-
January 13th, 2011, 03:13 PM
#1
Mount an read an image in c#
I am having a problem and dont know where to start on this one, my experience in c# programming is average and was hoping for some advice on this subject. I have a disc image (an exact duplicate of a 40gb hard disc drive) the format is a dd image.
My task requires me to programmatically read through the files on this image, compare file extensions and recognise certain file types on the drive. Is this possible? I cannot find anyone who has attempted this on the internet and would appreciate any guidance to get the ball rolling.
Thank you
Craig
-
January 13th, 2011, 04:52 PM
#2
Re: Mount an read an image in c#
Of course it's possible, the information is there, but it is going to be dependent on the file type. How was this image created? What is the format of the file? You need to be able to answer that question.
-
January 13th, 2011, 06:16 PM
#3
Re: Mount an read an image in c#
Thanks for such a prompt reply. I am a computer forensic student so I am farmiliar with using the Forensic Toolkit imager by Access Data. There are many options of format, it can either be a dd (raw) image, a .E01 image, smart and AFF, i think the last 3 are compressed using the FTK imager.
I really dont mind which format the image is, whichever easiest and quickest for the program to analyse i suppose. Its such a relief to hear it is possible and would again appreciate any further advice or direction regarding methods or code.
Thanks again
Craig
-
January 13th, 2011, 06:32 PM
#4
Re: Mount an read an image in c#
I mean, it simply comes down to figuring out the format and parsing it. As long as the format is documented it should be trivial (if perhaps time consuming). I am not personally familiar with any of those formats, so I can't give you details, but step 1 is finding a spec.
-
January 13th, 2011, 09:42 PM
#5
Re: Mount an read an image in c#
cr41g14, you have a hard disk dump and want to get the files off of it. There are two ways of doing this.
1. You use the proper files system to access the data on it as you would a normal hard drive.
2. You mentioned forensics, so in that context, one would assume that the files system on the disk image has been corrupted or destroyed by some means. In that case you have no meta data (like file names and extensions) to work with. You have to search the image for each type of file you wish to recover. The way you do this will depend on the type of file. e.g. You might search for a magic number followed by a header.
-
January 14th, 2011, 05:44 AM
#6
Re: Mount an read an image in c#
Is it possible then to access the files without mounting the image first? Even though forensics does deal with recovering data that has been damaged in this case the hdd would be intact and in working format. The HDD would be taken from a sky box, it is up to me then to write a program to analyse a disc image of this HDD to scroll through the files and then be able to distinguish whether this sky box has been used normally or abnormally.
e.g. if a suspect has removed this HDD from the sky box and plugged it into a windows system to transfer images to the disc, then put it back again to hide this data. Well upon seizure the police will have the grueling task of analysing a maybe foreign filesystem and filetypes on the image.
Now this program (hopefully) will understand the default files and file types that are supposed to be on the drive, i.e. sky recordings and other default files then be able to recognise any other files that aren't supposed to be on the drive, JPG's, .DOC's etc. It will then flag these foreign filetypes to the investigator and fail the test. Sky boxes with no foreign files will pass the test. So all the program will have to do is scan through the image, check for file extensions that are foreign or for residue data left by windows (e.g $Recycler) this will prove that the HDD has been plugged into windows and removed from the sky box for potential criminal activity.
I hope this makes sense and I understand this is a complicated scenario but i'm glad to be talking to c# experts. I was worried it was not possible and like i said my knowledge of programming is minimal but i have to get this done.
Thanks again
-
January 14th, 2011, 12:39 PM
#7
Re: Mount an read an image in c#
Sounds like a pretty good job, if you're up to the challenge. I'd let the police handle it, as it were
-
January 15th, 2011, 04:12 AM
#8
Re: Mount an read an image in c#
I have to do this, its my dissertation for my degree, is it at all possible using visual studio and c#?
-
January 15th, 2011, 06:17 PM
#9
Re: Mount an read an image in c#
-
January 15th, 2011, 06:27 PM
#10
Re: Mount an read an image in c#
This still doesn't make a lot of sense. If the partition or files haven't been erased, then why write a program to read the image when you can simply mount them?
-
January 16th, 2011, 01:54 PM
#11
Re: Mount an read an image in c#
It's as do-able in C# as it is in C or assembly. If your requirements are to search a raw hd copy for image files, then you'll have to implement a filesystem parser to figure out where the files are and how they're stored and using that retrieve the data. If your task allows it, i'm sure there's plenty of opensource libraries for all filesystem types which can be used.
www.monotorrent.com For all your .NET bittorrent needs
NOTE: My code snippets are just snippets. They demonstrate an idea which can be adapted by you to solve your problem. They are not 100% complete and fully functional solutions equipped with error handling.
-
January 16th, 2011, 05:18 PM
#12
Re: Mount an read an image in c#
Fair comment chris, how would you mount this image then using c# and scan the files? Being it is a HDD from a sky box, do you think it be mounted easily to a drive letter, recognised in windows as a drive and the files displayed as explorer?
sorry if its an obvious question but my programming skills are poor.
-
January 19th, 2011, 03:28 AM
#13
Re: Mount an read an image in c#
Originally Posted by Mutant_Fruit
It's as do-able in C# as it is in C or assembly. If your requirements are to search a raw hd copy for image files, then you'll have to implement a filesystem parser to figure out where the files are and how they're stored and using that retrieve the data. If your task allows it, i'm sure there's plenty of opensource libraries for all filesystem types which can be used.
I am also looking on how to extract files or mount the .dd image file. I want to do this in CV++ or C#, i know there are tools which can do this but the requirement is writing a new application. Does that mean that i will have to implement something like a file system parser which understands the file system inside the .dd image file ?
Any pointers or sample code to this ?
Thanks.
-
June 17th, 2013, 08:34 PM
#14
Re: Mount an read an image in c#
Originally Posted by cr41g14
Fair comment chris, how would you mount this image then using c# and scan the files? Being it is a HDD from a sky box, do you think it be mounted easily to a drive letter, recognised in windows as a drive and the files displayed as explorer?
sorry if its an obvious question but my programming skills are poor.
hi craig, have you managed to write the code? i am working on the same project as you right now.. can you please help me?
many thanks
amreen
-
December 10th, 2013, 11:51 AM
#15
Re: Mount an read an image in c#
Originally Posted by amreen
hi craig, have you managed to write the code? i am working on the same project as you right now.. can you please help me?
many thanks
amreen
Hello craig can you jus help on dis. Even I am trying for dis kinda project code .
Posting Permissions
- You may not post new threads
- You may not post replies
- You may not post attachments
- You may not edit your posts
-
Forum Rules
|
Click Here to Expand Forum to Full Width
|