Joining DD Files
Firstly, apologies for the n00b question, but I did look around for my answer.
I took an image today using FTK Imager and it has split the image up into 650mb files (May be my own fault).
Anyway, I now have nearly 300 files called image.dd.001, image.dd.002 etc.
What can I use to join these, or what will open them as is (Windows XP)? (Open source/Freeware only please)
Ps, first day hands on and I have already learnt something! Hopefully will be the same everyday. D
> I took an image today using FTK Imager and it has split the image up into 650mb files (May be my own fault).
Only in that you are perhaps not familiar with the tool…it does this by default.
First off, you don't need to join them, but if you like, simply use the 'type' command
c\>type image.dd.001 >> image.dd
now, repeat, replacing "image.dd.001" with the next successive file in order. I usually write a Perl script to do this for me.
As to the rest of your question
This should keep you busy for a while
Check out some other possible solutions there also.
Here you can load that image you took and analyze it.
But, you will have to read 😉 , before hands on -)
You can join the files by a simple Linux command
The same can be achieved using a cat.exe for Windows as well.
I am wondering why do you need to join these though??
If you are assuming that you need to join the split images into one prior to analysis or restoration, then it isn't true.
You can analyze the split image using Sleuthkit and Autopsy browser (which are freeware). You can even preview and restore the image using FTK imager as well. Hell, you can even join the image by reacquiring the split image using FTK imager but specifying the Image fragment size as 0 (which means that you are not opting for a split image)
Plenty of options in this case!
Thanks guys, all very useful posts. I will hopefully get analysing at the weekend.
Ps, Maybe I will start a bit of reading too.