DD format processing

Nov 7, 2011 at 11:20 PM

Does DiscUtils have source code for extracting content from DD image files? Thanks.

Coordinator
Nov 12, 2011 at 9:28 AM

Yes - it can handle raw disk images.  To try it out, you can do something like this:

DiskDump.exe -dt RAW mydiskimage.dd

Cheers,

Ken

Nov 17, 2011 at 1:01 AM

I built the diskdump utility but it does not have any -dt option.

I created an image using dd and used the following:

DiskDump.exe -db d:\discutils\test\zip.dd and it failed.

I noticed that it does not accept the RAW option and I could generate a dump from the file once I changed the file extension to img i.e. zip.img

i.e. DiskDump.exe -db d:\discutils\test\zip.img dumped the content on the console.

The DiskDump.exe that I built emits the following when invoked with -h

------------

DiskDump <switches> disk0 disk1 ...

Parameters:  disk0..n  Paths to the disks to inspect.  Where a volume manager is used  to span volumes across multiple virtual disks, specify all  disks in the set.

 Values can be a file path, or an iSCSI or   NFS URL.  URLs for iSCSI LUNs are of the form:  iscsi://192.168.1.2/iqn.2002-2004.example.com:port1?LUN=2.

 Use the iSCSIBrowse utility to discover iSCSI URLs.  NFS URLs            are of the form: nfs://host/a/path.vhd.

Switches: 

  -db                 Includes a hexdump of all disk content in the output  -diskbytes
  -vb                 Includes a hexdump of all volumes content in the  -volbytes           output
  -sf                 Includes a list of all files found in volumes  -showfiles
  -u <user_name>      If using an iSCSI source or target, optionally use  -user <user_name> ..

  -pw <secret>        If using an iSCSI source or target, optionally use  -password <secret>  this parameter to specify the password to authenticate with.

  -h                  Show this help.  -?  -help
  -q                  Run quietly.  -quiet

------

Is this the right application to extract content from a DD image file?

Thanks for any help.

Coordinator
Nov 17, 2011 at 7:56 AM

If you're building from source - best to use the very latest source, which includes the 'dt' option.  I haven't issued a release for quite some time, so the most recent release is fairly out of date.

DiskDump will show you the contents of a disk if you use '-sf' option, and it's a file system DiscUtils understands.

 

Cheers,

Ken

Nov 17, 2011 at 8:40 PM

Thanks - with the latest code, I can now list the disk content using DiskDump.exe -sf -dt RAW <file_path>.

Is there any utility to mount the content of the disk as a virtual disk so that we can browse and extract content from specific files using a standard client?

Or do we need need to write code similar to how showDir is doing - opening the volume and using the .NET System.IO classes to extract the content?

Thanks,

Shantanu

Coordinator
Nov 18, 2011 at 6:28 AM

Three options:

  • Code an app against the discutils library
  • Use the PowerShell module that's part of DiscUtils, which lets you create PowerShell drives and navigate around inside a disk using PowerShell
  • Use dokan to mount as a real OS disk: http://dokandiscutils.codeplex.com/

Cheers,

Ken