±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36459
New Yesterday: 3 Visitors: 110

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Joining DD Files

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

Minesh
Senior Member
 

Joining DD Files

Post Posted: Jun 28, 07 01:24

Firstly, apologies for the n00b question, but I did look around for my answer.

I took an image today using FTK Imager and it has split the image up into 650mb files (May be my own fault).

Anyway, I now have nearly 300 files called image.dd.001, image.dd.002 etc.

What can I use to join these, or what will open them as is (Windows XP)? (Open source/Freeware only please)


Thanks

Ps, first day hands on and I have already learnt something! Hopefully will be the same everyday. Very Happy  
 
  

keydet89
Senior Member
 

Re: Joining DD Files

Post Posted: Jun 28, 07 01:40

> I took an image today using FTK Imager and it has split the image up into 650mb files (May be my own fault).

Only in that you are perhaps not familiar with the tool...it does this by default.

First off, you don't need to join them, but if you like, simply use the 'type' command:

c:\>type image.dd.001 >> image.dd

now, repeat, replacing "image.dd.001" with the next successive file in order. I usually write a Perl script to do this for me.

As to the rest of your question:
windowsir.blogspot.com...q=liveview  
 
  

secret_squirrel
Member
 

Re: Joining DD Files

Post Posted: Jun 28, 07 09:07

This should keep you busy for a while:

www.vmware.com/vmtn/ap...ectory/249


Check out some other possible solutions there also.


Here you can load that image you took and analyze it.

But, you will have to read Wink , before hands on Smile  
 
  

cinux
Member
 

Re: Joining DD Files

Post Posted: Jun 28, 07 14:07

Minesh,
You can join the files by a simple Linux command:

#cat image.dd.*>fullimage.dd

The same can be achieved using a cat.exe for Windows as well.

I am wondering why do you need to join these though??

If you are assuming that you need to join the split images into one prior to analysis or restoration, then it isn't true.
You can analyze the split image using Sleuthkit and Autopsy browser (which are freeware). You can even preview and restore the image using FTK imager as well. Hell, you can even join the image by reacquiring the split image using FTK imager but specifying the Image fragment size as 0 (which means that you are not opting for a split image)

Plenty of options in this case!

HTH
_________________
Chetan Gupta
ENCE, GCFA, GCIA, CEH, CCNA, CIW Sec. Analyst
Forensic Analyst 
 
  

Minesh
Senior Member
 

Re: Joining DD Files

Post Posted: Jun 28, 07 14:43

Thanks guys, all very useful posts. I will hopefully get analysing at the weekend.

Ps, Maybe I will start a bit of reading too.  
 

Page 1 of 1