2

I need to examine and extract files from various storage devices and always run them through a quarantine station. But sometimes all I need to do is copy and store the contents in a raw image format, such as .DD or .eo1

I know I can detect viruses if I access the logical file system from the HDD. But if I wanted to forgo this step and just keep the raw image, would an antiviral program detect viruses in the raw image? Thanks.

Improve this question
5
  • 1
    I suspect not ...
    – DavidPostill ♦
    Apr 18, 2017 at 22:35
  • If you can mount the image as a virtual drive, you should be able to scan it, but not directly as an image itself.
    – acejavelin
    Apr 18, 2017 at 22:41
  • Don't virus scanners search for "magic bits" of viruses? But only in certain files & places? If the image isn't compressed and you searched the entire fs image you could probably find them, but that would search all the free space and data files too, taking much much longer than mounting the images & searching "properly"
    – Xen2050
    Apr 18, 2017 at 22:53
  • Even if Xen2050's idea works and it discovered a virus snippet, all it could do would be to quarantine the entire image. You would then need to unquarantine and mount it, and process it again to find the actual infected file.
    – fixer1234
    Apr 19, 2017 at 4:29
  • Huh, I think it's not possible or at least very hard to AVs to detect and isolate the virus on RAW. Aggre with fixer1234 it will quarantine the entire image.
    – Strepsils
    Apr 28, 2017 at 13:06

2 Answers 2

Reset to default
2

This might depend on the virus and virus scanner but in general no.

Certainly in the (in my opinion) unlikely event it will work, it will be very slow - it needs to scan the whole disk, including deleted files and unused space, without knowledge of the layout its looking for, or even the offsets.

A lot of virii can be found because of signatures in a file [ relative to the start/end of the file ] - without this information it would not work. Also, I posit that disk fragmentation will cause further problems, as payloads could be broken up and scattered in separate parts of the disk.

Improve this answer
2
  • +1 about file "fragmentation," even a fresh empty ext4 (all the ext's?) filesystem will write files in "stripes" across the disk (and still report "0 non-contiguous files" in fsck)
    – Xen2050
    Apr 19, 2017 at 2:18
  • Good point about the file signature for each virus- a distinct hash value I suppose? Which would be obscured by the hash value of the disk image as a whole.
    – Darkivist
    Apr 19, 2017 at 16:10
2

If your AV software is aware of it - possibly. However considering most disk image formats are at 'least' a bitwise copy of a filesystem inside some sparse file or compressed file, chances are no. Smart money to me is on mounting in some way that disallows files executing (Linux will let you do this on a mountpoint, I'm not sure how to do this on windows - but that'll need additional software anyway) and scanning.

Fortunately this is relatively easy to test for - throw the EICAR test file into an image and scan it with your favourite anti virus. Chances are it won't detect but its a completely safe way to test if your antivirus will work in a specific scenario like this

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .