Tweet
I created a BIN of a drive using ImageUSB a few months ago. I'd like to go back and view (even read only) the files in this BIN file without having to rewrite it to a drive. Is there a way I can do this?
-
-
You can mount the image with our OSFMount tool.Originally posted by m3nt0r View Post
http://www.osforensics.com/tools/mount-disk-images.html -
Originally posted by Richard (PassMark) View Post
I'm not sure if I'm doing this correctly, but I ran OSFMount. Selected "Mount new"
Selected Source Image File
Selected the BIN file
Left everything else default.
When I try to access the drive (in this case it is L
it tells me to insert a disk.
I then tried to mount it the same way only changing type from Auto to HDD.
When I select the drive then, it says L:\ is not accessible. The parameter is incorrect.
Do I just have a bad BIN file?Comment
-
Sounds like you did the right thing.
Do you know what format the original disk was in (NTFS, FAT, etc..). Was the original in a good state before you made a copy of it?Comment
-
It was NTFS. The disk was fine when I imaged it. In fact after I imaged it I re installed the OS and gave it back to teh person and they have been running fine since.Originally posted by David (PassMark) View Post
Any way to do a check on teh BIN itself to see if it is even a viable image?Comment
-
The bin file should be a byte for byte identical copy of the drive, with the exception of the first 512 bytes, which contain checksums in the form of hashes for the rest of the file.
Was the drive a bootable drive to start with? What was on the drive (at a high level)?
If you open up the bin file good hex editor, you should see the MBR (Master boot record) at offset 512 bytes.
The very first 16 bytes should be
69 00 6D 00 61 00 67 00 65 00 55 00 53 00 42 00 i.m.a.g.e.U.S.B.
If you wanted to you could upload the file somewhere and we could download it and take a look.Comment
Comment