CodeGuru Home VC++ / MFC / C++ .NET / C# Visual Basic VB Forums Developer.com
Page 1 of 2 12 LastLast
Results 1 to 15 of 18
  1. #1
    Join Date
    Jan 2011
    Posts
    6

    Mount an read an image in c#

    I am having a problem and dont know where to start on this one, my experience in c# programming is average and was hoping for some advice on this subject. I have a disc image (an exact duplicate of a 40gb hard disc drive) the format is a dd image.

    My task requires me to programmatically read through the files on this image, compare file extensions and recognise certain file types on the drive. Is this possible? I cannot find anyone who has attempted this on the internet and would appreciate any guidance to get the ball rolling.

    Thank you

    Craig

  2. #2
    Join Date
    Jun 2008
    Posts
    2,477

    Re: Mount an read an image in c#

    Of course it's possible, the information is there, but it is going to be dependent on the file type. How was this image created? What is the format of the file? You need to be able to answer that question.

  3. #3
    Join Date
    Jan 2011
    Posts
    6

    Re: Mount an read an image in c#

    Thanks for such a prompt reply. I am a computer forensic student so I am farmiliar with using the Forensic Toolkit imager by Access Data. There are many options of format, it can either be a dd (raw) image, a .E01 image, smart and AFF, i think the last 3 are compressed using the FTK imager.

    I really dont mind which format the image is, whichever easiest and quickest for the program to analyse i suppose. Its such a relief to hear it is possible and would again appreciate any further advice or direction regarding methods or code.

    Thanks again

    Craig

  4. #4
    Join Date
    Jun 2008
    Posts
    2,477

    Re: Mount an read an image in c#

    I mean, it simply comes down to figuring out the format and parsing it. As long as the format is documented it should be trivial (if perhaps time consuming). I am not personally familiar with any of those formats, so I can't give you details, but step 1 is finding a spec.

  5. #5
    Join Date
    Aug 2008
    Posts
    902

    Re: Mount an read an image in c#

    cr41g14, you have a hard disk dump and want to get the files off of it. There are two ways of doing this.

    1. You use the proper files system to access the data on it as you would a normal hard drive.

    2. You mentioned forensics, so in that context, one would assume that the files system on the disk image has been corrupted or destroyed by some means. In that case you have no meta data (like file names and extensions) to work with. You have to search the image for each type of file you wish to recover. The way you do this will depend on the type of file. e.g. You might search for a magic number followed by a header.

  6. #6
    Join Date
    Jan 2011
    Posts
    6

    Re: Mount an read an image in c#

    Is it possible then to access the files without mounting the image first? Even though forensics does deal with recovering data that has been damaged in this case the hdd would be intact and in working format. The HDD would be taken from a sky box, it is up to me then to write a program to analyse a disc image of this HDD to scroll through the files and then be able to distinguish whether this sky box has been used normally or abnormally.

    e.g. if a suspect has removed this HDD from the sky box and plugged it into a windows system to transfer images to the disc, then put it back again to hide this data. Well upon seizure the police will have the grueling task of analysing a maybe foreign filesystem and filetypes on the image.

    Now this program (hopefully) will understand the default files and file types that are supposed to be on the drive, i.e. sky recordings and other default files then be able to recognise any other files that aren't supposed to be on the drive, JPG's, .DOC's etc. It will then flag these foreign filetypes to the investigator and fail the test. Sky boxes with no foreign files will pass the test. So all the program will have to do is scan through the image, check for file extensions that are foreign or for residue data left by windows (e.g $Recycler) this will prove that the HDD has been plugged into windows and removed from the sky box for potential criminal activity.

    I hope this makes sense and I understand this is a complicated scenario but i'm glad to be talking to c# experts. I was worried it was not possible and like i said my knowledge of programming is minimal but i have to get this done.

    Thanks again

  7. #7
    Join Date
    Jan 2006
    Location
    Fox Lake, IL
    Posts
    15,007

    Re: Mount an read an image in c#

    Sounds like a pretty good job, if you're up to the challenge. I'd let the police handle it, as it were
    David

    CodeGuru Article: Bound Controls are Evil-VB6
    2013 Samples: MS CODE Samples

    CodeGuru Reviewer
    2006 Dell CSP
    2006, 2007 & 2008 MVP Visual Basic
    If your question has been answered satisfactorily, and it has been helpful, then, please, Rate this Post!

  8. #8
    Join Date
    Jan 2011
    Posts
    6

    Re: Mount an read an image in c#

    I have to do this, its my dissertation for my degree, is it at all possible using visual studio and c#?

  9. #9
    Join Date
    Jan 2011
    Posts
    6

    Re: Mount an read an image in c#

    Anyone???

  10. #10
    Join Date
    Aug 2008
    Posts
    902

    Re: Mount an read an image in c#

    This still doesn't make a lot of sense. If the partition or files haven't been erased, then why write a program to read the image when you can simply mount them?

  11. #11
    Join Date
    May 2007
    Posts
    1,546

    Re: Mount an read an image in c#

    It's as do-able in C# as it is in C or assembly. If your requirements are to search a raw hd copy for image files, then you'll have to implement a filesystem parser to figure out where the files are and how they're stored and using that retrieve the data. If your task allows it, i'm sure there's plenty of opensource libraries for all filesystem types which can be used.
    www.monotorrent.com For all your .NET bittorrent needs

    NOTE: My code snippets are just snippets. They demonstrate an idea which can be adapted by you to solve your problem. They are not 100% complete and fully functional solutions equipped with error handling.

  12. #12
    Join Date
    Jan 2011
    Posts
    6

    Re: Mount an read an image in c#

    Fair comment chris, how would you mount this image then using c# and scan the files? Being it is a HDD from a sky box, do you think it be mounted easily to a drive letter, recognised in windows as a drive and the files displayed as explorer?

    sorry if its an obvious question but my programming skills are poor.

  13. #13
    Join Date
    Jan 2011
    Posts
    1

    Re: Mount an read an image in c#

    Quote Originally Posted by Mutant_Fruit View Post
    It's as do-able in C# as it is in C or assembly. If your requirements are to search a raw hd copy for image files, then you'll have to implement a filesystem parser to figure out where the files are and how they're stored and using that retrieve the data. If your task allows it, i'm sure there's plenty of opensource libraries for all filesystem types which can be used.
    I am also looking on how to extract files or mount the .dd image file. I want to do this in CV++ or C#, i know there are tools which can do this but the requirement is writing a new application. Does that mean that i will have to implement something like a file system parser which understands the file system inside the .dd image file ?
    Any pointers or sample code to this ?

    Thanks.

  14. #14
    Join Date
    Jun 2013
    Posts
    1

    Re: Mount an read an image in c#

    Quote Originally Posted by cr41g14 View Post
    Fair comment chris, how would you mount this image then using c# and scan the files? Being it is a HDD from a sky box, do you think it be mounted easily to a drive letter, recognised in windows as a drive and the files displayed as explorer?

    sorry if its an obvious question but my programming skills are poor.
    hi craig, have you managed to write the code? i am working on the same project as you right now.. can you please help me?

    many thanks

    amreen

  15. #15
    Join Date
    Dec 2013
    Posts
    1

    Re: Mount an read an image in c#

    Quote Originally Posted by amreen View Post
    hi craig, have you managed to write the code? i am working on the same project as you right now.. can you please help me?

    many thanks

    amreen
    Hello craig can you jus help on dis. Even I am trying for dis kinda project code .

Page 1 of 2 12 LastLast

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  





Click Here to Expand Forum to Full Width

Featured