Alternative to Enca...
 
Notifications
Clear all

Alternative to Encase to view Bitlocked E01

12 Posts
8 Users
0 Reactions
4,695 Views
Passmark
(@passmark)
Reputable Member
Joined: 14 years ago
Posts: 376
 

Well, just for the record both Imdisk and AIM are open source anyway.

OFSmount most probably should, but it isn't. cry

Just to correct the record about Imdisk and OSFMount.

OSFMount was a fork of ImDisk from back in 2010. The main motivation was to add support for forensics formats, like E01, but to also make the default behaviour read only and not R/W.

The source code license for Imdisk is,
"Source files without copyright notice can be used without any restriction and are provided without any warranty". And at least back in 2010, there was no further notice in the files we forked. I haven't checked the situation today.

So there was no requirement for it to be open source. Neverthless we fed bug fixes back into the open source ImDisk project. ImDisk only supports RAM drives greater than 4GB due to this. There were also massive machine crashing memory leaks we fixed up in ImDisk.

Seven years later the code base and user interface is now pretty different. A merge would be pretty complex.

We are looking at also supporting full physical disk mounting for the next major release. But generally it isn't required except for a few niche cases however.

But is it true, ImDisk and OSFMount aren't the best option for cases where there was full disk encryption. OSForensics is a better option, as is supports Bitlocker decryption, without mounting to a Windows drive letter. This is generally better option than mounting to a drive letter as you can bypass all of the problems with NTFS file permissions while preserving the drive as read only.

(Disclosure We are the developers of OSFMount & OSForensics)


   
ReplyQuote
jaclaz
(@jaclaz)
Illustrious Member
Joined: 18 years ago
Posts: 5133
 

The source code license for Imdisk is,
"Source files without copyright notice can be used without any restriction and are provided without any warranty". And at least back in 2010, there was no further notice in the files we forked. I haven't checked the situation today.

So there was no requirement for it to be open source.

I know ) , but the fact that there is no requirement does not automatically mean that it cannot (or shouldn't) be done idea .

The only issue (from a theoretical legal standpoint) is ONLY the part of IMDISK source code related to floppy disk access (which derives from GPL code and thus needs to be removed if not releasing the derivative as GPL), since hopefully you removed that part from OFSmount you are perfectly fine ) .

http//www.ltr-data.se/opencode.html/

License
I have received some e-mails with questions whether or not it is okay to include this driver in a commercial product. The answer is yes, just like all other tools I publish here. However, note that a few lines of code are under the GNU GPL license. More specifically, the driver code related to floppy emulation. Some of the driver code is also ported to Windows NT from the FreeBSD 'md' driver.

This means that if you modify the code and/or include it in and/or redistribute it along with your own product, all of the modified/integrated/redistributed product that you distribute needs to be redistributed under GPL, including source code. If you wish to avoid GPL requirements, such as the need to redistribute source code, you would therefore need to remove all floppy emulation related code from the driver. I will be happy to do such modifications for you to make the code comply with your license requirements. Just send me an e-mail!

jaclaz


   
ReplyQuote
Page 2 / 2
Share: