Disk Image tools

Phishfry · Jul 11, 2017

I would like to be able to view the structure of a disk image file.
What are the FreeBSD tools for working with images?
Are there any GUI based .img viewers?
NanoBSD is beating me down.

Phishfry · Jul 11, 2017

How important is the correct bs= when dd 'ing a disk image?
bs=bit sectors.
When I run diskinfo -v da0 for my USB -SD card reader I see this:

Code:

root@E6420:~ # diskinfo -v da0
da0
   512             # sectorsize
   16139354112    # mediasize in bytes (15G)
   31522176       # mediasize in sectors
   0               # stripesize
   0               # stripeoffset
   1962           # Cylinders according to firmware.
   255             # Heads according to firmware.
   63             # Sectors according to firmware.
   000000000903   # Disk ident.
   Not_Zoned       # Zone Mode

So should I be using bs=512 with this SD card? I have been using 1M.

Phishfry · Jul 11, 2017

Using file I can see some of the contents:

Code:

root@E6420:~ # file /raid1/Images/_.disk.image.i386
/raid1/Images/_.disk.image.i386: DOS/MBR boot sector; partition 1 : ID=0xa5, start-CHS (0x3ff,255,63), end-CHS (0x3ff,255,63), startsector 1, 65536 sectors; partition 2 : ID=0xa5, active, start-CHS (0x3ff,255,63), end-CHS (0x3ff,255,63), startsector 65537, 334976 sectors

tobik@ · Jul 11, 2017

Phishfry said:
What are the FreeBSD tools for working with images?

You can create a md(4) device backed by an image with mdconfig(8) and then use all the standard tools like gpart(8) etc. on it.

sko · Jul 11, 2017

Phishfry said:
bs=bit sectors

Have a look at dd(1) - bs sets the blocksize. With flash drives 1m is common but as the drive handles the blocksize itself it doesn't really matter except for performance...

Phishfry · Jul 11, 2017

OK got that mixed up block size not bit sector.
Did more reading and it is a speed thing.
It would still boot even at bs=1

I have used this wiki to mount my .img with mdconfig in testing
http://forensicswiki.org/wiki/Mounting_Disk_Images

wblock@ · Jul 15, 2017

dd(1) for copying binary images. Set bs= to 64k or more for performance. There is not much point to going larger than 1m or maybe 8m.
gpart(8) for dealing with partitioning.
file(1) for determining types of filesystems or other content.
mdconfig(8) for mounting binary image files. See the examples at the end of the man page for some useful things, like skipping over initial content.

vince66 · Dec 21, 2017

Hello wblock,

in this post you list the programs to:
dd a drive,
determine filesystems type
and mount binary images.

Please, can you tell me for FreeBSD O.S. programs that extract data (also deleted) from an image file ?

Thanks in advance.

vince66 · Dec 21, 2017

Another question.

Phishfry, about diskinfo, can you tell me more about the last parameter Not_Zoned. What is it ? Is maybe it related with the timezone ?

Thanks. !

Phishfry · Dec 22, 2017

I serious doubt that #Zone Mode has anything to do with timezone.

Code:

root@E6420:~ # diskinfo -t ada0
ada0
   512             # sectorsize
   64023257088    # mediasize in bytes (60G)
   125045424       # mediasize in sectors
   0               # stripesize
   0               # stripeoffset
   124053         # Cylinders according to firmware.
   16             # Heads according to firmware.
   63             # Sectors according to firmware.
   141183401444   # Disk ident.
   Not_Zoned       # Zone Mode

vince66 · Dec 22, 2017

Yes, it is strange.
Please, do you know if filesystems FAT16/32, exFAT and NTFS store the timezone informations once a file is created ?

Snurg · Dec 22, 2017

AFAIK practically every OS since the transition from 8 to 16 bit computing has timestamps.
You could google this so easily...

Old FAT is even in Wikipedia: https://en.wikipedia.org/wiki/Design_of_the_FAT_file_system
http://www.ntfs.com/exfat-file-directory-entry.htm

NTFS is a proprietary undocumented file system.
https://www.cnwrecovery.com/manual/NTFSDirectoryEntryMFT.html
I have high respect to the FUSE guys who did a great deal of reverse engineering.

Please tell more about your concrete data loss scenario, or what makes it so important to find time/date information on some Microsoft based file systems, because it depends on that what strategies you can apply.