Déc 122015
 

Playing with registry api’s, I coded this small proggie.

Will save an online registry hive to an offline hive file.
Will restore an offline hive file to an online hive (a backup will be made next to the source hive file).

Needs admin rights – Works on windows 2000 and up.

Discuss it here.

dumpreg

 Posted by at 16 h 12 min
Août 012014
 

In a previous article, I showed how to setup a « proxy » for ImDisk thru devio to mount an EWF file.

This time, lets do it with a QCOW file.

The command lines for the proxy and ImDisk are below :

devio --dll=proxy.dll;dllopen shm:test_proxy c:\test.qcow
imdisk -a -t proxy -o shm -o ro -f test_proxy -m Z:

Find the proxy here : PROXY_QCOW .

Juil 212014
 

I recently discovered the work of Joachim Metz.
I first decided to write a delphi wrapper unit around libewf (here) so that I could add EWF support to CloneDisk.

Today, I decided to do the same for Joachim’s libvmdk unit : another delphi wrapper.
The unit is straighforward and is based on the previous libewf one : create the object, open the file, get the size, read and/or write, close…

The delphi unit is here : libvmdk .

 Posted by at 19 h 10 min  Tagged with:
Juil 212014
 

In a previous article, I showed how to setup a « proxy » for ImDisk thru devio to mount an EWF file.

This time, lets do it with a VMDK file.

The command lines for the proxy and ImDisk are below :

devio --dll=proxy.dll;dllopen shm:test_proxy c:\test.vmdk
imdisk -a -t proxy -o shm -o ro -f test_proxy -m Z:

See below devio in action :
imdisk_vmdk

Find the proxy here : proxy_VMDK .

Juil 202014
 

In a previous article, I have shared a delphi unit for libewf.

Now lets code a proxy for ImDisk using that library to mount an EWF file.

I initially used this template from reboot.pro and came with the below basic delphi unit.

Once I had done that, it was pretty easy to fill in the missing parts to mount and EWF reusing my previous libewf delphi unit.
See code attached.proxy_EWF

library proxy;

uses
  SysUtils,
  Classes,windows;

{$R *.res}

type
  dllread_proc = function (handle:thandle; buf:pointer; size:cardinal; offset:int64): integer; cdecl;
  dllwrite_proc = function (handle:thandle; buf:pointer; size:cardinal; offset:int64): integer; cdecl;
  dllclose_proc = function (handle:thandle): integer; cdecl;

var
file_handle:thandle;

function SetFilePointerEx (hFile: THandle; lDistanceToMove: int64; lpNewFilePointer: Pointer; dwMoveMethod: DWORD): BOOL; stdcall; external 'kernel32.dll';
function GetFileSizeEx(hFile: THandle; var lpFileSize: Int64): BOOL; stdcall; external 'kernel32.dll' name 'GetFileSizeEx';

function my_read_proc(handle:thandle; buf:pointer; size:cardinal; offset:int64): integer; cdecl;
var
bytes_read:cardinal;
begin
	writeln('Read request - size:'+inttostr(size)+' offset:'+inttostr(offset));
	SetFilePointerEx(handle, offset, nil, FILE_BEGIN);
	ReadFile(handle, buf^, size, bytes_read, nil);
	result:=bytes_read;
end;

function my_write_proc(handle:thandle; buf:pointer; size:cardinal; offset:int64): integer; cdecl;
var
bytes_written:cardinal;
begin
	writeln('Write request - size:'+inttostr(size)+' offset:'+inttostr(offset));
	SetFilePointerEx(handle, offset, nil, FILE_BEGIN);
	WriteFile(handle, buf^, size, bytes_written, nil);
	result:=bytes_written;
end;

function my_close_proc(handle:thandle): integer; cdecl;
begin
	writeln('Close request');
	CloseHandle(handle);
	result:=0;
end;

function dllopen(filename:pchar; read_only:integer; var dllread:dllread_proc; var dllwrite:dllwrite_proc; var dllclose:dllclose_proc; var size:int64):thandle;cdecl;
begin
	writeln('File to open: '+filename);

	dllread := my_read_proc;
	dllwrite := my_write_proc;
	dllclose := my_close_proc;

	file_handle := CreateFile(filename, GENERIC_READ or GENERIC_WRITE, FILE_SHARE_READ, nil, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0);
	GetFileSizeEx(file_handle, size);

	result:=file_handle;
end;

exports
  dllopen index 1;

begin
end.

The command lines for the proxy and ImDisk are below :

devio --dll=proxy.dll;dllopen shm:test_proxy c:\test.vmdk
imdisk -a -t proxy -o shm -o ro -f test_proxy -m Z:

Devio in action :
imdisk_ewf

Mai 132014
 

Libewf is a library to access the Expert Witness Compression Format (EWF). Read more here.
Also, read more about the Encase image file format here.

Lately I took interest into the EWF file format for my CloneDisk software.
I found a delphi unit implementing read only access to EWF files but it was (out)dated from 2010 using deprecated funtions.
I therefore decided to refresh (rewrite) it so that it uses the latest functions from the version 2 library and I also implemented a couple of extra functions like write, set header, set compression, etc.

EWF support for CloneDisk has the following benefits for now :
-the compression (at the expense of speed thus)
-it can be mounted later on
-it can be browsed later on

Later on, I could see other benefits :
-headers / metadatas such as author, os name, os build, description, etc
-md5/sha1
-multi threading (to get more speed)

Found the delphi project (sourcecode v1) here libewf.

Updated version (v2 / will work with delphi xe5 and 32/64 bits) : libewf.

libewf