Best Linux Image Tool For Job Question

danmartinj · 05-04-2015, 10:53 AM

Hello,

I have acquired a linux commercial penetration test appliance which runs a debian based operating system. I am trying to create an image of the system so I can place it on other identical appliances but it looks like the OS is encrypted. I have asked the manufacturers for support but they said they do not provide any documentation or help for what I am trying to do. I have already tried to run clonezilla Live CD on the appliance but it appears clonezilla does not see the disk and I could try dd but I know that tool can be pretty dangerous so my question is does anyone have any suggestions or advice for me?

Thanks,

Joe

rtmistler · 05-04-2015, 01:02 PM

How can the OS be encrypted? This would mean a custom bootloader?

I've written this a few ways. Basically you can "try" to copy using the dd command, but you'd need to be able to copy "to" a place, such as an added secondary storage medium, be that microSD, SD, USB stick, etc. If you have no secondary storage capability, then really you won't be able to do this.

I first started with you'd have to boot off a secondary media. That started to fall apart because you'd need a comparable Linux to run on that system, likely a non-standard processor situation. So that's problem #1.

If you manage to copy the OS to a secondary medium, you could then try to boot using that secondary medium on a target system. If that works, great, you then would need to copy the entire image from a secondary medium to the internal flash of the target, to make the target a duplicate.

There's a ton of pitfalls. This is the general gist of what to do, however it's not going to be easy because the manufacturer didn't intend it to be easy. And if it's illegal, then don't do it at all.

unSpawn · 05-04-2015, 01:05 PM

Quote:

Originally Posted by danmartinj

(..) so my question is does anyone have any suggestions or advice for me?

Yes: don't. That may not be the answer that you are looking for but AFAIK this is about you honoring commercially licensing agreement, which I am pretty sure says something about reverse engineering and similar activities, and anything that reeks of circumvention is not a topic for LQ. Please see the LQ Rules.

jefro · 05-04-2015, 04:24 PM

Since you say appliance then we'd have to know more about this. Some laptops can have some unique ways to protect data.

What is this device?

danmartinj · 05-11-2015, 11:48 AM

rtmistler and everyone else,

Thanks for your reply. I have contacted the manufacturer and confirmed they are OK with me doing this just to let everyone know. The processor is a 1.8GHZ Intel i3 with 32GB SSD.
I have done additional research and it seems what I am trying to do should not be that hard. Running

Code:

fdisk -l
Disk /dev/sda: 32.0 GB, 32017047552 bytes
255 heads, 63 sectors/track, 3892 cylinders, total 62533296 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x0001f807

   Device Boot      Start         End      Blocks   Id  System
/dev/sda1   *        2048    62531583    31264768   83  Linux

and

Code:

blkid
/dev/sda1: UUID="bd92adb0-100d-4a9d-ae24-ff704c34c1f5" TYPE="ext4"

and

Code:

df -h
Filesystem                                              Size  Used Avail Use% Mounted on
rootfs                                                   30G  5.8G   22G  21% /
udev                                                     10M     0   10M   0% /dev
tmpfs                                                   390M  264K  390M   1% /run
/dev/disk/by-uuid/bd92adb0-100d-4a9d-ae24-ff704c34c1f5   30G  5.8G   22G  21% /
tmpfs                                                   5.0M     0  5.0M   0% /run/lock
tmpfs                                                   780M     0  780M   0% /run/shm
tmpfs                                                   2.0G     0  2.0G   0% /tmp

and

Code:

ls -lA /root
....
-rw-r--r-- 1 root root      112 Apr 30 15:59 .ecryptfsrc

So, I am not exactly sure what .ecryptfsrc means but the more I look into this it seems like this device might not be encrypted at all so I think I will try what rtmistler said and try to use dd and put the img onto an external USB drive unless anyone out there sees something I am missing? Thanks for your help again in advance.

Joe

fatmac · 05-12-2015, 10:17 AM

Agree, that just looks like any other Linux disk so using dd should work.
(.ecryptfsrc looks like it may be an encryption resource file.)

danmartinj · 05-21-2015, 09:58 AM

Thanks for the feedback everyone,

Just to close this thread out the procedure we used was:
1. Boot into Live Ubuntu CD disto
4. ssh into the device by ifconfig for the ip and then get into it from host computer
5. type fdisk -l to make sure sdc is external with the device folder and sda is the device image
6. Ensure Proper Drives are Connected
7. Perform dd operation
dd "if=source" "of=destination"
To create an image of sda,
-

Code:

dd if=/dev/sda of=/media/location/backup.img

To restore a backup image you already have,
-

Code:

dd if=/media/location/backup.img of=/dev/sda

I still don't understand why clonezilla did not see the proper drives. We might yet still try to get that tool to work for image creating and restoration but now dd works fine as always.

Thanks,
Joe