kleanchap wrote:

Thank you for explaining this! What tools should I use against partition images to get the partition layout? I am looking for files, directories and their metadata. K

Why don't you mount the image file?

And then use "normal" filesystem tools?

Or (for some data) you may want to use TESTDISK:
www.cgsecurity.org/wiki/TestDisk

Or you may want to use some Forensic utilities....
www.sleuthkit.org/

Read related tutorials articles:
www.forensicfocus.com/...lysis-ntfs

In other words:
WHAT EXACTLY are you trying to do/WHAT EXACT data you need to retrieve/look at?

Then, after having read and understood the basics of the filesystems/partitioning, etc., you could ask specific questions about something that you still have not clear.

A tool is, well, a tool, nothing more, it is the knowledge, the skill and experience of the user of the tool that makes it useful.

Don't take it the wrong way, but it seems to me like you asked:

Quote::

What do I use to shorten a wooden plank?

To which anyone can answer ANY of the following:
a saw
a hacksaw
a circular saw
a band saw
a jig saw
an axe
a hatchet

They are all valid answers, but each of them has it's own advantages and drawbacks, there may be a "better" answer among them for your particular case.

And however, using the "right" tool does not guarantee that the wooden plank will be shortened to the right measure and with a clean cut if you don't know how to use the tool properly....

jaclaz

kleanchap,

If you want to dump file system meta data and file metadata and data then you would call upon file system and file tools. The NTFSPROGS package has a number of file system metadata tools. Various forensics applications do as well.

You could use a mount tool such as SMART MOUNT to mount the file system image and then your normal operating system environment to analyze the data.

Cheers!

farmerdude


www.forensicbootcd.com

www.onlineforensictraining.com

Some more ideas - that I often refer to

www.win.tue.nl/~aeb/pa...pes-1.html



Also have a look at the start of the partition, can often indicate what it is

Just a suggestion but you might get more assistance if you posted the hex from the start of the image rather than the ouput from some tool.