2

I'm trying a level about forensics on a forum. I have a .img file which I've been trying to recover. In windows i tried 4 tools,but only one sort of worked and I can t open any of the files. I analysed the file with trid and I got back that is: 40.2% .ATN, 16,1%.WK etc(I don't know if it helps).I also installed linux and ran fdisk -l forensics1.img and I get

fdisk -l forensics1.img

Disk forensics1.img: 25 MiB, 26214400 bytes, 51200 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes

Could someone give me any ideas about how to open the file ?

Edit: When I run dd if=forensics1.img | file - I get /dev/stdin: Linux rev 1.0 ext4 filesystem data, UUID=3252234c-f5e0-4ed4-a809-beb029819989, volume name "Forensics" (extents) (huge files)

Improve this question
1
  • By what software this image built? Possibly it not linux generated image?
    – Mikhail Moskalev
    Commented Oct 4, 2016 at 23:14

3 Answers 3

Reset to default
3

There is actually no difference between .iso and .img. Copy it to a *.iso:

sudo cp forensics.img forensics.iso

And try to mount:

sudo mkdir /media/iso
sudo mount -o loop filename.iso /media/iso

Copy it for backup in the case it is really something different.

Improve this answer
2
  • Tried that but when I click on the mounted folder it s empty
    – Bogdan Daniel
    Commented Oct 28, 2015 at 15:01
  • See my edit. Maybe it helps figuring out how to open it.
    – Bogdan Daniel
    Commented Oct 28, 2015 at 15:30
-2

Use poweriso or daemontools on windows to mount it.

Improve this answer
2
  • It doesn't work with those. I tried. I think it has to be a forensics tool, but I haven't found the right one ..
    – Bogdan Daniel
    Commented Oct 28, 2015 at 9:40
  • 1
    @BogdanDaniel Perhaps edit your question to include the tools you've tried already, and what the results were. Otherwise this is probably just going to devolve into just a list of "name every tool that can mount an img/iso". ;)
    – Ƭᴇcʜιᴇ007
    Commented Oct 28, 2015 at 13:45
-2

Try Win32DiskImager to burn it to a disc which can then be used in the PC. Failing that, see if you can find a tool to convert it to an ISO which in my experience seems to be supported a lot more.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .