Forensic Focus - Computer Forensics, Computer Forensic Training, Digital Forensics
LoginRegisterForumsColumnistsPapersEducationGraduatesReviewsInterviewsNewsletterJobsEventsBlogAdvertise
Search Forensic Focus
Custom Search

Find us on Facebook
Follow Forensic Focus on Twitter
Columnists
"I erred." "I was mistaken."
Craig Ball
Single Sign On
Simon Biles
Copyright and games console modification
Dan Gaskell
To GUI or not to GUI?
Chris Hargreaves
'Web 2.0' as evidence
Sean McLinden
Sometimes it’s all about timing
Sam Raincock
Avoiding common job application errors
David Sullivan
Scalability: A Big Headache
Dominik Weber
Graduate Recruitment

computer forensics graduate jobs

Main Menu
MY ACCOUNT
COMMUNITY
EMPLOYMENT
EDUCATION
RESOURCES
MISC
Follow Forensic Focus

Join newsletter

Join LinkedIn group

Follow on Twitter

Subscribe to news

Subscribe to forums

Subscribe to blog

Subscribe to tweets

Members' blogs

External feeds

Bookmark & share: Bookmark and Share

Computer Forensics Newsletter
Newsletter

You must be a
registered user
to receive our newsletter

Register Now!

Mounting an image
Go to page Previous  1, 2, 3, 4, 5, 6, 7  Next
Post new topic   Reply to topic   Printer Friendly Page     Forum Index -> General Discussion
View previous topic :: View next topic  
Author Message
jaclaz
Senior Member


Joined: Nov 16, 2007
Posts: 420
Location: Near Florence - Italy

PostPosted: Fri Nov 16, 2007 10:56 am    Post subject: Re: Mounting an image Reply with quote

Hallo,
I am the author of the everyday increasingly outdated small pseudo-GUI for VDK.EXE you can find here:
home.graffiti.net/jacl...M/vdm.html

I just want to let you know that a handy way to mount "dd-like" images is to use VMWare 2.00 .pln descriptor files, see this:
www.msfn.org/board/ind...80281&st=1
This way the "dd-like" image can be mounted with the "correct" geometry, as VDK defaults normally to a 64/32 one.

To automatically create a .pln file descriptor for the image you have, you are free to "borrow" code from this other small batch of mines (MBRbatch/Mkimg):
www.boot-land.net/foru...t3191.html

Moreover, there is a new Filesystem driver, IMDISK:
www.ltr-data.se/opencode.html
www.boot-land.net/foru...k-f59.html
(you will need to specify a "hidden sectors" offset to mount "full" HD images)

Here is a thread where I try to collect all links I can find to Ramdisk/Filedisk drivers:
www.boot-land.net/foru...topic=1507

Finally, there are a number of absolutely FREEWARE "dd-like" tools for Windows, I use a lot dsfo/dsfi from the DSFOK toolkit:
members.ozemail.com.au.../freeware/

But in this thread there are a few other options:
www.911cd.net/forums//...opic=16534

jaclaz
Back to top
View user's profile
keydet89
Senior Member


Joined: Oct 19, 2004
Posts: 2373
Location: NoVA

PostPosted: Fri Nov 16, 2007 2:32 pm    Post subject: Re: Mounting an image Reply with quote

jaclaz,

I'm finding that the IMDisk utility keeps wanting to format the drive whenever I mount a dd image file as a drive. My goal is to open an image file ("image.dd") and mount it as an F:\ drive, as read-only.
Back to top
View user's profile Visit poster's website AIM Address
jaclaz
Senior Member


Joined: Nov 16, 2007
Posts: 420
Location: Near Florence - Italy

PostPosted: Sat Nov 17, 2007 3:53 am    Post subject: Re: Mounting an image Reply with quote

keydet89 wrote:
jaclaz,

I'm finding that the IMDisk utility keeps wanting to format the drive whenever I mount a dd image file as a drive. My goal is to open an image file ("image.dd") and mount it as an F:\ drive, as read-only.
If the "dd image" is that of a "whole" hard disk, you need to supply IMDISK the correct offset to the bootsector of the partition you want to mount, making it skip the MBR+hidden sectors.
On most of modern hard disks, geometry is set to nx255x63, so the first partition is 63 sectors away from the beginning.
Consequently, you need to tell IMDISK to have an "Image file offset" of 63 and set the "Unit of image offset" as blocks, or set "Image file offset" to 63x512=32256 and set the "Unit of image offset" as bytes.
If the volume you want to mount is second or further partition, you need to find it's start (the bootsector) and "feed" it to IMDISK.

VDK, on the other hand, parses the contents of the MBR and mounts partition(s) correctly.

In other words, VDK is a "Virtual Hard Disk" driver, whilst IMDISK is a "Virtual Partition" or "Virtual Filesystem" driver.

VDK creates in 2K/XP a normal "low-level" drive link, like \\.\PHYSICALDRIVEn, whilst IMDISK treats each mounted volume as it were a "superfloppy".

If you use (as you should until you get familiarity with IMDISK) the control panel GUI, and mount an image with the wrong offset, the data in the "Filesystem" column will be "N/A", whilst if you mount it with the right one, the correct filesustem type will appear (of course limited to FAT, FAT32 or NTFS unless you have some other IFS filesystem drivers installed).

jaclaz
Back to top
View user's profile
keydet89
Senior Member


Joined: Oct 19, 2004
Posts: 2373
Location: NoVA

PostPosted: Sat Nov 17, 2007 6:48 am    Post subject: Re: Mounting an image Reply with quote

Jaclaz,

Thanks. I think I'll stick w/ VDK...

H
Back to top
View user's profile Visit poster's website AIM Address
jaclaz
Senior Member


Joined: Nov 16, 2007
Posts: 420
Location: Near Florence - Italy

PostPosted: Sun Nov 18, 2007 10:42 am    Post subject: Re: Mounting an image Reply with quote

I simply forgot that I already had put together a small batch to help creating a .pln file for a RAW image:
Code::
@ECHO OFF
SETLOCAL ENABLEDELAYEDEXPANSION
SETLOCAL ENABLEEXTENSIONS
SET /A HEADS=255
SET /A SECTORS=63

ECHO.
ECHO makepln.cmd: small batch file to create a .pln descriptor file
ECHO              for RAW disk images to be used with VDK.EXE to 
ECHO              mount the image with the correct geometry
ECHO Author:      jaclaz http://home.graffiti.net/jaclaz:graffiti.net/
ECHO.

IF %1.==/?. GOTO :Usage
IF %1.==. GOTO :Interactive

IF NOT EXIST %1 ECHO File NOT FOUND &GOTO :Interactive
CALL :Setvars %1
IF NOT %2.==. SET HEADS=%2
IF NOT %3.==. SET SECTORS=%3
GOTO :DOIT

:Interactive
ECHO Please input filename of the imagefile:
SET /P imgfile=
ECHO Imgfile is %imgfile%
CALL :Setvars %imgfile%
IF NOT EXIST %imgP%%imgN%%imgE% ECHO File NOT FOUND &GOTO :Interactive
ECHO Please input number of Heads for the imagefile [ENTER] for default 255:
SET /P HEADS=
REM SET /A HEADS=%HEADS%
ECHO Please input number of Sectors for the imagefile [ENTER] for default 63:
SET /P SECTORS=
REM SET /A SECTORS=%SECTORS%


:DOIT
FOR /F "tokens=3 delims= " %%A in ('DIR /-C %imgP%%imgN%%imgE% ^|FIND "%imgN%%imgE%"') DO SET /A TOTsectors=%%A/512
DIR /-C %imgP%%imgN%%imgE% |FIND "%imgN%%imgE%"
ECHO Tot sectors are %TOTsectors%
SET /A CYLYNDERS=%totsectors%/%SECTORS%/%HEADS%
:CheckSize
SET /A CheckCyl=%CYLYNDERS%*%SECTORS%*%HEADS%
IF NOT %CheckCyl% LEQ %totsectors% SET /A CYLYNDERS=%CYLYNDERS%-1&GOTO :CheckSize

IF %CYLYNDERS% LEQ 0 ECHO ERROR! Image too little for this geometry.&PAUSE&goto :EOF

ECHO.
ECHO The Following will be written to %imgP%%imgN%.pln:
CALL :Writefile CON
SET Confirm=
ECHO.
ECHO Type Y to confirm, Enter to abort:
SET /P Confirm=
IF /I NOT %Confirm%.==Y. PAUSE&GOTO :EOF
CALL :Writefile "%imgN%.pln"
ECHO File  %imgP%%imgN%.pln written.
PAUSE
GOTO :EOF

:Setvars
%~d1
CD %~dp1
SET imgN=%~n1
SET imgE=%~x1
SET imgP=%~dp1
GOTO :EOF

:Writefile
(
ECHO DRIVETYPE ide
ECHO CYLINDERS %CYLYNDERS%
ECHO HEADS     %HEADS%
ECHO SECTORS   %SECTORS%
ECHO ACCESS "%imgN%%imgE%" 0 %TOTsectors%
) > %1
GOTO :EOF

:Usage
ECHO Usage:
ECHO makepln.cmd [filename] [heads] [sectors]
ECHO Examples:
ECHO makepln.cmd C:\testimg.img 16 63
ECHO makepln.cmd C:\testimg.img (will default to Nx255x63)
ECHO Long filenames are OK, as long as given inside double quotes
ECHO If no parameters are given, will enter interactive mode
GOTO :EOF 


Last edited by jaclaz on Wed Apr 01, 2009 3:11 am; edited 1 time in total
Back to top
View user's profile
jaclaz
Senior Member


Joined: Nov 16, 2007
Posts: 420
Location: Near Florence - Italy

PostPosted: Fri Nov 28, 2008 12:34 pm    Post subject: Re: Mounting an image Reply with quote

@keydet89

FYI, Olof has recently released a newish version of IMDISK that (finally) "automaps" the partition:
www.boot-land.net/foru...0&start=20
Wink


jaclaz
Back to top
View user's profile
MMachor
Member


Joined: Apr 25, 2008
Posts: 69
Location: Canton, OH

PostPosted: Sun Nov 30, 2008 1:17 pm    Post subject: Re: Mounting an image Reply with quote

Ok, along the lines of this post, does anyone have any known image mounting software that will work with Windows Vista? I have Smart Mount, ImDisk, FTK Imager. Get the same problem with all of them, access is denied when trying to mount image as a drive. I've already checked the permissions and have full access to the image. Any ideas?
Back to top
View user's profile Visit poster's website
jaclaz
Senior Member


Joined: Nov 16, 2007
Posts: 420
Location: Near Florence - Italy

PostPosted: Sun Nov 30, 2008 7:20 pm    Post subject: Re: Mounting an image Reply with quote

MMachor wrote:
Ok, along the lines of this post, does anyone have any known image mounting software that will work with Windows Vista? I have Smart Mount, ImDisk, FTK Imager. Get the same problem with all of them, access is denied when trying to mount image as a drive. I've already checked the permissions and have full access to the image. Any ideas?

Mind you I don't use /like Vista, but maybe:

Have you tried running as "true Admin"?
www.boot-land.net/foru...topic=4057

With UAC disabled?
www.boot-land.net/foru...&st=25

jaclaz
Back to top
View user's profile
MMachor
Member


Joined: Apr 25, 2008
Posts: 69
Location: Canton, OH

PostPosted: Sun Nov 30, 2008 8:17 pm    Post subject: Re: Mounting an image Reply with quote

Have tried both with the same results. Thanks though. I'll keep trying untill I find something.
Back to top
View user's profile Visit poster's website
MMachor
Member


Joined: Apr 25, 2008
Posts: 69
Location: Canton, OH

PostPosted: Fri Dec 05, 2008 3:18 pm    Post subject: Re: Mounting an image Reply with quote

I have been using ImDisk. Seems to work good, and is a freeware tool.
Back to top
View user's profile Visit poster's website
Display posts from previous:   
Post new topic   Reply to topic   Printer Friendly Page     Forum Index -> General Discussion All times are GMT - 6 Hours
Go to page Previous  1, 2, 3, 4, 5, 6, 7  Next
Page 4 of 7


Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum


Use of this website signifies your agreement to the Terms of Use/Privacy Policy available here.

All logos and trademarks in this site are property of their respective owner. The comments are property of their posters, all the rest © 2010 Forensic Focus


Interactive software released under GNU GPL, Code Credits, Privacy Policy
.: fisubsilver shadow phpbb2 style by Daz :: CPG-Nuke port by norseman :: ported to CPG-Dragonfly by jamin :.