Juin 112018
 

Updated version following up on this article : added netcat support

Download from here

RAW can be :
-A logical drive in the form of \\.\X:
-A physical drive in the form of \\.\physicaldriveX
-A volume in the form of \\?\Volume{e26e7b15-122a-11e7-82bf-806e6f6e6963}
-A volume shadow copy in the form of \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1
-A disk image file in the form of c:\temp\disk.img

DEVIO or NETCAT will be IP:PORT (ex: 127.0.0.1:9000)

NETCAT command line:
Use nc to backup incoming datas to a file (i.e RAW to NETCAT) -> nc.exe -v -n -l -p 9000 > c:\temp\disk.img
Use nc to restore datas from a file (i.e NETCAT to RAW) -> nc -l -v -p 9000 < c:\temp\disk.img

Download Netcat here.

DEVIO (RAW to DEVIO or DEVIO TO RAW) command line:
A logical drive -> devio 9000 \\.\X:
A physical drive -> devio 9000 \\.\PhysicalDriveX
A physical drive and a partition (starting a 1) -> devio 9000 \\.\PhysicalDriveX 1
A file (must exist and sized according to your needs) -> devio 9000 c:\temp\disk.img 0 0
Read only mode : devio -r 9000 \\physiscaldrive0 1

Download Devio here : x86 x64

 Posted by at 19 h 41 min
Jan 032018
 

On removable medias (such as USB disks), Windows can only access one partition at a time.
This is a driver limitation (which you can actually work around by using another driver but this is not the point of this article).

Here below one way to work around this.

First, lets select our device in CloneDisk and under the disk (right) menu : (1) put it offline, (2) delete disk layout, (3) create 2 (or more) partitions, (4) put your disk online.

Note that if you disk is already multi partitioned, you can skip the above 4 tasks and go the last part of this article which is about accessing the second partition.

Create one partition, and repeat this task once.

Once done (i.e partitions are created), it should looks like this once done (2 times 2 GB partitions).

In CloneDisk main window, put your disk online : windows should detect a new volume and offer to format it (if not, remove and reinsert media).

Create a folder named ‘part1’ (this is only a witness/indicator)

Now, lets see how we can access the second partition : Go back to CloneDisk -> Disk -> Partition Editor, select your second partition and « set as partition number 1 ».

Again, windows should detect a new volume (the previous volume ‘part 1’ has disappeared) and offer to format it (if not, remve and reinsert media) – unless you have skipped the first part of this article.

Create a folder named ‘part2’.

You can now switch back and forth between your partitions on your removable media by using CloneDisk -> Disk -> Partition Editor, select your partition and « set as partition number 1 ».

 Posted by at 20 h 31 min
Déc 292017
 

2.3.7
modified : rewritten _enum_drives_lv to enumerate thru volumes not drive letters (x32)
modified : selected.caption replaced with inttostr(integer(lvdisks.Selected.data)) (x32)
modified : renamed convert to vmdk/vhd to create vmdk file descriptor
modified : added raw to vhd in disk conversion
modified : GetVolumeNameForVolumeMountPoint moved to udiskmgmt
todo : move md5 hash to disk image
added : if pos(‘:\’,path)>0 then exit; in prep_src & prep_dst
added : backup/restore in mbr editor (x32)
modified : backup will now suggest a proper filename (x32)
modified : set disk ro and rw will go offline/online if disk is online (x32)
modified : VDI2RAW,vmdk2raw,vhd2raw,restore_devio,backup_devio,EWF2Drive,Drive2EWF moved to new uconvert unit (x32)
modified : createfile_devio,getfilesize_deviowrite_devio,prep_src,prep_dst,_lockdismount_vol,_unlock_vol moved to new uconvert unit (x32)
modified : vdi,LibVMDK,libVHDI,LibEWFUnit,wsck removed from umain (x32)
removed : privilege, ntdll, fmifs units
modified : GetDriveParams moved udiskmgt
removed : int13ext unit
modified : uformat renamed to ufrmformat
fixed : result set to 0 in lib._GetDosDrives
modified : Drive2RAW,RAW2Drive moved to uconvert unit (x32)
added : mode 0 in lib._EnumerateDosDevices to list all devices
added : list volume shadow copy volumes in volumes
added : add dos device in volumes
modified : renamed createvhd to umsvirtdisk
modified : renamed main to ufrmMain
modified : replaced custom wsck unit with delphi winsock unit
midified : libewf_SetCompressionValues uses LIBEWF_COMPRESS_FLAG_USE_EMPTY_BLOCK_COMPRESSION (x32)
modified : ufrvolume, definedosdevice will try DDD_RAW_TARGET_PATH and 0 (x32)
modified : drive2raw will display the offset if reafile fails (x32)
modified : xxx2RAW will propose to delete target file (x32)
todo : consider 1mB instead of 65kB for memsize in xxx2RAW functions
added : backup/restore from popup menu (x32)
added : checkbox in disk/part/disk&part popupmenu (x32)
added : offline/online after create partition (x32)
added : refresh after format (modal form) (x32)
added : try/catch in wim_logmessage
added : makeiso improvements around boot files
added : extend volume will propose the closest max size possible

 Posted by at 14 h 17 min
Déc 292017
 

2.3.6
added : imapi, copy bootfile to temp folder to avoid file used error
added : source/target label in convert image form
added : backup_drive, zeromemory when readfile=false
added : vdi2raw added in image conversion
added : vmdk2raw added in image conversion
added : vhd2raw added in image conversion
added : backup/restore caption in backup/restore form
todo : complete code to backup/restore from/to vhd/vmdk/vdi
added : backup_devio simplified
modified : backup_drive->Drive2RAW,backup_ewf->Drive2EWF,backup_wim->Drive2WiM
modified : restore_drive->RAW2Drive,restore_ewf->EWF2Drive,restore_wim->WIM2Drive
fixed : rename frmmain src & dst to _src and _dst which were creating inconsistencis here and there
modified : cleanup in raw2drive
modified : cleanup in ewf2drive
modified : backup/restore to/from devio renamed to … network
modified : unlockvolume in backup_devio
modified : cleanup in restore_devio
added : volumes
removed : mount point from ‘symlinks – mount points’ tab
removed : dosdevices in advanced tabs
removed : symlink in advanced tab
added : mount_vol and unmount_vol to udiskmgmt
added : change partition to number one in part editor
added : extra partition mbr types in part editor
modified : display disk id and part disk id, part id in updated column=’device’
added : restore any BS boot code
modified : renamed NT6 to NT6.3 in boot sector and MBR
modified : boot sector fields editable in white
added : VolumeNameToDeviceName to lib and removed from ufrmvolume
added : GetVolumePathNamesForVolumeName to udiskmgmt
modified : wim/wimboot/skip empty parts grayed out when needed in restore/backup

 Posted by at 14 h 17 min
Déc 282017
 

MkIso will create an ISO from a source folder.

Supports multi-boot iso : x86 and EFI.
Supports isolinux (checksum will be taken care of).
Tested successfully with Grub4Dos.

Mkiso is native (no external dependencies), standalone, built in on windows builtin imapi2.

MkIso is also part of CloneDisk.

Questions, feedback, requests welcome.

MkIso

Regards,
Erwan

 Posted by at 23 h 31 min
Mai 062017
 

DiskMgr has been developed primarily for use in a Windows Forensic Environment (WinFE) to provide a user friendly method of changing the following DISK attributes : Offline, Online, Read-Only, Read-Write.

DiskMgr is similar in use to Colin Ramsden’s « Write Protect » application (see here). DiskMgr is available in native Windows 32-bit and 64-bit versions.

Discuss and download here

.

 Posted by at 15 h 44 min
Avr 142017
 

In this post, I shared a quick tool to convert VMDK files to RAW files.
The interface was rather minimalist and limited.
Here comes an updated version which can convert multiple files format (VMDK, VHDI, EWF, VDI) to RAW image disks.

Download it here.

 Posted by at 19 h 06 min
Déc 122015
 

Latest changes :

fixed : will use libewf_handle_read_buffer_at_offset or libewf_handle_read_random (x32)
fixed : extend/shrink function (x32)
added : backup_ewf function (x32)
added : backup_devio function (x32)
added : restore_devio function (x32)
added : restore_ewf function (x32)
added : options grayed out in backup/restore window (x32)
added : disk image conversion (x32)
modified : not fliping code for disk s/n (x32)
added : create iso disk image (x32)

 Posted by at 14 h 24 min