Case "multipartraw" Provider = DevioServiceFactory.GetProviderMultiPartRaw(DeviceName, DiskAccess)to the Select Case statement that begins at line 114. That's it. I will check in this change as soon as possible, but you could try adding these lines yourself meanwhile if you would like to try out your multi-part raw files.
Mounting Windows 8.1 disk from EWF
#26
Posted 17 April 2014 - 12:34 PM
#27
Posted 17 April 2014 - 12:42 PM
Yes, it works! Both Logical and Physical Raw images work!
If you ever get bored, here are some ideas:
* specify which partition to mount with an offset, just like with imdisk
* specify which driveletter to use (this may be a pain in the ass to do; if ArsenalImageMounterControl /query outputs which driveletters have been used for which offsets that would be sufficient as well)
I think this would make it easier to use AIM in a scripting environment..
Edited by theraven1982, 17 April 2014 - 12:53 PM.
#28
Posted 17 April 2014 - 12:54 PM
@Olof
Yep
More generally, the good thing about Forums like this one (and exchanging ideas/experiences/whatever through them) is that usually we can - one way or the other - have solutions suitable to both kind of people, i.e. those - like yours truly - that believe in the "less is more" paradigm and at the same time those that think that "latest is better" (and that *need* or *wish* or *likes* to have the very latest mass of bloat).
Wonko
- Olof Lagerkvist likes this
#29
Posted 17 April 2014 - 01:31 PM
- misty likes this
#30
Posted 17 April 2014 - 02:12 PM
Yes, it works! Both Logical and Physical Raw images work!
If you ever get bored, here are some ideas:
* specify which partition to mount with an offset, just like with imdisk
* specify which driveletter to use (this may be a pain in the ass to do; if ArsenalImageMounterControl /query outputs which driveletters have been used for which offsets that would be sufficient as well)
I think this would make it easier to use AIM in a scripting environment..
Thanks for the ideas, but I believe it could possibly turn out to be somewhat complicated...
Arsenal Image Mounter has no knowledge of concepts like drive letters, partitions and similar. All such things are left to disk.sys in Windows to handle. That's what makes it compatible with practically speaking all sorts of partition tables, filesystems and whatever that Windows handles for physical disks. Now, this also means that because such things are not directly managed by this Arsenal Image Mounter driver, it could turn out to be, not impossible of course, but complicated to implement some kind of tracking about these things.
Having said that, I would not be surprised if someone have already made a tool of some kind available for more general tasks like this. Tools that work with any kind of SCSI disk, physical, virtual, redirected, whatever and let you analyze and modify partitions and drive letters for these disks. But I don't know about one, maybe someone else do.
#31
Posted 17 April 2014 - 02:22 PM
Ah ok. I can work around it, so it's not a big problem. Thought that maybe it would be a few lines of code (that some function that you use from the Windows API returns information about a drive letter).
Carry on then
#32
Posted 17 April 2014 - 07:49 PM
Fantastic work
I do not actually have any EWF format disk images to test. I have however used ArsenalImageMounterService.exe to mount an NTFS compressed disk image I captured earlier today.
I also tested this in WinPE 5.0 with .NET Framework and HTA optional components installed - I don't know if HTA is also required, it just happened to be installed already. I had some issues actually installing the required drivers before running ArsenalImageMounterService.exe - neither ArsenalImageMounter-DriverSetup.exe nor running the following command...
rundll32.exe setupapi.dll,InstallHinfSection DefaultInstall 132 phdskmnt.inf...worked in my WinPE build (it's very basic - other than the optional components I mentioned).
I was forced to install the required drivers by running ArsenalImageMounterMountTool.exe. Any suggestions on installing the drivers in WinPE - preferably via the commandline?
Regards,
Misty
#33
Posted 17 April 2014 - 08:15 PM
@olof
Fantastic work
Thanks!
I do not actually have any EWF format disk images to test. I have however used ArsenalImageMounterService.exe to mount an NTFS compressed disk image I captured earlier today.
I also tested this in WinPE 5.0 with .NET Framework and HTA optional components installed - I don't know if HTA is also required, it just happened to be installed already. I had some issues actually installing the required drivers before running ArsenalImageMounterService.exe - neither ArsenalImageMounter-DriverSetup.exe nor running the following command...
rundll32.exe setupapi.dll,InstallHinfSection DefaultInstall 132 phdskmnt.inf...worked in my WinPE build (it's very basic - other than the optional components I mentioned).
I was forced to install the required drivers by running ArsenalImageMounterMountTool.exe. Any suggestions on installing the drivers in WinPE - preferably via the commandline?
You cannot install this kind of driver using rundll32.exe in that way. It is a plug-and-play driver, so in one way or another you need to install it through plug-and-play functions. One way would be to pick the correct .inf for your Windows version and architecture and use devcon.exe:
devcon install path\phdskmnt.inf ROOT\PhDskMnt
Something like that should work. Otherwise, there is also ArsenalImageMounterCLISetup.exe. If you unzip DriverSetup\DriverSetup.7z to somewhere, you can run ArsenalImageMounterCLISetup.exe /install there to install the correct version of the driver automatically.
- misty likes this
#34
Posted 17 April 2014 - 08:43 PM
@Olof.... Otherwise, there is also ArsenalImageMounterCLISetup.exe. If you unzip DriverSetup\DriverSetup.7z to somewhere, you can run ArsenalImageMounterCLISetup.exe /install there to install the correct version of the driver automatically.
Thanks - this command worked.
Misty
- Olof Lagerkvist likes this
#35
Posted 03 June 2014 - 12:58 PM
Maybe I should open a new topic, but the question is very adjacent to what was asked before in this thread.
I have a second system (Windows 7 x86) in which I cannot get ArsenalImageMounterService to work correctly. I downloaded the latest version, and when I use the ArsenalImageMounterMountTool program, I can mount everything: multipart Raw disks, multipart EWF files, etc. When I do this, the partitions that reside in these images are recognized correctly: the partitions are viewable in the Explorer.
However, when I use the ArsenalImageMounterService /mount /filename=E:\EWF.E01 /provider=LibEwf command, it mounts the disk, but only shows the full disk size as unallocated (same goes with /provider=multipartraw). I added the x86 libewf/zlib/msvcr100 DLLs to the directory the exe is called from.
So it does find all the segments of the image correctly, but there seems to be something missing. I'm 99.9999% sure I'm doing it right, as my other machine accepts this command and shows the contents correctly.
Any ideas?
thanks in advance,
#36
Posted 03 June 2014 - 01:35 PM
This seems strange. I cannot think of anything that is practically done in any different way in console application compared to GUI application. There could be a few issues around auto-detection of disk partitions though that could have different effects when used from different applications (timing issues principally).
A few things you could try though, is right-click and Rescan or Refresh in Disk Management, or "rescan" command in diskpart command line tool. There is also a /rescan switch to ArsenalImageMounterControl.exe that you could try.
#37
Posted 03 June 2014 - 02:04 PM
Right click in Disk Management and Rescan disks: the management console stops responding. Note that if I haven't mounted a disk yet, the Disk Management GUI opens quickly. If I subsequently mount a disk with Arsenal it shows up quickly (but all as unallocated).
However, if I mount the disk with Arsenal, and THEN open Disk Management, it will not show any disks (window is not responding) until I remove the mounted disk (Ctrl-C in the CMD window).
The /rescan option shows: "Result: True". Nothing changes.
If I use diskpart, I can select the disk (only if I mount the disk after diskpart was started.. otherwise I can't enter commands). I can select the disk, and it shows one large partition which cannot be opened).
Edited by theraven1982, 03 June 2014 - 02:06 PM.
#38
Posted 03 June 2014 - 02:25 PM
That's even more strange. It looks like the driver stops responding for some reason. Or maybe the driver is alive but the communication with libewf.dll in the service exe gets stuck for one reason or another. I am a little out of ideas right now, but I will check a few things and come back to this matter as soon as I have any idea or something!
#39
Posted 03 June 2014 - 02:57 PM
(same user as above.. I'm at home now, and reboot.pro does not allow me to log in with my account here).
Anyway, it's not a libewf problem, as the same issue occurs when I connect a multisegment Raw file. Haven't tried a single raw file yet, but will do so tomorrow. Don't know if this makes it easier to debug or even worse...
#40
Posted 04 June 2014 - 05:17 AM
(didn't explicitly mention it, but I didn't compile the sources, but instead downloaded the files from the website).
If you want, I can try to compile the files (I have VS2012 Express installed) and see if there are any warnings/errors? Not sure if those would show up during the compile stage... you're the expert
#41
Posted 04 June 2014 - 06:06 AM
Thanks, but I agree that errors like these are not likely to show up during compile time. I would say that some communication problem between the driver and the service exe (and thereby connected libraries) is the most probable cause. A few debug printouts from service exe when it receives from or sends messages to the driver would probably be useful.
#42
Posted 04 June 2014 - 06:30 AM
Where can I view these messages? The event log only displays 'The system failed to flush data to the transaction log. Corruption may occur.'
The ArsenalImageMounterService.exe command only displays messages about the date_time_values-string, header_values and value_64bit. No errors or warnings.
#43
Posted 04 June 2014 - 06:49 AM
#44
Posted 04 June 2014 - 06:59 AM
Ah, no worries. Take your time (I know it's still early )
There's no /verbose or /debug flag. Furthermore (if you're going to add it anyway), there's no /provider=multipartraw flag in the help (but it does accept it as a valid parameter).
#45
Posted 04 June 2014 - 12:33 PM
The switch is, quite surprisingly, /trace which I for some reason did not remember. Try it and see if it could give any hints about what happens. I see in the source code that the printouts are not extremely detailed, just simply somewhat detailed, including in particular when something changes, errors occur etc, but not for each read/write operation.
#46
Posted 04 June 2014 - 12:49 PM
Thanks for the reply. I used the /trace option, and this was the output: http://pastebin.com/vv4qAbKS
(skipped some non-problematic looking info..)
Seeing the write-request related problems, I specified the /readonly flag, and everything worked alright... So it's not a big problem (and somewhat a mistake on my part).
I checked it on my 64 bit machine (zip from github downloaded from April 16) and it did not require the /readonly flag.
Thanks Olof!
Also tagged with one or more of these keywords: imdisk, windows 8.1, inaccessible
Groups →
Project forge →
ImDisk →
Does ImDisk support drives on External Drive?Started by NobodyWithNoName , 04 Nov 2022 imdisk |
|
|
||
Groups →
Project forge →
Load_RamDiskStarted by alacran , 28 Aug 2022 imdisk, ramdisk |
|
|
||
Groups →
Project forge →
ImDisk →
ImDisk stopped working properly on Windows 11Started by NobodyWithNoName , 14 Jun 2022 imdisk, windows11 |
|
|
||
Groups →
Project forge →
ImDisk →
4k Read/Write speed very slow when select "Use AWE physical memory"Started by yygymcu , 08 Feb 2022 imdisk, ramdisk |
|
|
||
Groups →
Windows Extreme →
Windows 8 →
How to permantly disable the start menu in windows 8.1?Started by popoof22 , 26 Jun 2020 windows 8, windows 8.1, windows and 3 more... |
|
|
1 user(s) are reading this topic
0 members, 1 guests, 0 anonymous users