0

I am trying to put together a USB stick to use for system emergencies, digital forensics, incident response, etc. (i.e., for when SHTF). I want to have a few Linux ISOs, a bootable Windows 10 partition, an install of CAINE 10, and a FAT partition with some Windows IR tools such as FTK Imager as the final partition.

I have a 256GB Samsung BAR stick. Here is what I have done so far:

  1. Wiped the stick:

    dc3dd wipe=/dev/sdb
    
  2. I created an MBR partition table with three primary partitions and an extended partition: a 1MB ef02 partition, a 100MB ef00 partition, a 5GB NTFS partition for Windows 10, and an extended partition and a 50GB logical ext4 partition inside the extended partition where the ISOs will go.

  3. I followed these instructions: https://wiki.archlinux.org/index.php/Multiboot_USB_drive#Installing_GRUB and installed grub for BIOS and EFI to the stick.

  4. I copied my Linux Mint 19 ISO to the ext4 partition.

  5. I created a grub.cfg file:

    if loadfont /boot/grub/font.pf2 ; then
        set gfxmode=auto
        insmod efi_gop
        insmod efi_uga
        insmod gfxterm
        terminal_output gfxterm
    fi
    
    set menu_color_normal=white/black
    set menu_color_highlight=black/light-gray
    
    search --fs-uuid --set isopath --no-floppy [UUID]
    export isopath
    
    submenu 'Linux' {
        menuentry "Linux Mint" {
        set gfxpayload=keep
        set isofile="($isopath)/linuxmint-19-xfce-64bit-v2.iso"
        loopback loop $isofile
        linux   (loop)/casper/vmlinuz  file=/cdrom/presee/linuxmint.seed boot=casper iso-scan/filename=${isofile} quiet splash --
        initrd  (loop)/casper/initrd.lz
        }
    }
    

https://i.imgur.com/rEVAkpX.png is what happens. (Not a typewriter? WTF?)

I am testing the stick in a KVM VM, but I get the same results if I try to boot it natively.

Any help would be appreciated.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.