±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 35750
New Yesterday: 1 Visitors: 103

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

What imager creates files ending .OBaa etc?

Forensic software discussion (commercial and open source/freeware). Strictly no advertising.
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

AmNe5iA
Senior Member
 

What imager creates files ending .OBaa etc?

Post Posted: Apr 30, 19 20:45

Our lab recently received an SSD image taken by another forensic company (we were not told which company). The files were named disk0.split.OBaa with the next segment ending .OBab then .OBac, .OBad etc. Turns out it was just a dd image of a Apple MacBook Pro. We were able to use a bulk rename tool to change the file extension to the more common .001, .002, .003 etc. We were then able to open the image correctly using our favourite tools. No imaging hash was provided so we suspect that the image was not taken using common "forensic" imaging software (or possibly hardware I suppose).

Does anyone recognise this file extension naming convention? Any idea what product this company may have used to create this SSD image?

We've tried googling this file extension (and variations of it) but haven't found anything relevant.  
 
  

athulin
Senior Member
 

Re: What imager creates files ending .OBaa etc?

Post Posted: May 01, 19 05:04

- AmNe5iA
Does anyone recognise this file extension naming convention? Any idea what product this company may have used to create this SSD image?


It could perhaps be a result of using split(1), which adds the 'aa', 'ab', ... suffixes. (Assumes all segments have the same size, except for the tailing one. If they don't, it's something else.) Whether '.OB' or '.splitOB' is significant or if it's another split command argument (the prefix) ...

... well, only way to find out for certain is to ask those who created it.  
 
  

AmNe5iA
Senior Member
 

Re: What imager creates files ending .OBaa etc?

Post Posted: May 01, 19 08:53

Thanks,

We can't ask the 'company' as the investigators either can't ascertain which company did it or are refusing to disclose it to us, for some reason...  
 
  

giandega
Senior Member
 

Re: What imager creates files ending .OBaa etc?

Post Posted: May 01, 19 14:15

usually on the copy there is a txt file that is a log of software. Nothing?  
 
  

dpathan
Member
 

Re: What imager creates files ending .OBaa etc?

Post Posted: May 01, 19 15:13

It is a dd image because you can add any thing for extension and it will still be recognized by many forensics software(s). I think in this case the company just used its own naming convention to add different extension (similar to the many DVR manufacturers who implements the same practices to mask the original format).  
 

Page 1 of 1