Notifications
Clear all

Joining DD Files

5 Posts
4 Users
0 Likes
3,517 Views
(@minesh)
Posts: 75
Trusted Member
Topic starter
 

Firstly, apologies for the n00b question, but I did look around for my answer.

I took an image today using FTK Imager and it has split the image up into 650mb files (May be my own fault).

Anyway, I now have nearly 300 files called image.dd.001, image.dd.002 etc.

What can I use to join these, or what will open them as is (Windows XP)? (Open source/Freeware only please)

Thanks

Ps, first day hands on and I have already learnt something! Hopefully will be the same everyday. D

 
Posted : 28/06/2007 1:24 am
keydet89
(@keydet89)
Posts: 3568
Famed Member
 

> I took an image today using FTK Imager and it has split the image up into 650mb files (May be my own fault).

Only in that you are perhaps not familiar with the tool…it does this by default.

First off, you don't need to join them, but if you like, simply use the 'type' command

c\>type image.dd.001 >> image.dd

now, repeat, replacing "image.dd.001" with the next successive file in order. I usually write a Perl script to do this for me.

As to the rest of your question
http//windowsir.blogspot.com/search?q=liveview

 
Posted : 28/06/2007 1:40 am
(@secret_squirrel)
Posts: 38
Eminent Member
 

This should keep you busy for a while

http//www.vmware.com/vmtn/appliances/directory/249

Check out some other possible solutions there also.

Here you can load that image you took and analyze it.

But, you will have to read 😉 , before hands on -)

 
Posted : 28/06/2007 9:07 am
cinux
(@cinux)
Posts: 21
Eminent Member
 

Minesh,
You can join the files by a simple Linux command

#cat image.dd.*>fullimage.dd

The same can be achieved using a cat.exe for Windows as well.

I am wondering why do you need to join these though??

If you are assuming that you need to join the split images into one prior to analysis or restoration, then it isn't true.
You can analyze the split image using Sleuthkit and Autopsy browser (which are freeware). You can even preview and restore the image using FTK imager as well. Hell, you can even join the image by reacquiring the split image using FTK imager but specifying the Image fragment size as 0 (which means that you are not opting for a split image)

Plenty of options in this case!

HTH

 
Posted : 28/06/2007 2:07 pm
(@minesh)
Posts: 75
Trusted Member
Topic starter
 

Thanks guys, all very useful posts. I will hopefully get analysing at the weekend.

Ps, Maybe I will start a bit of reading too.

 
Posted : 28/06/2007 2:43 pm
Share: