±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 1 Overall: 35997
New Yesterday: 9 Visitors: 188

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Mounting an image

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page Previous  1, 2, 3, 4, 5, 6, 7, 8, 9, 10  Next 
  

jaclaz
Senior Member
 

Re: Mounting an image

Post Posted: Nov 16, 07 21:56

Hallo,
I am the author of the everyday increasingly outdated small pseudo-GUI for VDK.EXE you can find here:
home.graffiti.net/jacl...M/vdm.html

I just want to let you know that a handy way to mount "dd-like" images is to use VMWare 2.00 .pln descriptor files, see this:
www.msfn.org/board/ind...80281&st=1
This way the "dd-like" image can be mounted with the "correct" geometry, as VDK defaults normally to a 64/32 one.

To automatically create a .pln file descriptor for the image you have, you are free to "borrow" code from this other small batch of mines (MBRbatch/Mkimg):
www.boot-land.net/foru...t3191.html

Moreover, there is a new Filesystem driver, IMDISK:
www.ltr-data.se/opencode.html
www.boot-land.net/foru...k-f59.html
(you will need to specify a "hidden sectors" offset to mount "full" HD images)

Here is a thread where I try to collect all links I can find to Ramdisk/Filedisk drivers:
www.boot-land.net/foru...topic=1507

Finally, there are a number of absolutely FREEWARE "dd-like" tools for Windows, I use a lot dsfo/dsfi from the DSFOK toolkit:
members.ozemail.com.au.../freeware/

But in this thread there are a few other options:
www.911cd.net/forums//...opic=16534

jaclaz  
 
  

keydet89
Senior Member
 

Re: Mounting an image

Post Posted: Nov 17, 07 01:32

jaclaz,

I'm finding that the IMDisk utility keeps wanting to format the drive whenever I mount a dd image file as a drive. My goal is to open an image file ("image.dd") and mount it as an F:\ drive, as read-only.  
 
  

jaclaz
Senior Member
 

Re: Mounting an image

Post Posted: Nov 17, 07 14:53

- keydet89
jaclaz,

I'm finding that the IMDisk utility keeps wanting to format the drive whenever I mount a dd image file as a drive. My goal is to open an image file ("image.dd") and mount it as an F:\ drive, as read-only.

If the "dd image" is that of a "whole" hard disk, you need to supply IMDISK the correct offset to the bootsector of the partition you want to mount, making it skip the MBR+hidden sectors.
On most of modern hard disks, geometry is set to nx255x63, so the first partition is 63 sectors away from the beginning.
Consequently, you need to tell IMDISK to have an "Image file offset" of 63 and set the "Unit of image offset" as blocks, or set "Image file offset" to 63x512=32256 and set the "Unit of image offset" as bytes.
If the volume you want to mount is second or further partition, you need to find it's start (the bootsector) and "feed" it to IMDISK.

VDK, on the other hand, parses the contents of the MBR and mounts partition(s) correctly.

In other words, VDK is a "Virtual Hard Disk" driver, whilst IMDISK is a "Virtual Partition" or "Virtual Filesystem" driver.

VDK creates in 2K/XP a normal "low-level" drive link, like \\.\PHYSICALDRIVEn, whilst IMDISK treats each mounted volume as it were a "superfloppy".

If you use (as you should until you get familiarity with IMDISK) the control panel GUI, and mount an image with the wrong offset, the data in the "Filesystem" column will be "N/A", whilst if you mount it with the right one, the correct filesustem type will appear (of course limited to FAT, FAT32 or NTFS unless you have some other IFS filesystem drivers installed).

jaclaz  
 
  

keydet89
Senior Member
 

Re: Mounting an image

Post Posted: Nov 17, 07 17:48

Jaclaz,

Thanks. I think I'll stick w/ VDK...

H  
 
  

jaclaz
Senior Member
 

Re: Mounting an image

Post Posted: Nov 18, 07 21:42

I simply forgot that I already had put together a small batch to help creating a .pln file for a RAW image:
Code:
@ECHO OFF
SETLOCAL ENABLEDELAYEDEXPANSION
SETLOCAL ENABLEEXTENSIONS
SET /A HEADS=255
SET /A SECTORS=63

ECHO.
ECHO makepln.cmd: small batch file to create a .pln descriptor file
ECHO              for RAW disk images to be used with VDK.EXE to 
ECHO              mount the image with the correct geometry
ECHO Author:      jaclaz http://home.graffiti.net/jaclaz:graffiti.net/
ECHO.

IF %1.==/?. GOTO :Usage
IF %1.==. GOTO :Interactive

IF NOT EXIST %1 ECHO File NOT FOUND &GOTO :Interactive
CALL :Setvars %1
IF NOT %2.==. SET HEADS=%2
IF NOT %3.==. SET SECTORS=%3
GOTO :DOIT

:Interactive
ECHO Please input filename of the imagefile:
SET /P imgfile=
ECHO Imgfile is %imgfile%
CALL :Setvars %imgfile%
IF NOT EXIST %imgP%%imgN%%imgE% ECHO File NOT FOUND &GOTO :Interactive
ECHO Please input number of Heads for the imagefile [ENTER] for default 255:
SET /P HEADS=
REM SET /A HEADS=%HEADS%
ECHO Please input number of Sectors for the imagefile [ENTER] for default 63:
SET /P SECTORS=
REM SET /A SECTORS=%SECTORS%


:DOIT
FOR /F "tokens=3 delims= " %%A in ('DIR /-C %imgP%%imgN%%imgE% ^|FIND "%imgN%%imgE%"') DO SET /A TOTsectors=%%A/512
DIR /-C %imgP%%imgN%%imgE% |FIND "%imgN%%imgE%"
ECHO Tot sectors are %TOTsectors%
SET /A CYLYNDERS=%totsectors%/%SECTORS%/%HEADS%
:CheckSize
SET /A CheckCyl=%CYLYNDERS%*%SECTORS%*%HEADS%
IF NOT %CheckCyl% LEQ %totsectors% SET /A CYLYNDERS=%CYLYNDERS%-1&GOTO :CheckSize

IF %CYLYNDERS% LEQ 0 ECHO ERROR! Image too little for this geometry.&PAUSE&goto :EOF

ECHO.
ECHO The Following will be written to %imgP%%imgN%.pln:
CALL :Writefile CON
SET Confirm=
ECHO.
ECHO Type Y to confirm, Enter to abort:
SET /P Confirm=
IF /I NOT %Confirm%.==Y. PAUSE&GOTO :EOF
CALL :Writefile "%imgN%.pln"
ECHO File  %imgP%%imgN%.pln written.
PAUSE
GOTO :EOF

:Setvars
%~d1
CD %~dp1
SET imgN=%~n1
SET imgE=%~x1
SET imgP=%~dp1
GOTO :EOF

:Writefile
(
ECHO DRIVETYPE ide
ECHO CYLINDERS %CYLYNDERS%
ECHO HEADS     %HEADS%
ECHO SECTORS   %SECTORS%
ECHO ACCESS "%imgN%%imgE%" 0 %TOTsectors%
) > %1
GOTO :EOF

:Usage
ECHO Usage:
ECHO makepln.cmd [filename] [heads] [sectors]
ECHO Examples:
ECHO makepln.cmd C:\testimg.img 16 63
ECHO makepln.cmd C:\testimg.img (will default to Nx255x63)
ECHO Long filenames are OK, as long as given inside double quotes
ECHO If no parameters are given, will enter interactive mode
GOTO :EOF 
 

Last edited by jaclaz on Apr 01, 09 14:11; edited 1 time in total
 
  

jaclaz
Senior Member
 

Re: Mounting an image

Post Posted: Nov 28, 08 23:34

@keydet89

FYI, Olof has recently released a newish version of IMDISK that (finally) "automaps" the partition:
www.boot-land.net/foru...0&start=20
Wink


jaclaz  
 
  

MMachor
Senior Member
 

Re: Mounting an image

Post Posted: Dec 01, 08 00:17

Ok, along the lines of this post, does anyone have any known image mounting software that will work with Windows Vista? I have Smart Mount, ImDisk, FTK Imager. Get the same problem with all of them, access is denied when trying to mount image as a drive. I've already checked the permissions and have full access to the image. Any ideas?  
 

Page 6 of 10
Page Previous  1, 2, 3, 4, 5, 6, 7, 8, 9, 10  Next