vdk raw image,whithout converting image to vmdk.
Back to top
View user's profile
keydet89
Senior Member


Joined: Oct 19, 2004
Posts: 2380
Location: NoVA

PostPosted: Tue Apr 03, 2007 6:16 am    Post subject: Re: Mounting an image Reply with quote

Marat,

I don't know...I haven't tried. Why don't you try it and let us know? I know I'd greatly appreciate it if you did.

Thanks,

Harlan
Back to top
View user's profile Visit poster's website AIM Address
Marat
Newbie


Joined: Mar 15, 2006
Posts: 31
Location: Russia

PostPosted: Tue Apr 03, 2007 11:08 am    Post subject: Re: Mounting an image Reply with quote

Harlan,
sorry for my bad english.
Vdk can mount raw image. Smile
Back to top
View user's profile
keydet89
Senior Member


Joined: Oct 19, 2004
Posts: 2380
Location: NoVA

PostPosted: Tue Apr 03, 2007 12:01 pm    Post subject: Re: Mounting an image Reply with quote

Great...can you share the process/command line?
Back to top
View user's profile Visit poster's website AIM Address
Marat
Newbie


Joined: Mar 15, 2006
Posts: 31
Location: Russia

PostPosted: Tue Apr 03, 2007 12:56 pm    Post subject: Re: Mounting an image Reply with quote

yes
for example

vdk view D:\EVIDENCE_LOCKER\HASHSETS.001

Failed to decide type of 'd:\evidence_locker\hashsets.001'.
Open as a simple sector image file.
Image Name : hashsets
Disk Capacity : 2097152 sectors (1024 MB)
Number Of Files : 1

Type Size Path
------- ------- ----
FLAT 2097152 d:\evidence_locker\hashsets.001

Partitions :
# Start Sector Length in sectors Type
-- ------------ --------------------- ----
0 0 2097152 ( 1024 MB) NTFS

and

vdk open * D:\EVIDENCE_LOCKER\HASHSETS.001 /WB /L:G
/WB write block
/L:G G-drive letter
Back to top
View user's profile
keydet89
Senior Member


Joined: Oct 19, 2004
Posts: 2380
Location: NoVA

PostPosted: Tue Apr 03, 2007 1:12 pm    Post subject: Re: Mounting an image Reply with quote

Marat,

Thanks! I'm glad you shared that...that's the kind of thing the community needs more of.

H
Back to top
View user's profile Visit poster's website AIM Address
cosimo
Newbie


Joined: Apr 17, 2006
Posts: 19
Location: Italy

PostPosted: Wed Apr 04, 2007 4:12 am    Post subject: Re: Mounting an image Reply with quote

Harlan,

there is also a GUI for VDK that works fairly well. I've used it quite effectively in the past, and it can be found on petruska.stardock.net/...Mware.html where you can find also other useful VMWare-related disk manipulation software.

Speaking of which, sometimes (I would say about 20% of the times) I've had stability problems when using the VDK driver on a Windows XP SP2 machine, that crashed (with the BSOD) when I unmounted a dd image. Did you experience similar problems?

Cheers,
-- Cosimo
Back to top
View user's profile
Marat
Newbie


Joined: Mar 15, 2006
Posts: 31
Location: Russia

PostPosted: Wed Apr 04, 2007 4:37 am    Post subject: Re: Mounting an image Reply with quote

cosimo,
Quote::
I've had stability problems when using the VDK driver on a Windows XP SP2 machine, that crashed (with the BSOD) when I unmounted a dd image. Did you experience similar problems?

I am used vdk long time and dont have any problems on Windows XP SP2.
Back to top
View user's profile
jaclaz
Senior Member


Joined: Nov 16, 2007
Posts: 423
Location: Near Florence - Italy

PostPosted: Fri Nov 16, 2007 10:56 am    Post subject: Re: Mounting an image Reply with quote

Hallo,
I am the author of the everyday increasingly outdated small pseudo-GUI for VDK.EXE you can find here:
home.graffiti.net/jacl...M/vdm.html

I just want to let you know that a handy way to mount "dd-like" images is to use VMWare 2.00 .pln descriptor files, see this:
www.msfn.org/board/ind...80281&st=1
This way the "dd-like" image can be mounted with the "correct" geometry, as VDK defaults normally to a 64/32 one.

To automatically create a .pln file descriptor for the image you have, you are free to "borrow" code from this other small batch of mines (MBRbatch/Mkimg):
www.boot-land.net/foru...t3191.html

Moreover, there is a new Filesystem driver, IMDISK:
www.ltr-data.se/opencode.html
www.boot-land.net/foru...k-f59.html
(you will need to specify a "hidden sectors" offset to mount "full" HD images)

Here is a thread where I try to collect all links I can find to Ramdisk/Filedisk drivers:
www.boot-land.net/foru...topic=1507

Finally, there are a number of absolutely FREEWARE "dd-like" tools for Windows, I use a lot dsfo/dsfi from the DSFOK toolkit:
members.ozemail.com.au.../freeware/

But in this thread there are a few other options:
www.911cd.net/forums//...opic=16534

jaclaz
Back to top
View user's profile
keydet89
Senior Member


Joined: Oct 19, 2004
Posts: 2380
Location: NoVA

PostPosted: Fri Nov 16, 2007 2:32 pm    Post subject: Re: Mounting an image Reply with quote

jaclaz,

I'm finding that the IMDisk utility keeps wanting to format the drive whenever I mount a dd image file as a drive. My goal is to open an image file ("image.dd") and mount it as an F:\ drive, as read-only.
Back to top
View user's profile Visit poster's website AIM Address
Display posts from previous:   
Post new topic   Reply to topic   Printer Friendly Page     Forum Index -> General Discussion All times are GMT - 6 Hours
Go to page Previous  1, 2, 3, 4, 5, 6, 7  Next
Page 4 of 7


Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum


Use of this website signifies your agreement to the Terms of Use/Privacy Policy available here.

All logos and trademarks in this site are property of their respective owner. The comments are property of their posters, all the rest © 2010 Forensic Focus


Interactive software released under GNU GPL, Code Credits, Privacy Policy
.: fisubsilver shadow phpbb2 style by Daz :: CPG-Nuke port by norseman :: ported to CPG-Dragonfly by jamin :.