7 replies to this topic

[cancelled]

How can I mount a raw DD image of a drive that is split into many smaller files?

ie: instead of mounting myimage.dd I want to mount myimage.dd.01, myimage.dd.02, myimage.dd.03, myimage.dd.04, etc.

[TheHive]

Welcome to the community.
First a first post. That possibility seems like a good idea.

[cancelled]

Welcome to the community.
First a first post. That possibility seems like a good idea.

Thank you.

If the capability to mount split files is built into IMDISK, I can't figure out how.
If it is not built in, it seems from what I am reading on this forum that a simple user-land script can be written to handle the translation between the IMDISK device and the actual file layout. Could someone elaborate on that? I could write this script in Perl if I understood what the interface is (Note: I am running on Windows, not Linux).

[Olof Lagerkvist]

If the capability to mount split files is built into IMDISK, I can't figure out how.

There is no such feature at the moment.

If it is not built in, it seems from what I am reading on this forum that a simple user-land script can be written to handle the translation between the IMDISK device and the actual file layout. Could someone elaborate on that? I could write this script in Perl if I understood what the interface is (Note: I am running on Windows, not Linux).

You are right, this would probably be the easiest way to implement this. The user-mode program must answer I/O requests, either over a TCP/IP connection or a named pipe. The protocol used is quite simple, the headers are specified in the file inc\imdproxy.h in the source package.

I could write this myself but it would take a while before I can do it, the problem is that I have a lot of other things to do right now but it would not be any problem otherwise

[pscEx]

The job seems to be interesting for everybody.

But I have some concerns:

@Turtlecove: Do you really need this feature or is it just an 'academic' idea?
If you need, please explain your background.

I would not agree that Olof spends a lot of time, just to proof that a 'theoretical construction' can be done with his ImDisk driver.

If it is really needed:
@Olof: I give you time to finish until eastern (and you tell us which year)

Peter

[cancelled]

The job seems to be interesting for everybody.

@Turtlecove: Do you really need this feature or is it just an 'academic' idea?

Yes, I need it; It is not just academic.
I work with disk images made by tools such as FTK Imager and dcfldd (dd) using the split option. These tools prefer to split the image into smaller segment files. The smaller files can be stored on FAT32 filesystems and moved between Windows, Linux, and Mac more easily.

There are many excellent utilities that work on single monolithic disk images, such as Scalpel and various anti-virus tools for example. These tools cannot work on the split images. If I could mount the split images as a drive I could run these tools against the mounted drive.

Another goal is to use libewf to make IMDISK able to mount EnCase images directly. There is a similar program mount-ewf but it is Linux ONLY.

[gdh]

<Commercial app name> will mount segmented DD files

<link to site of the Commercial app>


Post edited by jaclaz see below.

[was_jaclaz]

@gdh
Sponsoring Commercial apps is deprecated on this forum.

It is, to say the least, strange that you join the board and on your first post you do the above.

The fact that your IP and e-mail appear connected to the actual manufacturers/sellers of the product makes me think that this is a form of "hidden" advertisement, that is FORBIDDEN on this forum.

Thus, I am removing the link you posted, and you should consider this as first warning, do it again and I'll see you out of this forum in NO time.

@Turtlecove
VDK by Ken Kato can mount RAW images divided in sections through the use of VMware v.2.00 .pln descriptor file.

Read this:
http://www.msfn.org/...i...1.html&st=1

I also wrote a small batch to autocreate a .pln descriptor file, at the moment it is aimed to monolithic images, but you can modify it to suite your needs:
http://www.forensicf...m...sc&start=42

jaclaz