2

I'm trying a level about forensics on a forum. I have a .img file which I've been trying to recover. In windows i tried 4 tools,but only one sort of worked and I can t open any of the files. I analysed the file with trid and I got back that is: 40.2% .ATN, 16,1%.WK etc(I don't know if it helps).I also installed linux and ran fdisk -l forensics1.img and I get

fdisk -l forensics1.img

Disk forensics1.img: 25 MiB, 26214400 bytes, 51200 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes

Could someone give me any ideas about how to open the file ?

Edit: When I run dd if=forensics1.img | file - I get /dev/stdin: Linux rev 1.0 ext4 filesystem data, UUID=3252234c-f5e0-4ed4-a809-beb029819989, volume name "Forensics" (extents) (huge files)

  • By what software this image built? Possibly it not linux generated image? – Mikhail Moskalev Oct 4 '16 at 23:14
3

There is actually no difference between .iso and .img. Copy it to a *.iso:

sudo cp forensics.img forensics.iso

And try to mount:

sudo mkdir /media/iso
sudo mount -o loop filename.iso /media/iso 

Copy it for backup in the case it is really something different.

  • Tried that but when I click on the mounted folder it s empty – Bogdan Daniel Oct 28 '15 at 15:01
  • See my edit. Maybe it helps figuring out how to open it. – Bogdan Daniel Oct 28 '15 at 15:30
-2

Use poweriso or daemontools on windows to mount it.

  • It doesn't work with those. I tried. I think it has to be a forensics tool, but I haven't found the right one .. – Bogdan Daniel Oct 28 '15 at 9:40
  • 1
    @BogdanDaniel Perhaps edit your question to include the tools you've tried already, and what the results were. Otherwise this is probably just going to devolve into just a list of "name every tool that can mount an img/iso". ;) – Ƭᴇcʜιᴇ007 Oct 28 '15 at 13:45
-2

Try Win32DiskImager to burn it to a disc which can then be used in the PC. Failing that, see if you can find a tool to convert it to an ISO which in my experience seems to be supported a lot more.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.