Image USB files slightly larger than media

[RoddinRob]

Hi.

I'm using ImageUSB v1.1 build 1015 on a W7/64b PC. I've previously created an image of a 4GB CF card. Bin log says the file size is 4000317440 bytes. If I try to write that image to UFD I am told that the media (4GB) is too small... available size is 3.72Gb. If I write to a 16Gb file, it goes in no problem. Is there any way to make a 4Gb image fit back on to a 4Gb CF card?

Thanks,

RR.

[Richard (PassMark)]

Unfortunately the labeling of drives seems to be the approximate size of the drive. We have drives from the same manufacturer and model and sometimes the total bytes would differ a few megabytes.

Depending on how full the drive is and how fragmented the data is, you may be able to get a way with writing the 4GB image on to the smaller drive. Or if only the contents of the drive is what you are after (and not exact duplicate is needed), you can write the image to the 16GB drive (or just mount the image), and just copy and paste the contents to the smaller drive.

[RoddinRob]

I tried OSFMount... Doesn't work... I mount the image file & windows keeps telling me I have to format th drive before I can use it - so the image is unaccesable. Not sure how to get around that...

[Richard (PassMark)]

If the image you are mounting is from imageUSB, OSFMount should recognize this and skip the first 512 bytes. If not, make sure to set the image file offset to 512 bytes to bypass some meta information imageUSB adds to the image file.

How many partitions and what file systems were on the original CF Card? If the filesystem is not supported Windows, then you would get the format the drive message.

[RoddinRob]

Image is from hard drive, created from CF card. Offset doesn't work. I don't know exactly what is on it or how many partitions. I suspect it might be Linux. I just need to be able to transfer the contents to a 4gb flash card & not a 16gb card simply because the image file that was created went beyond the actual size of the card. I don't have a Linux system or tools to be able to play with it. I guess I'm pooched....

Thanks anyway.

[David (PassMark)]

I suspect it might be Linux

That would explain why Windows doesn't recognise the file system, and prompts for a format.

Our OSForensics software can browse Linux file systems. But you can also just setup a VM with Linux to read the file system if you wanted. There is always a solution to these problems, it just depends on how much time to you want to spend on it.

[DennisMc]

I'm using a Kingston DataTraveler G4 16GB. And have made a W10 backup recovery drive that I need to duplicate using the ImageUSB product. Further, I've tested this W10 recovery USB and it works just fine. I made an image of it as a .bin file. I then tried another same make/model/size drive to duplica and get an error that the media is to small. So I took the original drive and an fully formatted it and tried to write the image on it as well - same problem - media is too small. Here's a pic included. Any help would be great.

[Richard (PassMark)]

Something is strange, the Disk size and File size difference is quite large, 15,728,640,000 - 15,472,047,104 = 256,592,896 bytes (around 256 MB). We had a couple of reports in the past (a few KB or MBs), but nothing as drastic as 256 MB difference if file sizes. The Disk size and File size are calculated by using Windows API function calls. Disk size is calculated by calling IOCTL_DISK_GET_DRIVE_GEOMETRY_EX on the drive and File size is determined by using GetFileSizeEx(). We compare the number of bytes and throw up an warning if the drive is smaller than the image file.

Initial look over the code, I don't spot anything wrong. We can probably do more testing next week on various drives we may have laying around, but it could just be the drive and/or Windows/Device Drivers is reporting the wrong values (wouldn't be the first time).

[DennisMc]

I have built two windows recovery drives with my 16GB Kingston G3's. They work great. The end result with them are good operational W10 systems. When I create an image .bin file from each of them and the imageusb apps- it works great. But I cannot build a USB drive from the BIN files and imageusb software. Not working on brand new pulled from the package never used before sticks. Same problem each time. Hope that helps as far as what I've done on my side. Thx.

[David (PassMark)]

From the two numbers, 15,728,640,000 & 15,472,047,104, I would suspect that the 1st one is the wrong one. But only because it appears to be a neat round number.

If in Windows Explorer, you right click on the .bin file and View Properties, what is the file size?
Maybe the .bin file was the right size, and some 3rd party bit of software has added some data to the end of the file.
Or maybe something has reduced the size of the drive? Maybe the windows backup recovery drive creation process somehow hides 256MB as a separate partition (HPA/DCO settings can do this) .

[Richard (PassMark)]

I do have a 16GB Kingston G3, but not the same style/shape as the one in your picture, and I can't seem to replicate the issue on it or the several other drives I tested. I created Window 10 Recovery image onto the drives, imaged to file and then write back to the drive with ImageUSB without issue.

It would be interesting to load up the image and the drive in a hex viewer (e.g. in our OSForensics' Raw Disk Viewer) and view the contents at the end of the drive. If you do do this, note that the first 512 bytes from the .bin image should be skipped prior to comparing.