Physical Image and Partition Mounting in Tsurugi Linux

This is a basic DFIR skill, but extremely useful. Demonstrated on Tsurugi Linux.

Sometimes it is helpful to access data inside a forensic disk image without going through carving and processing. For example, when you want to use tools to search for or process data, the tools do not 'understand' forensic disk images. In this video, we use Tsurugi with ewfmount and the built-in 'mount' command to access a file system of a suspect disk image. The same commands will work on other versions of Linux as well.

Tsurugi Linux has pre-configured directories that make mounting disk images very easy. We will use an expert witness file (EWF) (E01) as an example. First, mount the physical disk image with ewfmount. Then use the Sleuth Kit mmls to find the partition table and get the offset to the target partition. Calculate the byte offset. Then use 'mount' to mount the target partition. From there, you should have access to the suspect's data as if their hard drive were directly connected to your system.

00:00 Tsurugi Linux
00:14 Goals of the video
00:26 Selecting tools from the Applications menu
01:04 Open a command prompt (terminal)
01:32 Tsurugi home directory non-standard folders
01:49 Why image mounting?
02:15 Tsurugi Linux mnt directory
03:08 Mount an EWF physical disk image (E01)
04:31 Access the mounted disk image
04:52 tsk mmls for disk partition table
05:28 Calculate byte offset to partition
06:27 Mount a partition inside a physical disk image
07:32 Accessing the mounted partition file system
08:12 Overview
08:44 Thanks for watching

010001000100011001010011011000110110100101100101011011100110001101100101
Get more Digital Forensic Science

010100110111010101100010011100110110001101110010011010010110001001100101

Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License. Please link back to the original video. If you want to use this video for commercial purposes, please contact us first. We would love to see what you are doing.

Experiment 003:
House of the dragon, super smash bros, todo o nada, Facebook, peacemaker, squid game

[DFIRScience]

I used this method a lot last week at the Cellebrite 2021 CTF. Thought I would share!

[corneliussteel]

I'm trying to do this, but I'm getting stuck at the 5:30 mark. I cannot use mmls on the ewf1 disk image file because, apparently "libewf.so.2" is not a library on my tsurugi vm. I've make sure all packages are up-to-date, and ewfmount and libewf are installed, but a look through the library directories and a search with "find" indeed show that there is no "libewf.so.2" library. I don't see anything anywhere else online about this problem. Any guidance?

PS: Man, mounting linux images in a linux environment is excruciating! I can't get a single tool to work on any image I can find. Why is it so difficult to achieve this one task? I appreciate the effort on the video though. Very good explanations. If it weren't for a jillion dependencies, I'm sure it would work for me...

[saschajaeger]

Hello, thanks for your work. I'm an absolute beginner... with which tool can I easily create an image of my HDD