# Disk Image tools



## Phishfry (Jul 11, 2017)

I would like to be able to view the structure of a disk image file.
What are the FreeBSD tools for working with images?
Are there any GUI based .img viewers?
NanoBSD is beating me down.


----------



## Phishfry (Jul 11, 2017)

How important is the correct bs= when dd 'ing a disk image?
bs=bit sectors.
When I run `diskinfo -v da0` for my USB -SD card reader I see this:

```
root@E6420:~ # diskinfo -v da0
da0
   512             # sectorsize
   16139354112    # mediasize in bytes (15G)
   31522176       # mediasize in sectors
   0               # stripesize
   0               # stripeoffset
   1962           # Cylinders according to firmware.
   255             # Heads according to firmware.
   63             # Sectors according to firmware.
   000000000903   # Disk ident.
   Not_Zoned       # Zone Mode
```

So should I be using bs=512 with this SD card? I have been using 1M.


----------



## Phishfry (Jul 11, 2017)

Using file I can see some of the contents:

```
root@E6420:~ # file /raid1/Images/_.disk.image.i386
/raid1/Images/_.disk.image.i386: DOS/MBR boot sector; partition 1 : ID=0xa5, start-CHS (0x3ff,255,63), end-CHS (0x3ff,255,63), startsector 1, 65536 sectors; partition 2 : ID=0xa5, active, start-CHS (0x3ff,255,63), end-CHS (0x3ff,255,63), startsector 65537, 334976 sectors
```


----------



## tobik@ (Jul 11, 2017)

Phishfry said:


> What are the FreeBSD tools for working with images?


You can create a md(4) device backed by an image with mdconfig(8) and then use all the standard tools like gpart(8) etc. on it.


----------



## sko (Jul 11, 2017)

Phishfry said:


> bs=bit sectors



Have a look at dd(1) - bs sets the blocksize. With flash drives 1m is common but as the drive handles the blocksize itself it doesn't really matter except for performance...


----------



## Phishfry (Jul 11, 2017)

OK got that mixed up block size not bit sector.
Did more reading and it is a speed thing.
It would still boot even at bs=1

I have used this wiki to mount my .img with mdconfig in testing
http://forensicswiki.org/wiki/Mounting_Disk_Images


----------



## wblock@ (Jul 15, 2017)

dd(1) for copying binary images.  Set bs= to 64k or more for performance.  There is not much point to going larger than 1m or maybe 8m.
gpart(8) for dealing with partitioning.
file(1) for determining types of filesystems or other content.
mdconfig(8) for mounting binary image files.  See the examples at the end of the man page for some useful things, like skipping over initial content.


----------



## vince66 (Dec 21, 2017)

Hello wblock,

in this post you list the programs to:
dd a drive, 
determine filesystems type 
and mount binary images.

Please, can you tell me for FreeBSD O.S. programs that extract data (also deleted) from an image file ?


Thanks in advance.


----------



## vince66 (Dec 21, 2017)

Another question.

Phishfry, about diskinfo, can you tell me more about the last parameter Not_Zoned. What is it ? Is maybe it related with the timezone ?

Thanks. !


----------



## Phishfry (Dec 22, 2017)

I serious doubt that #Zone Mode has anything to do with timezone.


```
root@E6420:~ # diskinfo -t ada0
ada0
   512             # sectorsize
   64023257088    # mediasize in bytes (60G)
   125045424       # mediasize in sectors
   0               # stripesize
   0               # stripeoffset
   124053         # Cylinders according to firmware.
   16             # Heads according to firmware.
   63             # Sectors according to firmware.
   141183401444   # Disk ident.
   Not_Zoned       # Zone Mode
```


----------



## vince66 (Dec 22, 2017)

Yes, it is strange.
Please, do you know if filesystems FAT16/32, exFAT and NTFS store the timezone informations once a file is created ?


----------



## Snurg (Dec 22, 2017)

AFAIK practically every OS since the transition from 8 to 16 bit computing has timestamps.
You could google this so easily...

Old FAT is even in Wikipedia: https://en.wikipedia.org/wiki/Design_of_the_FAT_file_system
http://www.ntfs.com/exfat-file-directory-entry.htm

NTFS is a proprietary undocumented file system.
https://www.cnwrecovery.com/manual/NTFSDirectoryEntryMFT.html
I have high respect to the FUSE guys who did a great deal of reverse engineering.

Please tell more about your concrete data loss scenario, or what makes it so important to find time/date information on some Microsoft based file systems, because it depends on that what strategies you can apply.


----------

