Image file Offset
Posted 17 May 2007 - 12:41 PM
VMware vmdk, Microsoft SDI, and so on.
Probably Jaclaz has already posted in other threads here or on 911cd.net forums different well documented infos about this.
If we could put them together here, it would help to find the required steps to compute the offset.
Posted 17 May 2007 - 01:08 PM
There are different images.
XP embedded sdi image: a hard disk image with a header.
8 sector header: sector zero of a hard disk. And partion geometry use CHS 63 sectors.
Therefore boot sector of first partition is at sector 71.
A hd sector contains 512 byte data.
Note: The first 4 KB of each SDI image file consists of the SDI header information.
SDI Disk image: 4096 SDI header + 32256 DISK BLOB offset: -b 36352
Posted 17 May 2007 - 01:59 PM
The VMWare disk image contains more than just one partition, it's a *disk* image, so it represents the entire drive and not a single partition.
it depends entirely on the partition layout of the image in question. Also, this assumes that the image has only one partition, since it copies the entire disk but skips the first 32256 bytes (63 sectors) to the beginning of the first partition.
Here's the explanation that explain how I computed that the first partition (yes theres is only one in the image) start at sector 63:
in the image the first partition start at CHS 0/1/1 (from the partition table in last 66 bytes of the first 512 bytes of the image, aka the MBR)
The equation to convert from CHS to LBA follows:
LBA = ( ( CYL * HPC + HEAD ) * SPT ) + SECT - 1
LBA: linear base address of the block
CYL: value of the cylinder CHS coordinate
HPC: number of heads per cylinder for the disk
HEAD: value of the head CHS coordinate
SPT: number of sectors per track for the disk
SECT: value of the sector CHS coordinate
with (from file tiger-x86.vmdk)
ddb.geometry.sectors = "63"
ddb.geometry.heads = "16"
ddb.geometry.cylinders = "9825"
LBA = (0 + 1) * 63 + (1 - 1) = 63
that is sector 63
63*512 = 32256
vmdk VMware flat disk images: -b 32256
Posted 22 May 2007 - 10:03 AM
cdob here on SDI and VMDK images:
Virtualbox .vdi image:
from further tests it appears that the offset is NOT fixed, it seems to be dependant on disk size.
Basically, it is very easy to determine where the "real" RAW image starts, with the help of gsar or similar search utility, as long as the image has been formatted.
Both MBR and bootsectors have the "magic signature" 55AA as LAST two bytes.
Microsoft DOS 6.22 MBR starts with FA33C0
Microsoft's Win9.x/ME/Win2k/XP/2003 MBR starts with 33C08E
FAT 12/16 bootrecord starts with EB3C90
FAT 32 bootrecord starts with EB5890
NTFS bootrecord starts with EB5290
Posted 30 May 2007 - 12:00 AM
Posted 30 May 2007 - 01:49 AM
Posted 30 May 2007 - 01:53 AM
you may implement an automatic offset "suggestion" in the cpl (i.e. the offset field may be already filled), by looking at first bytes of the file like unix file utility does
Yes, I have plans for implementing that. I am collecting information about different image file formats so that it could be used for automatically finding offset values in future releases.
Posted 04 April 2008 - 05:25 AM
Works fine but I wonder if it is possible to use ImDisk for this purpose (mounting VHD images)? Somebody knows the offset for VHD images?