HackTricks
Search…
Pentesting
Powered By GitBook
Image Adquisition & Mount

Acquisition

DD

1
#This will generate a raw copy of the disk
2
dd if=/dev/sdb of=disk.img
Copied!

dcfldd

1
#Raw copy with hashes along the way (more secur s it checks hashes while it's copying the data)
2
dcfldd if=<subject device> of=<image file> bs=512 hash=<algorithm> hashwindow=<chunk size> hashlog=<hash file>
3
dcfldd if=/dev/sdc of=/media/usb/pc.image hash=sha256 hashwindow=1M hashlog=/media/usb/pc.hashes
Copied!

FTK Imager

1
ftkimager /dev/sdb evidence --e01 --case-number 1 --evidence-number 1 --description 'A description' --examiner 'Your name'
Copied!

EWF

You can generate a dick image using the ewf tools.
1
ewfacquire /dev/sdb
2
#Name: evidence
3
#Case number: 1
4
#Description: A description for the case
5
#Evidence number: 1
6
#Examiner Name: Your name
7
#Media type: fixed
8
#Media characteristics: physical
9
#File format: encase6
10
#Compression method: deflate
11
#Compression level: fast
12
13
#Then use default values
14
#It will generate the disk image in the current directory
Copied!

Mount

Several types

In Windows you can try to use the free version of Arsenal Image Mounter (https://arsenalrecon.com/downloads/) to mount the forensics image.

Raw

1
#Get file type
2
file evidence.img
3
evidence.img: Linux rev 1.0 ext4 filesystem data, UUID=1031571c-f398-4bfb-a414-b82b280cf299 (extents) (64bit) (large files) (huge files)
4
5
#Mount it
6
mount evidence.img /mnt
Copied!

EWF

1
#Get file type
2
file evidence.E01
3
evidence.E01: EWF/Expert Witness/EnCase image file format
4
5
#Transform to raw
6
mkdir output
7
ewfmount evidence.E01 output/
8
file output/ewf1
9
output/ewf1: Linux rev 1.0 ext4 filesystem data, UUID=05acca66-d042-4ab2-9e9c-be813be09b24 (needs journal recovery) (extents) (64bit) (large files) (huge files)
10
11
#Mount
12
mount output/ewf1 -o ro,norecovery /mnt
Copied!

ArsenalImageMounter

It's a Windows Application to mount volumes. You can download it here https://arsenalrecon.com/downloads/

Errors

    cannot mount /dev/loop0 read-only in this case you need to use the flags -o ro,norecovery
    wrong fs type, bad option, bad superblock on /dev/loop0, missing codepage or helper program, or other error. in this case the mount failed due as the offset of the filesystem is different than that of the disk image. You need to find the Sector size and the Start sector:
1
fdisk -l disk.img
2
Disk disk.img: 102 MiB, 106954648 bytes, 208896 sectors
3
Units: sectors of 1 * 512 = 512 bytes
4
Sector size (logical/physical): 512 bytes / 512 bytes
5
I/O size (minimum/optimal): 512 bytes / 512 bytes
6
Disklabel type: dos
7
Disk identifier: 0x00495395
8
9
Device Boot Start End Sectors Size Id Type
10
disk.img1 2048 208895 206848 101M 1 FAT12
Copied!
Note that sector size is 512 and start is 2048. Then mount the image like this:
1
mount disk.img /mnt -o ro,offset=$((2048*512))
Copied!
Last modified 4mo ago