Difference between pages "Mounting Disk Images" and "CarvFs"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
m (To mount a disk image on Linux)
 
 
Line 1: Line 1:
= FreeBSD =
+
CarvFs is a modular [[Fuse]] based user space file system on top op [[LibCarvPath]].
 +
CarvFS makes CarvPath style annotations as used by LibCarvPath available as files.
 +
Using CarvFs makes it possible to process carved entities as files without the need for copy-out.
  
To mount a disk image on [[FreeBSD]]:
+
CarvFs is modular with respect to access to image files.
 +
The CarvFs distribution comes with a default module for access to (split) raw files.
  
First attach the image to unit #1:
+
A separate [[LibEwf]] module is available for access to ewf images.
  # mdconfig -a -t vnode -f /big3/project/images/img/67.img -u 1
+
  
Then mount:
+
[http://sourceforge.net/apps/mediawiki/carvpath/ CarvPath wiki]
  # mount -t msdos /dev/md1s1 /mnt
+
 
+
  # ls /mnt
+
  BOOTLOG.PRV    BOOTLOG.TXT    COMMAND.COM    IO.SYS          MSDOS.SYS
+
 
+
To unmount:
+
 
+
  # umount /mnt
+
  # mdconfig -d -u 1
+
 
+
To mount the image read-only, use:
+
 
+
  # mdconfig -o readonly -a -t vnode -f /big3/project/images/img/67.img -u 1
+
  # mount -o ro -t msdos /dev/md1s1 /mnt
+
 
+
= Linux =
+
 
+
==To mount a disk image on [[Linux]]==
+
 
+
# mount -t vfat -o loop=/dev/loop0,ro,noexec img.dd /mnt
+
-or-
+
# mount -t vfat -o loop=/dev/loop/0,ro,noexec img.dd /mnt
+
 
+
The '''''ro''''' is for read-only.
+
 
+
 
+
Some raw images contains multiple partitions (full HD image). In this case, it's necessary to specify a starting offset for each partition.
+
 
+
# mount -t vfat -o loop=/dev/loop0,offset=32256,ro,noexec img.dd /mnt/tmp_1
+
# mount -t vfat -o loop=/dev/loop1,offset=20974464000,ro,noexec img.dd /mnt/tmp_2
+
 
+
 
+
'''Note: You may need to say /dev/loop/0 instead of /dev/loop0 on some systems'''
+
 
+
==To unmount==
+
 
+
# umount /mnt
+

Revision as of 10:30, 12 March 2010

CarvFs is a modular Fuse based user space file system on top op LibCarvPath. CarvFS makes CarvPath style annotations as used by LibCarvPath available as files. Using CarvFs makes it possible to process carved entities as files without the need for copy-out.

CarvFs is modular with respect to access to image files. The CarvFs distribution comes with a default module for access to (split) raw files.

A separate LibEwf module is available for access to ewf images.

CarvPath wiki