Jul 12, 2009 at 8:53 PM
Edited Jul 12, 2009 at 8:56 PM
I've been playing with DiscUtils using (some of) the disc images from the
Digital Forensics Tool Testing Images available on Sourceforge.
Is there a simple method of determining what the file system of a partition in a stream is?
For example, whilst the following works, and bpt.Partitions.Count shows that there are 4 partitions:
using (FileStream ddFileStream = File.Open(file, FileMode.Open, FileAccess.Read))
Geometry geometry = BiosPartitionTable.DetectGeometry(ddFileStream);
BiosPartitionTable bpt = new BiosPartitionTable(ddFileStream, geometry);
The BiosPartitionInfo TypeAsString is "UnKnown", and the GuidType is empty. If I create a new NtfsFileSystem object, then everything works fine, even as far as retrieving some of the jpeg image files from one of the images. The reason I'm trying
to do this, is that I could then write a Factory class to create instances of the relevant IFileSystem whenever I load in a file.
My next question then, is how would you go about mounting a particular partition, or accessing the contents of a particular partition.
This library is amazingly well put together :)
Also as a side note, the first of those disc images has an extended partition table, and loading it in using the above code throws an IOException:
"Unable to complete read of 512 bytes"
at DiscUtils.Utilities.ReadFully(Stream stream, Int32 count)