603 replies to this topic

[erwan.l]

Minor, minor thing (only as a reminder, not worth any intervention until *something else* is needed).

RMPREPUSB created USB stick (Removable) with "hidden" 0x21 partition, the 2nd partition (or 2nd partition entry) is not enumerated correctly (it remains 0), more loosely the "Number" in the view should really be "Slot Number" or "Entry Number"

 

Actually, this is a "normal" behavior : windows only "consider" the first primary partition on a removable disk.

All other partitions are non existing (for windows) and therefore numbered with 0.

 

As opposed to a fixed drive, where all partitions would be numbered.

[erwan.l]

The:

1) Convert RAW to VMDK/VHD
2) Disk Image Conversion

 

Are somehow confusing, the working of the former could be included (consolidated) in the latter, removing one menu item.

 

Wonko

 

Actually, "Convert RAW to VMDK/VHD" would need to be reworded : it does not really convert but actually creates a header.

 

Disk conversion is mostly meant as converting files (vmdk, vhd, ewf, vdi, etc) to RAW.

[alacran]

@ erwan l

 

In your next update you may also update grub4dos 0.4.6a to a more recent version.

 

http://grub4dos.chen...4-6a/#year_2017

 

alacran

[misty]

Hi Erwan,

I've just downloaded clonedisk.zip and clonediskX64.zip from your site. The timestamps on the 64-bit build are a bit misleading -

• Properties > Details > Date modified 03/01/2016 15:22
• Properties > General > Modified 03 January 2016 15:22:02

Is this the latest version?

Misty

P.s. Including a text file with MD5 hash and version details in the download would be useful

[Wonko the Sane]

Actually, this is a "normal" behavior : windows only "consider" the first primary partition on a removable disk.

All other partitions are non existing (for windows) and therefore numbered with 0.

 

As opposed to a fixed drive, where all partitions would be numbered.

Sure, and as said it is "minor", but if you go Advanced->MBR, the # is about "Partition entry" or "Partition slot", that is what I would find confusing if I didn't already know about the matter.

Maybe - similarly to the PBR editor, you could have "valid" (as seen by windows) partitions with white background and "not valid" (as seen by windows) partitions background gray. , but IMHO the number should be referred to the "entry" or "slot".

 

 

 

Actually, "Convert RAW to VMDK/VHD" would need to be reworded : it does not really convert but actually creates a header.

 

Disk conversion is mostly meant as converting files (vmdk, vhd, ewf, vdi, etc) to RAW.

No, allow me to diasgree, the scope is always that of making things as simple and as less confusing as possible.

A conversion means to "transform" something in something else.

If you transform a whole disk RAW image into a "fixed" VHD by means of a header appending a footer you are converting.

If you transform a "fixed" VHD into a RAW image by means of stripping a header footer you are converting.

If you transform a whole disk RAW image into a "fixed" VMDK by means of a header (do you actually do that conversion? Or are you adding a VMDK descriptor file? Haven't tried.    )  you are making a conversion, etc.

In other words, I would find easier to have a choice "Image format conversion" where you can chose as source and destination suitable "couples" of formats, without the "special cases" for RAW to VHD and RAW to VMDK.

 

Wonko

[erwan.l]

Hi Erwan,

I've just downloaded clonedisk.zip and clonediskX64.zip from your site. The timestamps on the 64-bit build are a bit misleading -

• Properties > Details > Date modified 03/01/2016 15:22
• Properties > General > Modified 03 January 2016 15:22:02

Is this the latest version?

Misty

P.s. Including a text file with MD5 hash and version details in the download would be useful

 

 

ClonediskX64.zip has been refreshed.

It now contains a version.txt just like clonedisk.zip.

Beware that the x64 version is always slightly behind (extra work is needed for the x64 version).

[misty]

ClonediskX64.zip has been refreshed.
It now contains a version.txt just like clonedisk.zip.
Beware that the x64 version is always slightly behind (extra work is needed for the x64 version).

Thanks Erwan

[erwan.l]

it may help others : below the batch I use to generate version.txt.

set path="C:\Users\erwan\Documents\-= SOURCES =-\delphi\system\clone_disk"
set bin=clonedisk.exe
cd %path%
echo %bin% > version.txt
sigcheck.exe -n %bin% >> version.txt
for %%a in (%bin%) do echo %%~ta >> version.txt
md5 -n %bin% >> version.txt

[erwan.l]

May be of interest for Wonko, latest version can backup/restore partitions directly from the MBR editor.

The MBR editor can also parse a disk image.

 

 

One can also perform the same task in the partition editor.

 

Main difference is that MBR editor parses the MBR when Partition editor uses windows API.

 

[erwan.l]

 

No, allow me to diasgree, the scope is always that of making things as simple and as less confusing as possible.

A conversion means to "transform" something in something else.

If you transform a whole disk RAW image into a "fixed" VHD by means of a header appending a footer you are converting.

If you transform a "fixed" VHD into a RAW image by means of stripping a header footer you are converting.

If you transform a whole disk RAW image into a "fixed" VMDK by means of a header (do you actually do that conversion? Or are you adding a VMDK descriptor file? Haven't tried.    )  you are making a conversion, etc.

In other words, I would find easier to have a choice "Image format conversion" where you can chose as source and destination suitable "couples" of formats, without the "special cases" for RAW to VHD and RAW to VMDK.

 

Wonko

 

this is taken care of in latest version.

[erwan.l]

Sure, and as said it is "minor", but if you go Advanced->MBR, the # is about "Partition entry" or "Partition slot", that is what I would find confusing if I didn't already know about the matter.

Maybe - similarly to the PBR editor, you could have "valid" (as seen by windows) partitions with white background and "not valid" (as seen by windows) partitions background gray. , but IMHO the number should be referred to the "entry" or "slot".

 

 

I'll give it a thought.

For now, partition number comes from windows api/structure here.

[Wonko the Sane]

@erwan

Very good progresses



About the partition number as recovered by the api, it makes little sense to show the value 0 that it is returned ( as 0 ) , I mean. I do understand how the Api would return a 0, since the numbering is 1-based, maybe it would make more sense to "translate" the 0 to "N/A" or something like that.

If I get this right, this would happen only on non-first partition entries on Removable media, which would raise an interesting (side) question.

What happens on Windows 10 (latest-latest) that seemingly just changed the way Removable media is threated?



d@mn 500 server error!





Wonko

[rafael84]

Hello, Im trying to restore an image but no clue.

I made an e01 image with encase 8, image from whole 500gb HD. Now I need to restore it to other 500GB HD. How can I do it? The software dont show me any HD when I click disk unit, only when I click disk part. The HD is new, its not formatted. How can I choose this new HD and restore the e01 image to it?

 

thank you.

 

Edited: It was giving error on x64 version, with 32 its working  normally.

Edited by rafael84, 11 May 2017 - 08:19 PM.

[erwan.l]

Hello, Im trying to restore an image but no clue.

I made an e01 image with encase 8, image from whole 500gb HD. Now I need to restore it to other 500GB HD. How can I do it? The software dont show me any HD when I click disk unit, only when I click disk part. The HD is new, its not formatted. How can I choose this new HD and restore the e01 image to it?

 

thank you.

 

Edited: It was giving error on x64 version, with 32 its working  normally.

 

Glad you found on a solution the solution.

On x64, I believe you need to explicitly run as admin whereas on x32 CloneDisk will natively run as admin (provided you are an admin).

[erwan.l]

X64 version has been updated to version 2.3.6.

First post in this thread has been updated with a link (here) to the x64 version.

 

2.3.6 log file.

added : imapi, copy bootfile to temp folder to avoid file used error
added : source/target label in convert image form
added : backup_drive, zeromemory when readfile=false
added : vdi2raw added in image conversion
added : vmdk2raw added in image conversion
added : vhd2raw added in image conversion
added : backup/restore caption in backup/restore form
todo : complete code to backup/restore from/to vhd/vmdk/vdi
added : backup_devio simplified
modified : backup_drive->Drive2RAW,backup_ewf->Drive2EWF,backup_wim->Drive2WiM
modified : restore_drive->RAW2Drive,restore_ewf->EWF2Drive,restore_wim->WIM2Drive
fixed : rename frmmain src & dst to _src and _dst which were creating inconsistencis here and there
modified : cleanup in raw2drive
modified : cleanup in ewf2drive
modified : backup/restore to/from devio renamed to ... network
modified : unlockvolume in backup_devio
modified : cleanup in restore_devio
added : volumes
removed : mount point from 'symlinks - mount points' tab
removed : dosdevices in advanced tabs
removed : symlink in advanced tab
added : mount_vol and unmount_vol to udiskmgmt
added : change partition to number one in part editor
added : extra partition mbr types in part editor
modified : display disk id and part disk id, part id in updated column='device'
added : restore any BS boot code
modified : renamed NT6 to NT6.3 in boot sector and MBR
modified : boot sector fields editable in white
added : VolumeNameToDeviceName to lib and removed from ufrmvolume
added : GetVolumePathNamesForVolumeName to udiskmgmt
modified : wim/wimboot/skip empty parts grayed out when needed in restore/backup

Current version for X32 is 2.3.7 (work in progress).

Big cleanup in code so that eventually some modules from CloneDisk can be turned into smaller stand alone executables : PartMgr, VolumeMgr, DiskMgr, ...

modified : rewritten _enum_drives_lv to enumerate thru volumes not drive letters (x32)
modified : selected.caption replaced with inttostr(integer(lvdisks.Selected.data)) (x32)
modified : renamed convert to vmdk/vhd to create vmdk file descriptor
modified : added raw to vhd in disk conversion
modified : GetVolumeNameForVolumeMountPoint moved to udiskmgmt
todo : move md5 hash to disk image
added : if pos(':\',path)>0 then exit; in prep_src & prep_dst
added : backup/restore in mbr editor (x32)
modified : backup will now suggest a proper filename (x32)
modified : set disk ro and rw will go offline/online if disk is online (x32)
modified : VDI2RAW,vmdk2raw,vhd2raw,restore_devio,backup_devio,EWF2Drive,Drive2EWF moved to new uconvert unit (x32)
modified : createfile_devio,getfilesize_deviowrite_devio,prep_src,prep_dst,_lockdismount_vol,_unlock_vol moved to new uconvert unit (x32)
modified : vdi,LibVMDK,libVHDI,LibEWFUnit,wsck removed from umain (x32)
removed : privilege, ntdll, fmifs units
modified : GetDriveParams moved udiskmgt
removed : int13ext unit
modified : uformat renamed to ufrmformat
fixed : result set to 0 in lib._GetDosDrives
modified : Drive2RAW,RAW2Drive moved to uconvert unit (x32)
added : mode 0 in lib._EnumerateDosDevices to list all devices
added : list volume shadow copy volumes in volumes
added : add dos device in volumes
modified : renamed createvhd to umsvirtdisk
modified : renamed main to ufrmMain
modified : replaced custom wsck unit with delphi winsock unit
midified : libewf_SetCompressionValues uses LIBEWF_COMPRESS_FLAG_USE_EMPTY_BLOCK_COMPRESSION	(x32)
modified : ufrvolume, definedosdevice will try DDD_RAW_TARGET_PATH and 0 (32)
modified : drive2raw will display the offset if reafile fails (x32)
modified : xxx2RAW will propose to delete target file (x32)

[Wonko the Sane]

Before I forget, re:
http://reboot.pro/to...matted-as-ntfs/

Some time ago I tested Clonedisk "converted to vmdk from RAW" on Virtualbox and found a small glitch in Clonedisk:
https://www.forensic...wtopic/t=15861/

Actually it is a bug n VirtualBox that doesn't parse correctly the "# produced by CloneDisk":
https://www.forensic...er=asc/start=7/


Wonko

[erwan.l]

Before I forget, re:
http://reboot.pro/to...matted-as-ntfs/

Some time ago I tested Clonedisk "converted to vmdk from RAW" on Virtualbox and found a small glitch in Clonedisk:
https://www.forensic...wtopic/t=15861/

Actually it is a bug n VirtualBox that doesn't parse correctly the "# produced by CloneDisk":
https://www.forensic...er=asc/start=7/


Wonko

 

Did not read yet the ImDisk thread but clonedisk has been modded to take into account your report.

There should no longer be a "# produced by CloneDisk". 

[Wonko the Sane]

Did not read yet the ImDisk thread but clonedisk has been modded to take into account your report.
There should no longer be a "# produced by CloneDisk".

I seemed to remember I had told you, but today, while posting on the IMDISK thread I checked that my posts on forensicfocus were in September 2017, while last post here was June 2017, so I wan't sure it had been "fixed".  

Anyway all is well that ends well  .

 

Wonko

 

P.S.:

I found the reason why there was no mention here on the Clonedisk thread, it was on the IMGCONVERT one:

http://reboot.pro/to...653-imgconvert/

[erwan.l]

 

P.S.:

I found the reason why there was no mention here on the Clonedisk thread, it was on the IMGCONVERT one:

http://reboot.pro/to...653-imgconvert/

 

you beat me to it again : i did search for it (as I too remembered that discussion) but could never find it !

[Wonko the Sane]

you beat me to it again : i did search for it (as I too remembered that discussion) but could never find it !

Sure , I am "The Finder" for *some reasons*

 

Wonko

[sebus]

Any possibility of creating .vhds file? (part of the VHD Set, 260Kb in size, points to the renamed .vhdx which is now .avhdx )

[erwan.l]

Any possibility of creating .vhds file? (part of the VHD Set, 260Kb in size, points to the renamed .vhdx which is now .avhdx )

 

First time I hear about this format.

It is probably manageable thru the virtdisk.dll API's which I use already.

Let me have a look.

 

Current VHD and VHDX are supported in CloneDisk .

[sebus]

VHD Sets

[erwan.l]

I have uploaded a new version that may supports VHDS extension when creating/opening a virtual disk file.

 

I added that feature "blindly".

Indeed, you need windows 2016 to use VHDSET (and I dont have a w2k16 available).

On a system not supporting this new "provider", you should get an error like "provider not supported".

[sebus]

Sorry, but this version from today does not have .vhds available for creation/open