If you are, as I am, a GCFA who attended Rob Lee's famous training in the not-so-recent past, you probably still are "carving out" partitions from within an acquired full disk "dd" image by running it through another "dd". Given how quickly the disk sizes are increasing, this is highly inefficient both in terms of disk space and analyst time used. But there's a better way. You already know how to use "loopback mount" on Linux to mount an image? Well, loopback mount supports an "offset" parameter that lets you mount a partition directly from within a larger full-disk image. Thusly:
root@ubuntu:/media/disk-1# ls -al total 39082701 drwxrwxrwx 1 root root 4096 2009-07-12 13:33 . drwxr-xr-x 4 root root 4096 2009-08-18 19:04 .. -rwxrwxrwx 1 root root 878 2009-07-07 11:46 fdisk -rwxrwxrwx 1 root root 701 2009-07-07 11:47 hdparm -rwxrwxrwx 2 root root 40020664320 2009-07-07 14:34 image-sda -rwxrwxrwx 1 root root 43 2009-07-07 12:02 md5sum -rwxrwxrwx 1 root root 43 2009-06-29 13:13 md5sum-sda drwxrwxrwx 1 root root 0 2009-07-11 19:03 $RECYCLE.BIN root@ubuntu:/media/disk-1# fdisk -ul image-sda You must set cylinders. You can do this from the extra functions menu. Disk image-sda: 0 MB, 0 bytes 255 heads, 63 sectors/track, 0 cylinders, total 0 sectors Units = sectors of 1 * 512 = 512 bytes Disk identifier: 0x9c879c87 Device Boot Start End Blocks Id System image-sda1 * 63 78140159 39070048+ 7 HPFS/NTFS Partition 1 has different physical/logical endings: phys=(1023, 254, 63) logical=(4863, 254, 63) root@ubuntu:/media/disk-1# mount -o ro,loop,offset='''32256''' -t auto image-sda \ /media/image
root@ubuntu:/media/disk-1# cd .. root@ubuntu:/media# cd image root@ubuntu:/media/image# ls -1 AUTOEXEC.BAT favorites ntldr Start Menu blp INFCACHE.1 pagefile.sys System Volume Information boot.ini IO.SYS Program Files temp CONFIG.SYS MSDOS.SYS RECYCLER WINDOWS Documents and Settings NTDETECT.COM spoolerlogs
The magic "32256" offset passed to "mount" is easily explained as the start of the partition you are interested in (63 in this case) multiplied by the unit size (512 in this case). If you have more than one partition, just repeat the above steps for the other slices. There you go. This easily saves several hours and untold gigabytes of disk space compared to the GCFA "carving out" method.
How To >