2

I am new to this process and I'm struggling a bit. I was given a .dd file to analyze as an assignment in my current college course. I am using Sans Sift in a virtual box environment, but I have no idea how to open this file. I saved it to my desktop and all attempts by me (in terminal) to open it have failed.

Can anyone detail the process as how to properly open this type of file for analysis? If more information is needed, I will do my best to explain. We are attempting to look at the FAT and derive information from it.

4
  • Please show a little effort. We don't do your homework. What type of file is a .dd file ? What has it to be analyzed for ?
    – Soren A
    Oct 3, 2020 at 14:28
  • 1
  • Create a new empty directory, in the same directory as the .dd file: mkdir mydd. Then mount it with mount -t vfat -o ro imagefile.dd mydd. Then you should be able to do a cd mydd and look around. I added -o ro so you can't accidentally change anything to the dd file. (I got this from @Terrance's cheat sheet, page 2, top left).
    – Jos
    Oct 3, 2020 at 15:47
  • Jos, I followed these steps, but I am receiving the following message " Special device Project1.dd does not exist" Have you received this return before? Thank you for the assistance btw. Oct 4, 2020 at 3:01

2 Answers 2

1

To compliment existing answer I would recommend to use kpartx.

It is installable by

sudo apt-get install kpartx

and allows to create loop devices for the dd-image:

sudo kpartx -a -v file.dd

and then you can find the files in the /dev/mapper/ directory.

1
  • Running sudo kpartx -a seized_usb_drive.dd gets me device-mapper: reload ioctl on loop28p1 failed: Invalid argument and create/reload failed on loop28p1
    – ajmeese7
    Nov 27, 2022 at 23:50
0

The DD file is a disk image file and a replica of a hard disk drive.

The file that has a .dd extension is usually created with an imaging tool called DD.

The utility provides a command line interface to create disk images on a system running UNIX and GNU/LINUX OS.

To see what structure the file has, you can use fdisk:

sudo fdisk -l file.dd

fdisk shows only the type of partition but not the file system to know it is necessary to use cfdisk.

sudo cfdisk file.dd

So we will know what file system it is.

To know where the partition to mount begins in bytes, it is necessary to see the Start column.

Assuming you start at sector 92408 and each sector is 512 bytes.

The beginning of the partition in bytes will be 92408 * 512, this is what is known as offset.

The shell can do the necessary multiplication to calculate the offset by typing

$((92408 * 512))

Once we have everything we need, we are going to mount a dd image by typing:

sudo mount -t filesystem -o loop, ro, offset = $ ((start * 512)) file.dd mount_point

 -t: we indicate the file system
 -o: indicates options for mount
 loop: it is necessary to convert a static image into a dynamic image.
 ro: is in read mode (read-only)
 offset: indicates where the partition to mount begins in bytes
 start: is the data corresponding to the start column of fdisk or cfdisk

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .