Re: [sleuthkit-users] Adding file to an disk image

[Greg F. <gre...@gm...>]

A dd image can be mounted in linux as read/write with no issues, so it
is relatively straighforward.

Assuming you want to mount the second NTFS partition on the image this
should work:

====
mkdir /tmp/output
mmls image.dd > /tmp/output/partition-table
grep NTFS  /tmp/output/partition-table > /tmp/output/NTFS-partitions
cut -b 14-24 /tmp/output/NTFS-partitions >  /tmp/output/NTFS-partitions-offset
#process only the second partition
offset=$(head -2  /tmp/output/NTFS-partitions-offset | tail -1)

sudo mount -o loop,ro,offset=$((10#$offset * 512)) image.dd /mnt
====

In your case drop the ro option to make it read/write.  Obviously you
can tweak the above as needed, but it shows a relatively complete
situation.

fyi: mmls is part of sleuthkit, but the rest of the above is standard linux.

Greg
Greg
--
Greg Freemyer


On Thu, Sep 5, 2013 at 12:16 PM, Umit Karabiyik <umi...@gm...> wrote:
> Hi all,
>
> I have a quick question. Let's say I have a disk image created by dd tool.
> Is there any way I can add a file somewhere in the image file? I'll
> basically try to put some file in a disk image and test some tools if they
> can find the file or a string in the file.
>
> Thanks in advance,
> Umit
>
> ------------------------------------------------------------------------------
> Learn the latest--Visual Studio 2012, SharePoint 2013, SQL 2012, more!
> Discover the easy way to master current and previous Microsoft technologies
> and advance your career. Get an incredible 1,500+ hours of step-by-step
> tutorial videos with LearnDevNow. Subscribe today and save!
> http://pubads.g.doubleclick.net/gampad/clk?id=58041391&iu=/4140/ostg.clktrk
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>