Déc 292017
 

2.3.6
added : imapi, copy bootfile to temp folder to avoid file used error
added : source/target label in convert image form
added : backup_drive, zeromemory when readfile=false
added : vdi2raw added in image conversion
added : vmdk2raw added in image conversion
added : vhd2raw added in image conversion
added : backup/restore caption in backup/restore form
todo : complete code to backup/restore from/to vhd/vmdk/vdi
added : backup_devio simplified
modified : backup_drive->Drive2RAW,backup_ewf->Drive2EWF,backup_wim->Drive2WiM
modified : restore_drive->RAW2Drive,restore_ewf->EWF2Drive,restore_wim->WIM2Drive
fixed : rename frmmain src & dst to _src and _dst which were creating inconsistencis here and there
modified : cleanup in raw2drive
modified : cleanup in ewf2drive
modified : backup/restore to/from devio renamed to … network
modified : unlockvolume in backup_devio
modified : cleanup in restore_devio
added : volumes
removed : mount point from ‘symlinks – mount points’ tab
removed : dosdevices in advanced tabs
removed : symlink in advanced tab
added : mount_vol and unmount_vol to udiskmgmt
added : change partition to number one in part editor
added : extra partition mbr types in part editor
modified : display disk id and part disk id, part id in updated column=’device’
added : restore any BS boot code
modified : renamed NT6 to NT6.3 in boot sector and MBR
modified : boot sector fields editable in white
added : VolumeNameToDeviceName to lib and removed from ufrmvolume
added : GetVolumePathNamesForVolumeName to udiskmgmt
modified : wim/wimboot/skip empty parts grayed out when needed in restore/backup

 Posted by at 14 h 17 min
Déc 282017
 

MkIso will create an ISO from a source folder.

Supports multi-boot iso : x86 and EFI.
Supports isolinux (checksum will be taken care of).
Tested successfully with Grub4Dos.

Mkiso is native (no external dependencies), standalone, built in on windows builtin imapi2.

MkIso is also part of CloneDisk.

Questions, feedback, requests welcome.

MkIso

Regards,
Erwan

 Posted by at 23 h 31 min
Mai 062017
 

DiskMgr has been developed primarily for use in a Windows Forensic Environment (WinFE) to provide a user friendly method of changing the following DISK attributes : Offline, Online, Read-Only, Read-Write.

DiskMgr is similar in use to Colin Ramsden’s « Write Protect » application (see here). DiskMgr is available in native Windows 32-bit and 64-bit versions.

Discuss and download here

.

 Posted by at 15 h 44 min
Avr 142017
 

In this post, I shared a quick tool to convert VMDK files to RAW files.
The interface was rather minimalist and limited.
Here comes an updated version which can convert multiple files format (VMDK, VHDI, EWF, VDI) to RAW image disks.

Download it here.

 Posted by at 19 h 06 min
Déc 122015
 

Latest changes :

fixed : will use libewf_handle_read_buffer_at_offset or libewf_handle_read_random (x32)
fixed : extend/shrink function (x32)
added : backup_ewf function (x32)
added : backup_devio function (x32)
added : restore_devio function (x32)
added : restore_ewf function (x32)
added : options grayed out in backup/restore window (x32)
added : disk image conversion (x32)
modified : not fliping code for disk s/n (x32)
added : create iso disk image (x32)

 Posted by at 14 h 24 min
Août 232015
 

A new version is out.
Manu additions and bug fixes.


changed : use IOCTL_DISK_GET_PARTITION_INFO_EX to retrieve part size when backuping/restoring/cloning
changed : common code for prep source and prep dest when backuping/restoring
added : vdh informations
modified : copyfile uses xcopy only if psexec not in the folder
added : get boot sector work with \\.\PhysicalDrivex syntax
added : reach boot sector from partition table
modified : get_bs and set_bs now get an offset optional parameter (to possibly skip asking the user)
modified : can create more than one gpt partition
added : can modify a gpt partition type
added : can modify a gpt partition attributes
added : can create a virtual disk (raw) in mb/kb/byes
fixed : taborder in mbr and bs form
fixed : config called later in formcreate
added: enable_advanced=1 option in config
fixed : _restore_bs to work with \\.\PhysicalDrivex syntax
added : lock & dismount volume(s) when writing BS to physicaldrive
todo : prep drive before cloning
modified : getdrive works will all medias
modified : _get_infos will not crash on GetDriveLayoutEX (x32)
modified : increased getdrivelayoutex buffer size (x32)
added : extra partition types in part editor (x32)
modified : grayed out menus based on gpt/mbr in part editor (x32)
modified : check on total size in wipe (x32)
modified : change backup_drive signature (mode parameter removed) (x32)
modified : backup_drive signature now accepts offset parameter (x32)
modified : restore_drive signature now accepts size & offset parameters (x32)
added : can backup/restore from part editor (x32)
added : disks in gray in main window (x32)
modified : disks and parts are displayed by default (x32)

 Posted by at 15 h 02 min
Jan 302015
 

In some specific situations, you may want to backup only one partition but still wish to boot it as a disk image.
Lets see below how to turn a partition image into a disk image.

Before we start, have a a look at the below disk layout to have a better understanding of items such as MBR, BS, Disk and Partition.

1.Create a 1 MBytes (2048*512=1MB) header file (under virtualdisk, create raw disk image)
Note : instead of 2048 sectors, you can go for 63 or 128 or whatever « sectors before » may suit you – just report that number in the following steps.

2.Append this header to your partition image using the dos command line copy /b header.img+part.img disk.img

3.Adapt MBR type=07 (for ntfs), boot=80, chs start & end=1023*254*63, sectors before=2048, sectors=bootsector.totalsec+1
(You need to untick « hide advanced menu » under tools menu to enable advanced screens in CloneDisk).

4.Inject boot code (nt6) (this will also fix the mbr magic byte AA55).

5.Adapt bootSector hiddensec=2048 so that it matches MBR sectors before field

You are now ready to boot this image as it has all it requires to boot :
-a disk boot record
-a partition table
-a boot sector
-a consistent BPB (bios parameter block)

 Posted by at 19 h 05 min
Jan 242015
 

Lets start with a definition of the MBR :
A Master Boot Record (MBR) is a special type of boot sector at the very beginning of partitioned computer
mass storage devices. The MBR holds the information on how the logical partitions, containing file
systems, are organized on that medium.
Besides that, the MBR contains executable code to function as an operating system-independent chain boot loader in conjunction with each partition’s Volume Boot Record.

To make simpler, if a disk is a book, the mbr is the index table to quickly jump to each partitions.
MBR and GPT are just 2 different ways of writing that index (GPT handles a higher number of partitions and also bigger partitions).

So how to convert a GPT disk to MBR?

1.Write down the offset and length of your partition(s)

2.Delete the disk layout (this will not delete any datas, « only » the partition table and boot loader if any)

3.Create Disk (MBR style)


4.Create partition(s) with correct offset (most important) and length. Note that you can always correct these later by editing the MBR (advanced tools).
Choose IFS for a NTFS filesystem, or FAT32.


You end up with a MBR disk with a partition table similar to the GPT you previously had.
Note that you may want to inject a boot loader (nt6, g4d, etc) if this disk is a boot system one.
Also, this operation works the other way : MBR to GPT.

 Posted by at 19 h 20 min