LinuxQuestions.org - dd and mount command

- Linux - Security (https://www.linuxquestions.org/questions/linux-security-4/)

- - dd and mount command (https://www.linuxquestions.org/questions/linux-security-4/dd-and-mount-command-4175485535/)

mitra86

11-22-2013 12:20 PM

dd and mount command

Hi,
I made an image with this command in Fedora:
"dd if=/dev/sda of=/home/image.dd"
Are all my memory data in this image?
Can I mount it and investigate it with TSK?
I want to mount it with this command:
"mount /home/image.dd /mnt/tmp "
but it says "cannot determine filesystem type".
what should I do? Did I created image from correct file?
Thanks

Noway2

11-22-2013 12:30 PM

I am not really sure how this is a security question, but ...

The dd command you referenced will make an image of the entire drive named sda, which can be used to restore the drive using the dd command in reverse. This is a sector by sector copy of the drive but the image file is not a natively mountable device. Your question made me curious about this subject and a quick search for the terms 'linux mount dd image' brought up several promising links, including this one. Several of the links mention the need to account for a starting offset to be able to mount the image. It has been several years since I studied file system and drive layout but from what I recall, there are some initial portions of the drive that aren't part of the partition and these would need to be skipped.

schneidz

11-22-2013 12:31 PM

not sure what tsk is but what that seems to be is a image of a disk (boot sector, partition table, partitions). there are ways to mount the partitions inside of it but it is complex.

seems like you wanted to image the partitions only like so:

Code:

dd if=/dev/sda1 of=/home/image-part-1.dd

dd if=/dev/sda2 of=/home/image-part-2.dd

dd if=/dev/sda3 of=/home/image-part-3.dd

dd if=/dev/sda4 of=/home/image-part-4.dd

...

# then to mount you need to provide the loop mount parameter

sudo mount -o loop /home/image-part-4.dd /whatever/floats/your/boat

use the file command to determine if your images are disks or partitions.

unSpawn

11-22-2013 01:33 PM

Quote:

Originally Posted by schneidz (Post 5069023)

not sure what tsk is but

TSK stands for The Sleuthkit, which builds on TCT (The Coroner's Toolkit). Other OSS frameworks forensics practitioners could use would be pyFLAG (Forensic and Log Analysis GUI) or OCFA (Open Computer Forensics Architecture) to name two.

Quote:

Originally Posted by Noway2 (Post 5069020)

a quick search for the terms 'linux mount dd image' brought up several promising links

'kpartx' was mentioned on LQ since 2006 (only in 2008 in conjunction with mounting partitions) ;-p

Quote:

Originally Posted by mitra86 (Post 5069018)

Are all my memory data in this image?

No. For that you would needed to have a LKM loaded beforehand (let's not talk about hardware capture devices).

Quote:

Originally Posted by mitra86 (Post 5069018)

Can I mount it and investigate it with TSK?

Sure, easiest using TSK's companion app Autopsy.

All times are GMT -5. The time now is 10:14 PM.