Mount an read an image in c#

I am having a problem and dont know where to start on this one, my experience in c# programming is average and was hoping for some advice on this subject. I have a disc image (an exact duplicate of a 40gb hard disc drive) the format is a dd image.

My task requires me to programmatically read through the files on this image, compare file extensions and recognise certain file types on the drive. Is this possible? I cannot find anyone who has attempted this on the internet and would appreciate any guidance to get the ball rolling.

Thank you

Craig

Of course it's possible, the information is there, but it is going to be dependent on the file type. How was this image created? What is the format of the file? You need to be able to answer that question.

Thanks for such a prompt reply. I am a computer forensic student so I am farmiliar with using the Forensic Toolkit imager by Access Data. There are many options of format, it can either be a dd (raw) image, a .E01 image, smart and AFF, i think the last 3 are compressed using the FTK imager.

I really dont mind which format the image is, whichever easiest and quickest for the program to analyse i suppose. Its such a relief to hear it is possible and would again appreciate any further advice or direction regarding methods or code.

Thanks again

Craig

I mean, it simply comes down to figuring out the format and parsing it. As long as the format is documented it should be trivial (if perhaps time consuming). I am not personally familiar with any of those formats, so I can't give you details, but step 1 is finding a spec.

cr41g14, you have a hard disk dump and want to get the files off of it. There are two ways of doing this.

1. You use the proper files system to access the data on it as you would a normal hard drive.

2. You mentioned forensics, so in that context, one would assume that the files system on the disk image has been corrupted or destroyed by some means. In that case you have no meta data (like file names and extensions) to work with. You have to search the image for each type of file you wish to recover. The way you do this will depend on the type of file. e.g. You might search for a magic number followed by a header.

Is it possible then to access the files without mounting the image first? Even though forensics does deal with recovering data that has been damaged in this case the hdd would be intact and in working format. The HDD would be taken from a sky box, it is up to me then to write a program to analyse a disc image of this HDD to scroll through the files and then be able to distinguish whether this sky box has been used normally or abnormally.

e.g. if a suspect has removed this HDD from the sky box and plugged it into a windows system to transfer images to the disc, then put it back again to hide this data. Well upon seizure the police will have the grueling task of analysing a maybe foreign filesystem and filetypes on the image.

Now this program (hopefully) will understand the default files and file types that are supposed to be on the drive, i.e. sky recordings and other default files then be able to recognise any other files that aren't supposed to be on the drive, JPG's, .DOC's etc. It will then flag these foreign filetypes to the investigator and fail the test. Sky boxes with no foreign files will pass the test. So all the program will have to do is scan through the image, check for file extensions that are foreign or for residue data left by windows (e.g $Recycler) this will prove that the HDD has been plugged into windows and removed from the sky box for potential criminal activity.

I hope this makes sense and I understand this is a complicated scenario but i'm glad to be talking to c# experts. I was worried it was not possible and like i said my knowledge of programming is minimal but i have to get this done.

Thanks again

Sounds like a pretty good job, if you're up to the challenge. I'd let the police handle it, as it were

I have to do this, its my dissertation for my degree, is it at all possible using visual studio and c#?

Anyone???

This still doesn't make a lot of sense. If the partition or files haven't been erased, then why write a program to read the image when you can simply mount them?

It's as do-able in C# as it is in C or assembly. If your requirements are to search a raw hd copy for image files, then you'll have to implement a filesystem parser to figure out where the files are and how they're stored and using that retrieve the data. If your task allows it, i'm sure there's plenty of opensource libraries for all filesystem types which can be used.

Fair comment chris, how would you mount this image then using c# and scan the files? Being it is a HDD from a sky box, do you think it be mounted easily to a drive letter, recognised in windows as a drive and the files displayed as explorer?

sorry if its an obvious question but my programming skills are poor.

Quote:

---

Originally Posted by Mutant_Fruit

It's as do-able in C# as it is in C or assembly. If your requirements are to search a raw hd copy for image files, then you'll have to implement a filesystem parser to figure out where the files are and how they're stored and using that retrieve the data. If your task allows it, i'm sure there's plenty of opensource libraries for all filesystem types which can be used.

---

I am also looking on how to extract files or mount the .dd image file. I want to do this in CV++ or C#, i know there are tools which can do this but the requirement is writing a new application. Does that mean that i will have to implement something like a file system parser which understands the file system inside the .dd image file ?
Any pointers or sample code to this ?

Thanks.

Quote:

---

Originally Posted by cr41g14

Fair comment chris, how would you mount this image then using c# and scan the files? Being it is a HDD from a sky box, do you think it be mounted easily to a drive letter, recognised in windows as a drive and the files displayed as explorer?

sorry if its an obvious question but my programming skills are poor.

---

hi craig, have you managed to write the code? i am working on the same project as you right now.. can you please help me?

many thanks

amreen

Quote:

---

Originally Posted by amreen

hi craig, have you managed to write the code? i am working on the same project as you right now.. can you please help me?

many thanks

amreen

---

Hello craig can you jus help on dis. Even I am trying for dis kinda project code .

You may be able to mount using hyperV then access it like a normal disk after its mounted. Unless the disk is using a file format not known to windows, this shouldn't be a problem. My guess is that the disk on the sky box is fat32, which should mount without issue. Check out the following for a mount demo

http://msdn.microsoft.com/en-us/libr...11(VS.85).aspx

Quote:

---

Originally Posted by inblueswithu

Hello craig can you jus help on dis. Even I am trying for dis kinda project code .

---

I am also looking on how to extract files or mount the .dd image file using c#. Can you please let me know if anyone is able to mound using c#.

Thanks,
Prashant

Did you ever figure out if this was possible and how to do this?