Difference between pages "DeepSpar Disk Imager" and "Libqcow"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
 
(External Links)
 
Line 1: Line 1:
[[Image:DeepSpardiskimager.jpg|frame|DeepSpar Disk Imager Kit]]
+
{{Infobox_Software |
:The DeepSpar Disk Imager is a hardware, drive to drive, data recovery imaging device. It makes use of a fairly standard PC system but connects directly to the source drive (the drive being imaged.) Through this hardware connection, it is able to command the source drive on a low ATA register level. It thus bypasses normal BIOS calls to the hard drive. Standard BIOS / hard drive operations will not allow the retrieval of damaged or corrupted sectors as it would invariably cause a system (OS) failure. For data recovery purposes however, it is important to be able to access any available data.
+
  name = libqcow |
 +
  maintainer = [[Joachim Metz]] |
 +
  os = [[Linux]], [[FreeBSD]], [[NetBSD]], [[OpenBSD]], [[Mac OS X]], [[Windows]] |
 +
  genre = {{Disk imaging}} |
 +
  license = {{LGPL}} |
 +
  website = [http://code.google.com/p/libqcow/ code.google.com/p/libqcow] |
 +
}}
  
:Additionally, the DeepSpar Disk Imager controls the power input of the source drive so that it can, if required, re-power the source without rebooting the system. (This is significant with highly unstable drives that will continually “hang.”)
+
The '''libqcow''' package contains a library and applications to read the [[QCOW_Image_Format | QEMU Copy-On-Write (QCOW) image]] format.
  
:To control and pre-configure the source drive, the DeepSpar Disk Imager makes use of specific ATA commands (see also: [http://www.t13.org Technical Committee T13]) as well as some vendor specific commands. This includes the ability to read sectors while ignoring ECC errors as well as the ability to send software and hardware reset commands to the drive which creates the ability to control “read timeout.” (Read timeout is a user defined amount of time in milliseconds that the hard drive will be given to read any particular sector. If the read timeout is reached before the sector is correctly read, it will be skipped. The imager then marks in its “map” that the sector was skipped so that it can be reprocessed on later passes.)
+
== Tools ==
 +
The '''libqcow''' package contains the following tools:
 +
* '''qcowinfo''', which shows the information about QCOW files.
 +
* '''qcowmount''', which FUSE mounts QCOW image files.
  
:Through the tool’s software interface, the end user is able to configure all parameters and commands that they wish the imager to use over multiple imaging passes. As previously mentioned, the DeepSpar Disk Imager stores a “map” of all the sectors from the source drive. This map allows the imager to always remember which sectors have been imaged, which were skipped, and which had errors etc. This in turn allows the imager to run multiple passes without reprocessing sectors that had been previous read correctly. It also allows the imager run imaging passes to target specific sector errors.
+
== Examples ==
  
:Unlike forensics tools, the DeepSpar Disk Imager does not create an image file. Instead, it uses commands and techniques to image all sectors on the source drive directly to the destination drive. The image drive can then be used by any data retrieval or forensics software for file recovery or forensics investigation.
+
FUSE mounting a QCOW image (libqcow 20111009 or later)
 +
<pre>
 +
qcowmount image.qcow mount_point
 +
</pre>
 +
 
 +
== History ==
 +
 
 +
Libqcow was created by [[Joachim Metz]] in 2010.
 +
 
 +
== Also See ==
 +
[[QCOW_Image_Format | QEMU Copy-On-Write (QCOW) image format]]
  
 
== External Links ==
 
== External Links ==
* [http://www.driveimager.com/ Official website]
+
* [https://code.google.com/p/libqcow/ Project site]
* [http://www.deepspar.com/pdf/DeepSparDiskImager.pdf Product data sheet]
+
* [https://code.google.com/p/libqcow/wiki/Building Building libqcow and tools from source]
* [http://www.deepspar.com/mjm-ds-disk-imager.html Review of the DeepSpar Disk Imager] by Mike Montgomery of MJM Data Recovery in the UK.
+
* [https://code.google.com/p/libqcow/wiki/Mounting Mounting a QCOW image]
* ''[http://www.deepspar.com/pdf/DeepSparDiskImagingWhitepaper3.pdf Disk Imaging: A Vital Step in Data Recovery]'', a whitepaper on the product
+

Revision as of 01:29, 15 July 2013

libqcow
Maintainer: Joachim Metz
OS: Linux, FreeBSD, NetBSD, OpenBSD, Mac OS X, Windows
Genre: Disk imaging
License: LGPL
Website: code.google.com/p/libqcow

The libqcow package contains a library and applications to read the QEMU Copy-On-Write (QCOW) image format.

Tools

The libqcow package contains the following tools:

  • qcowinfo, which shows the information about QCOW files.
  • qcowmount, which FUSE mounts QCOW image files.

Examples

FUSE mounting a QCOW image (libqcow 20111009 or later)

qcowmount image.qcow mount_point

History

Libqcow was created by Joachim Metz in 2010.

Also See

QEMU Copy-On-Write (QCOW) image format

External Links