38 replies to this topic

[oriensol]

Here's a tool (adapted from Jaclaz's mbrbatch/mkimg batches) with a simplified interface to create hard disk images. The motivation to make this was to have an easy way to create a hard disk image, without worrying about the details.

It takes a filename for the disk image, a size in bytes (with optional K,M or G suffix for KB, MB or GB) and an optional /R parameter to create a disk image rounded to cylinder boundary.

You need to have these files from jaclaz's zip file to run this batch command: gsar.exe dsfo.exe dsfi.exe fsz.exe - http://www.boot-land...?...batch&st=40 . For AMD64, you will need the bpatcher from http://www.boot-land...?showtopic=5000 - see post 3 of Lancelot below.

Thanks to jaclaz.

Hope this helps.

D:\MBR Batch>hddimage



Usage: hddimage.cmd targetfile diskimagesize [round-to-cylinder=/R



targetfile is the path of the Disk Image File to be created



diskimagesize is the image size in bytes - add a suffix K, M or G for Kilo, M

ega or Giga



Optionally, specify '/R' to round the disk image size to cylinder boundary



1. A copy of the MBR is embedded inside a few system files:

- %SystemRoot%\System32\dmadmin.exe

- %SystemRoot%\System32\spcmdcon.sys

- %SystemRoot%\ServicePackFiles\I386\setupdd.sys

hddimage.cmd uses dmadmin.exe by default



If you are using a "lited" 2K/XP where this file has been removed

edit the batch accordingly, if you use the batch on just one system

you may also set a fixed offset and avoid the need for gsar.exe



If your OS doesn't have dmadmin.exe, find and copy it to the current directory



2.

The disk image is created with 255/63 geometry

Minimum disk image size is 16 MB (for 255/63 geometry)

If the size supplied is less than 32130 sectors, an image of size 32130 sector

s will be created

The largest possible partition is created, if size is not a multiple of 512

A single unformatted NTFS partition is created

Please format the partition later on to your liking

You may also create multiple partitions later on, if needed

Use the optional round-cylinder option (/R) to ensure image ends at cylinder b

oundary

Using /R will prevent the grub4dos warning while mapping the drive

Remember to use something like:

vdk open * imagename.pln [/RW] /p:1 [/l:z:]

each time you use the image with vdk or better still, do NOT use the /p switch at all

When the round-cylinder option is used, the size is 'increased', if needed

3.

You can mount the image using vdk

Use the .pln file in the target directory to open with 255/63 geometry using v

dk

The default geometry used by vdk is 64/32

vdk available from [url="http://chitchat.at.infoseek.co.jp/vmware/vdk.html"]http://chitchat.at.infoseek.co.jp/vmware/vdk.html[/url]

You can also mount the image using ImDisk

4.

EXAMPLES:

hddimage.cmd "X:\my folder\my disk.img" 20M

hddimage.cmd my_disk2.img 1G /R



D:\MBR Batch>

Please format the partition later on to your liking
Using /R will prevent the grub4dos warning while mapping the drive
Remember to use something like:
vdk open * imagename.pln [/RW] /p:1 [/l:z:]
each time you use the image with vdk or better still do NOT use the /p switch (thanks AGAIN to Jaclaz for pointing this out)
Use the .pln file in the target directory to open with vdk to ensure 255/63 geometry is used (thanks to Jaclaz for pointing this out)

Included the patch for AMD64 (see Lancelot's post 3 below).
Added .pln creation in target directory for use with vdk for 255/63 geometry (see Post 5 below)
Fixed problem with free space determination when using European Windows
Fixed AMD64 issue and removed use of echoo.com, using bpatcher instead in all cases
Added support for blanks in file path and name
Added check for dmadmin.exe in current directory and error if not supplied
If size given is less than 16 MB, instead of error message the smallest possible image is created
Fixed issue with special characters as numeric separator

Thanks owed to Lancelot for the suggestions for version 0.4 and testing the AMD64 issues.
Thanks to dera for help with testing version 0.5 - special numeric separator

Thanks to DooDoo - fixed the large file size free space comparison (and other possible similar issues) - in version 0.6.

The full set of needed files is available in the zip. The file list is: hddimage.cmd, gsar.exe, dsfo.exe, dsfi.exe, fsz.exe and bpatcher.exe.

You may need to manually copy dmadmin.exe to the hddimage directory, if it is not available at %SystemRoot%\System32\.

Latest version with all needed files can be downloaded from http://public.winbui.../hddimage06.zip

Uploaded the file to mediafire - previous link doesn't apparently work : http://www.mediafire...vyfvx7g2c67gfk2
Please keep informed of any issues you may find with Alpha 0.6.

[oriensol]

Some links:

http://www.boot-land...?showtopic=8265

http://www.boot-land...?...ic=8804&hl=

http://www.boot-land...?...ic=8862&hl=

http://www.boot-land...?showtopic=8168

http://www.boot-land...amp;hl=mbrbatch

[Lancelot]

Hi oriensol,

a minor thing , can you make batch not using echooo.com for hostosx64 compatibility
check post 6 here (if "%PROCESSOR_ARCHITECTURE%" == "AMD64" goto echooox64bypass....)

[oriensol]

@Lancelot

I have quickly updated the batch with the change for AMD64/bpatcher.

Thanks

[was_jaclaz]

Another thing.....

The advise to mount it with VDK is partially deceiving.

If you mount a 255/63 (or ANY xx/yy) geometry image under VDK directly it will be mounted with a a 64/32 geometry, which is something you DON'T want.

You need a .pln file with the right geometry and mount the .pln file (as opposed to the actual image .img file).

Should you have removed from MBRbatch the part that makes the .pln, one can use this "self-standing" batch:
http://www.forensicf...m...sc&start=38
(or a simplified version "fixed" to 255/63.



jaclaz

[oriensol]

@jaclaz

Thanks a lot.

Updated the tool with creation of .pln file in target directory in addition to the fix for AMD64.

When using with vdk use thus (/P:1 is optional as we have only one partition and /RW if you want the disk read/write):

vdk open * x:\myfolder\mydisk.pln /RW 

vdk open * my_disk2.pln /P:1

vdk open * my_disk3.pln /RW /P:1

vdk open * my_disk4.pln /RW

[oriensol]

Fixed a minor bug with .pln. Please redownload, if you downloaded version 0.2 within the past hour or so. Sorry.

[wimb]

The hddimage.cmd batch fails on non-English Windows Versions.
The FREEBYTES routine is the problem.

My language is Dutch and then I have to use "bytes beschikbaar" instead of "bytes free"
and a dot in "tokens=1-10 delims=." instead of a comma in "tokens=1-10 delims=,"

After these changes I can use the batch.

May be you can use other routine which supports International use.

[oriensol]

@wimb

Thank you. Should be fixed now.

Please download version 0.3.

[oriensol]

Revised 0.3 posted - removed assumption of English.

[wimb]

@oriensol

Thanks, hddimage.cmd runs now also in Dutch XP as OS.

[oriensol]

These are the updates:

Fixed AMD64 issue and removed use of echoo.com, using bpatcher instead in all cases
Added support for blanks in file path and name
Added check for dmadmin.exe in current directory and error if not supplied
If size given is less than 16 MB, instead of error message the smallest possible image is created

The full set of needed files is available at the link given in the first post. (The file list is: hddimage.cmd, gsar.exe, dsfo.exe, dsfi.exe, fsz.exe and bpatcher.exe)

Now the hddimage directory, the target path as well as the target file can have spaces.

Thanks to Lancelot for the suggestions for version 0.4 and testing the AMD64 issues.


Please keep informed of any issues, if you attempt to use this tool.

[oriensol]

Fixed special numeric separator character issue - thanks to dera

Link to new version Alpha 0.5 in first post.

[Doodoo]

Link to new version Alpha 0.5 in first post.

Thanks for this great tool ! For a very long time I've been struggling with ImDisk created images, which seem to be problematic... But all is great with HDDimage !

Well except a small problem that I can explain but don't know how to solve:

C:\>hddimage.cmd HDD1.img 1G /R

Creating an MBR from "C:\dmadmin.exe" with dsfo.exe

OK, 512 bytes, 0.000s, MD5 = 61a174a7d3cbe41d9996de0f124b7ebf</P> <P>Created hard-disk image HDD1.img &#40;Size=1077511680, Sectors=2104515, Cylinders=131&#41;

but

C:\>hddimage.cmd HDD1.img 4G /R

hddimage.cmd: Parameters supplied - HDD1.img 4G /R

hddimage.cmd: Error - Not enough freespace on drive  - needed 4301821440 bytes; available 29484929024 bytes

although
29484929024 is clearly larger than
4301821440

but for some reason (probably related to the maximum representable integer) the script doesn't think so....

[wimb]

Thanks for this great tool ! For a very long time I've been struggling with ImDisk created images, which seem to be problematic... But all is great with HDDimage !

ImDisk does Not create images, it mounts an image in a virtual drive

[Wonko the Sane]

ImDisk does Not create images, it mounts an image in a virtual drive

Well, NO.

IMDISK can create images too (using RAMDISK), but the point is that they are A DIFFERENT KIND of images.

IMDISK ONLY works on partitions or volumes or floppy or superfloppy images. (i.e. the first sector IMDISK loads is always and ONLY a bootsector).

VDK uses HD images, that may contain more than one partition or volume. (i.e. the first sector VDK loads is the first sector of the image, the MBR).
VDK can also mount "simple" partition images, but that's another story.

IMDISK CAN also mount HD images, by reading the MBR and THEN SKIPPING the whatever comes before the bootsector of the chosen partition.

If you format an image mounted in IMDISK the "sectors before" in the bootsector will ALWAYS be 0.

To repeat:

• VDK loads BOTH the partition AND the MBR+hidden sectors
• IMDISK loads ONLY the partition

For the record, there is a MS original driver also capable of mounting "whole HD" images:
http://www.boot-land...?...ic=6492&hl=


Wonko

[Doodoo]

IMDISK can create images too (using RAMDISK)

Well yes you can create images with "imdisk -f" or with the ImDisk control panel which few people probably use (but it explicitly says "HardDisk Volume" image, so it actually does what it says on the tin...)
Anyway thanks again for HDDimage which perfectly does the job... Any ideas anyone about my "Not enough freespace on drive" problem ? (fixed it for now by commenting out the test in the script... I would just like to understand why the test fails though !)

[Wonko the Sane]

Any ideas anyone about my "Not enough freespace on drive" problem ? (fixed it for now by commenting out the test in the script... I would just like to understand why the test fails though !)

There is a limit in the numbers the CMD.EXE can handle.

See here:
http://www.boot-land...?showtopic=2986

::=======================================================

::| WARNING! Limit is 2147483647 i.e. 7FFFFFF  WARNING! |

::=======================================================

Try running this batch :

SET /A A=2147483645

SET /A B=2147483646

:loop

PAUSE

SET /A A +=1

SET /A B +=1

ECHO %A%^<%B%

IF %A% leq %B% GOTO &#58;Loop

The point is here in hddimage.cmd:

IF %FREEBYTENUM% leq %Filesize% GOTO :NO-SPACE

One needs to write a slightly more complex comparison routine in order to support comparison between bigger numbers.


Wonko

[Doodoo]

There is a limit in the numbers the CMD.EXE can handle.

::=======================================================

::| WARNING! Limit is 2147483647 i.e. 7FFFFFF  WARNING! |

::=======================================================

Thanks Wonko. I didn't know that CMD.EXE had this 32-bit limitation (well in hindsight it seems fairly natural).

However I think the problem in the HDDimage script is a lot more profound.
In the script, the variables %FREEBYTENUM% and %Filesize% are not considered as integers (they are not defined using the /A switch in the SET command, like in your example)
It looks like they are considered as strings instead (which is also suggested by the fact that the error message displays the correct values, not the values modulo 2^32)

You might want to try this example too, which is very similar to what the script does....

SET A=4301821440 

SET B=29484929024

IF %A% leq %B% echo %A% is smaller than %B%

IF %B% leq %A% echo %B% is smaller than %A%

[Wonko the Sane]

Yes, you are right, the batch uses "my" multiply routine, which, exactly in order to workaround the numerical limitations of batches, does arithmetical operations using "text".

Still, the leq operator is the culprit.

You need something like:
[codebox]@ECHO OFF SETLOCAL ENABLEDELAYEDEXPANSION :comp SET A=1000146546 SET B=100018979 CALL :compare1 GOTO :EOF :compare1 SET A_length= SET /A Counter=0 :loop_A SET /A Counter+=1 SET A_length=!A:~0,%Counter%! IF %A_length%==%A% (SET /A A_length=%Counter%) ELSE (GOTO :loop_A) SET B_length= SET /A Counter=0 :loop_B SET /A Counter+=1 SET B_length=!B:~0,%Counter%! IF %B_length%==%B% (SET /A B_length=%Counter%) ELSE (GOTO :loop_ IF %A_length% lss %B_length% ECHO %A% ^< %B% IF %A_length% gtr %B_length% ECHO %A% ^> %B% IF %A_length% equ %B_length% CALL :compare2 GOTO :EOF :compare2 SET /A Counter=0 :loop_length SET A_digit=!A:~%Counter%,1! SET B_digit=!B:~%Counter%,1! IF %Counter% lss %A_length% (SET /A Counter+=1) ELSE (GOTO :Equal)
IF %A_digit% equ %B_digit% GOTO :loop_length
IF %A_digit% lss %B_digit% ECHO %A% ^< %B%&GOTO :EOF
IF %A_digit% gtr %B_digit% ECHO %A% ^> %B%&GOTO :EOF
:Equal
ECHO %A% = %B%
GOTO :EOF[/codebox]


Wonko

[oriensol]

I just saw this thread.

Thanks Doodoo for pointing this out.

Thanks Wonko for the suggested change.

I think I have a (what looks to me) simpler solution - which I will upload later on. The cause of the problem is the DOS's decision to be smart and do a numeric comparison even if they are strings when all characters are numeric.

Thanks again.

[oriensol]

@DooDoo

I have uploaded a new version. Please confirm if this is fine.

Thanks for your feedback.

[Doodoo]

Please confirm if this is fine.

Works like a charm !! Thanks for the very quick fix !! I can code pretty much anything in C, but when it comes to windows scripting, I'm useless and I would never have managed to do that !

[oriensol]

Thanks Doodoo for the feedback .

I am sure there will be more bugs like this still !

[Doodoo]

I know I might be asking a little bit too much, but how difficult would it be to add a command line switch to create a "contiguous image" as opposed to just "an image" (possibly fragmented) ? (NB: I am really asking about the feasibility, not about who, when, etc... )

That would be very useful, e.g. when booting direct from the file with GRUB4DOS instead of booting from RAM. Obviously it is always possible to defragment the image with contig, but I thought it would be nicer to make sure it is contiguous in the first place...

More generally, when copying an image file from A to B, is there anyway to ask windows to make sure the destination is not fragmented ? or any utility like xxcopy that can do so ?