5 replies to this topic

[a232]

Hi All,

I have a disk image file I made with ddrescue that I am trying to mount under WinXP. This is my first time doing so, so I am just learning from Googling and experimenting with various methods I see discussed.

I have tried to mount it using the 3 above methods with little success. I think the problem in the case of VDK is that I need to somehow convert dd format image to vmdk format. Is this the case? If so, how do I do so?

With the other two, I am guessing that I am not specifying offset or geometry properly. (With FileDisk, which I only used briefly, I don't even see how to specify offset yet...)

I see references around the 'Net to this post -- http://www.boot-land...LPHA-t3191.html -- containing, I suppose, some "common" geometry info, but I don't find it on this site.

Is it possible to successfully mount this image under WinXP using free tools? If so, how?

Please help! Thank you!

[was_jaclaz]

Sure, no problem.

The link you find is invalid because at a certain time the board used "friendly names" that have been later removed, thus this:

hxxp://www.boot-land.net/forums/MBRBatch-001-ALPHA-t3191.html

"translates" to:

hxxp://www.boot-land.net/forums/?showtopic=3191

i.e. this:
http://www.boot-land...?showtopic=3191

But the problem might be not that of geometry, but about filesystem.

Briefly:
1. Almost ANY modern hard disk will have a geometry of nx255x63
2. VDK by default uses the "old" NT 4.00 standard geometry of nx64x32
3. But the geometry should normally affect not the "normal" mounting of a hard disk image
4. There is a way to assign a given geometry through the use of a .pln file (VMware version 2.x file descriptor), see here:
http://www.forensicf...m...opic&t=1489

the above is VDK related.

For IMDISK, you have to give it the correct offset to the partition bootsector.
First partition is always at the geometry Sectors offset, usually 63 sectors=blocks or 63x512=32256 bytes, unless it is a logical volume inside extended partition.
Second and further partitions can be anywhere, you need to find their start point.

Mount the file "as is" with VDK, optionally using my pseudo-GUI for it.
You will have by default 4 "PhysicalDrive"'s added to the system, of which the first one will be your RAW image.
Access it with a partition utility like beeblebrox:
http://students.cs.byu.edu/~codyb/
to see the values in the MBR and get the correct adresses and geometry of the data inside the image.

This spreadsheet might be handy to help you:
http://www.boot-land...?showtopic=2959

But, once you have the correct address for the offset of IMDISK (or geometry for VDK), the filesystem needs to be among the "recognized ones":
FAT12
FAT16
FAT32
NTFS
if it's EXT2/3 or ReiserFS, or whatever, you need to install an appropriate filesystem driver in order for the drive to be "recognized".

If you cannot get it right, when you have mounted the image in VDK, use hdhacker:
http://dimio.altervista.org/eng/
to save a copy of the MBR (PhysicalDrive) or however (with dd, dsfok, a hexeditor or whatever) copy the first 512 bytes of the image to a file and attach it to your next post, I'll have a look at it and may be able to further help you.

jaclaz

[a232]

[...a lot of useful info!...]

Jaclaz, thank you very much for the info!

It was your comment on http://windowsir.blo...g-dd-image.html which led me in this direction, so thank you also, for that!

I will experiment with what you have explained and report back w/ results. Wish me luck!

[a232]

Success!

I was able to successfully mount/read the partition with IMDISK after using Beeblebrox to find the offset!

It all makes good sense now -- Windows isn't prepared to address a complete disk image as a drive letter; it needs to be pointed to a partition!

Thanks!

[was_jaclaz]

Success!

I was able to successfully mount/read the partition with IMDISK after using Beeblebrox to find the offset!

It all makes good sense now -- Windows isn't prepared to address a complete disk image as a drive letter; it needs to be pointed to a partition!

Thanks!

Happy about your success , but it's not a Windows problem, and it's not a problem at all actually, it is by design:
VDK is a "Hard disk" driver and CAN address and mount a "complete" disk image, by parsing the MBR, and assigning drive letters to the found partition(s)
IMDISK is a "partition" (or if you prefer a "superfloppy" or "volume") driver and knows NOTHING about the MBR and assigns a drive letter to whatever you give it

In other words:
VDK expects either a MBR or a bootsector as first sector of the image (NO "offset")
IMDISK expects only a bootsector as first sector (at the given "offset")



jaclaz

[was_jaclaz]

Just for the record, newish versions of IMDISK try and find the offset, see here:
http://www.boot-land...?...=2148&st=20

jaclaz