Use of OSFMount for dd backup browsing?

[ddfan]

I have been a dd fan for decades and I use it regularly to back up partitions and entire drives. In the past few years I've learned how dd can be combined with other tools (like squashfs, mount, and the losetup) to compactly store and browse these drive images. It's really great.

However, there's another use where those tools are not so great. For example, I've had a number of friends bring me their old Windows computers asking me to recover all of their files so they save what they want and dispose of the old computer. I can easily image their drives and partitions and hand them a USB drive with the whole thing, but what could they do with that? If they were running Linux, I'd set up a script to mount each partition as read only, and they could copy what they wanted to wherever they wanted it. But they're not running Linux, so here I am.

From what I've skimmed and inferred so far, it looks like OSFMount could mount such a binary image (either single or multiple partitions) and allow them to browse and copy files in a familiar Windows-like environment. Is that true? Does that seem like a reasonable use of the tool? Would there be any drawbacks to that application?

Thanks in advance.

[David (PassMark)]

Yes, OSFMount will mount a dd image (also called a raw image) from a Windows machine. You can either mount it as a virtual physical drive (the whole drive), or just mount a volume (single partition).

Having it on a USB flash drive might be rather slow. So if you can copy the image to an internal SSD first.
USB Flash drives also aren't typically very reliable over a long period (compared to internal SSDs).

Where this makes less sense is if the source drive is very large (e.g. 1TB+) with only a small amount of it used (e.g. 100GB). In this case you are probably better off not making a raw image of the entire drive as 90% of the data won't be valid files (but might not be zeroed empty space either). So a full image will be slow and use a lot of storage space. In this case a file based backup option would make more sense.

[ddfan]

Thanks David. Your quick response is a good sign!!

I'm sure you're right about it being slow. But I don't think the usage in this scenario will require much speed. For example, in my most recent case, a friend came to me with 7 old computers dating back to Windows 98. She had kept them all these years for fear that she might lose some important item. She had moved her most cherished data to each new machine along the way, but she always had the nagging feeling that she might have left something behind.

No problem, dd to the rescue (and not ddrescue in this case). I booted Knoppix on all 7 computers and made complete dd image of each (a few with 1/2TB drives). They all fit on just over half of a 4TB spinning Western Digital USB hard drive (sorry, I should have mentioned that it wasn't a flash drive). So now all of her data is at least on a modern drive. But I also wanted to give her an easy way to poke around inside and see what's there. I made a few attempts at copying the data from the image back out to regular files (under Linux), but there were a lot of problems with soft links and hard links. That would also nearly double the amount of space requiring yet another drive. If OSFMount can give her direct access (even if it's slow) that would make everything very easy!!

There are still a number of hurtles, but your quick response gives me enough confidence to install it and give it a try. Thanks, and I'll keep you posted.

[David (PassMark)]

There are also a bunch of command line options. You could turn them into a CMD batch file and leave an icon on the desktop. Double click and have the drive mounted.

We also have a self booting tool, OSFClone, that can boot Linux and run dd (slightly improved over the standard dd command). OSFClone also has the option to output the disk image in "E01" format which is a compressed dd format with checksums and hashing.

[ddfan]

OSFMount works great! Nice job.

I am, however, running into an access problem when trying to open certain directories (folders) on the mounted drive. I'm using Windows 10, and I get messages like "You have been denied permission to access this folder."

The Windows dialog gives me the option to open the "security tab", and I've fiddled around with it to no avail. I did try running OSFMount as Administrator, but that didn't seem to resolve the problem. This may be more of a Windows 10 question than an OSFMount question, but any suggestions would save me a lot of digging.

Thanks for all the help so far, and thanks for a really great tool.

[David (PassMark)]

"You have been denied permission to access this folder."

This is a Windows NTFS permissions thing. Same thing happens when you move physical hard drives between machines.
Admin on machine 1 is not the same Admin user as on machine 2.
So if a folder only has only Admin permission (for Admin 1) then Admin 2 can't view that folder. But you can add permission rights for Admin 2 to that folder (you can do this because you are Admin).

You need write access to the drive to change file permissions however.

[ddfan]

Thanks again for all the help.

I am struggling to change the ownership of all files to the host's version of "admin" (or any other user for that matter). I found some help here:

https://learn.microsoft.com/en-us/an...es-at-once-(wi

That article suggests something like:

takeown /d Y /a /r /f c:\MyData\BYourBadFolderName

It warns not to use "c:", so I tried it on the "Users" folder in the OSFMount partition (F: mounted as writable) with:

takeown /d Y /a /r /f F:\Users\*

I get the error:

ERROR: File ownership cannot be applied on insecure file systems;
there is no support for ACLs.

Also, while this "takeown" function might be one way around the problem, I'd really like the READ permissions for all files to be "EVERYONE", so my friend can just mount each partition from OSFMount and browse without becoming ADMIN. I'm sorry that I don't have the Windows skills to do this on my own, and I appreciate any help.

Thanks again.

[David (PassMark)]

We have computer forensics software that can open a disk image and read any file. It completely ignores file permissions (and root kits). But for your application of accessing a backup is it probably overkill.

File ownership cannot be applied on insecure file systems

This would imply the drive was using some other file system and not NTFS. (e.g. Maybe exFat, or FAT32, where there is no ACL, access control list)

There shouldn't be any difference, but try mounting the disk image as a physical drive rather than a volume.

[ddfan]

Thanks for all of the helpful suggestions. I've been trying each of them. I especially appreciate the kind responses to a somewhat off-topic request.

I'm rethinking the value of the project if the permissions inside the dd images will need to be modified to support browsing in Windows. That defeats one of the goals of using dd - which is having a complete and unmodified image of what was originally on the computers. I did some reading about Microsoft's ACL system, and it gave me a greater appreciation for the simplicity of the UNIX "one root with UID=0" approach (one of the simplifications from Multics to UNIX?).

The alternative would be a bootable Linux partition on the storage disk that automatically mounts the dd images via loopback devices. There would also be enough space on the 4T drives to create a common NTFS (or ExFAT) partition to hold files being recovered from the images so that the main Windows partition wouldn't be mucked with during recovery. It's ugly because she'll need to reboot twice every time she wants to browse and restore a few files. On the positive side, it will introduce another person to Linux.

I haven't completely given up because your interface is so compelling: just double-click OSFMount, select a drive, click a few buttons, and voila, all the files magically appear. All of the normal (and familiar) navigation tools just work. It's the way it should be done. It was perfect except for the (minor?) problem of not being able to open many of the files and folders ... even when logged in as admin!

If anyone has any ideas on how to get around the ACL problem, I'll keep checking back, and I may have other questions. Thanks again for all the kind and in-depth responses.

Bob

[David (PassMark)]

Here is what AI suggested. I haven't tested it.