updates
This commit is contained in:
overcuriousity
parent
454aab1df3
commit
a2fd3dab69
1
.gitignore
vendored
Normal file
1
.gitignore
vendored
Normal file
@ -0,0 +1 @@
|
||||
*.dd
|
||||
120
README.md
120
README.md
@ -4,10 +4,13 @@ A comprehensive toolkit for creating disk images with various filesystems for fo
|
||||
|
||||
## Features
|
||||
|
||||
- **Multiple Filesystem Support**: NTFS, FAT32, exFAT, ext2/3/4, XFS
|
||||
- **Multiple Filesystem Support**: NTFS, FAT32, exFAT, ext2/3/4, XFS, swap
|
||||
- **Multi-Partition Support**: Create up to 4 partitions in a single disk image
|
||||
- **Partition Schemes**: GPT (modern) and MBR (legacy)
|
||||
- **Initialization Methods**: Choose between /dev/zero (fast), /dev/urandom (realistic), or fallocate (sparse)
|
||||
- **Interactive Configuration**: User-friendly prompts for all parameters
|
||||
- **Automatic Loop Device Management**: Handles mounting and cleanup
|
||||
- **Filesystem Availability Check**: Verifies required tools before operation
|
||||
- **Forensic-Ready**: Pre-configured for hex editor and forensic tool analysis
|
||||
|
||||
## Prerequisites
|
||||
@ -20,7 +23,8 @@ sudo apt-get install -y \
|
||||
parted \
|
||||
util-linux \
|
||||
e2fsprogs \
|
||||
dosfstools
|
||||
dosfstools \
|
||||
bc
|
||||
```
|
||||
|
||||
### Optional (for specific filesystems)
|
||||
@ -39,6 +43,38 @@ sudo apt-get install xfsprogs
|
||||
sudo apt-get install sleuthkit
|
||||
```
|
||||
|
||||
## Initialization Methods
|
||||
|
||||
The script offers three methods for creating the disk image file:
|
||||
|
||||
1. **`/dev/zero`** (Recommended for most cases)
|
||||
- Fast creation speed
|
||||
- Fills image with zeros
|
||||
- Forensically predictable and clean
|
||||
- Creates realistic empty disk structure
|
||||
|
||||
2. **`/dev/urandom`** (For realistic random data)
|
||||
- Slow creation speed
|
||||
- Fills image with random data
|
||||
- More realistic for testing data recovery
|
||||
- Useful for simulating previously used disks
|
||||
|
||||
3. **`fallocate`** (Fastest)
|
||||
- Very fast, creates sparse file
|
||||
- Does not actually write data to disk initially
|
||||
- Good for quick testing
|
||||
- May not be suitable for all forensic scenarios
|
||||
|
||||
## Multi-Partition Support
|
||||
|
||||
Create complex disk layouts with up to 4 partitions:
|
||||
|
||||
- Each partition can have a different filesystem
|
||||
- Mix operating system types (Windows NTFS + Linux ext4)
|
||||
- Include swap partitions for realistic Linux setups
|
||||
- The last partition automatically uses remaining space
|
||||
- Perfect for practicing partition table analysis
|
||||
|
||||
## Usage
|
||||
|
||||
### Creating a Disk Image
|
||||
@ -46,17 +82,22 @@ sudo apt-get install sleuthkit
|
||||
Run the main script with sudo:
|
||||
|
||||
```bash
|
||||
sudo ./create_forensic_disk.sh
|
||||
sudo ./pseudodisk.sh
|
||||
```
|
||||
|
||||
The script will interactively prompt you for:
|
||||
|
||||
1. **Filename**: Output file name (default: forensic_disk.dd)
|
||||
2. **Size**: Choose from presets (100MB, 500MB, 1GB, 5GB) or custom
|
||||
3. **Partition Scheme**: GPT or MBR
|
||||
4. **Filesystem**: NTFS, FAT32, exFAT, ext2/3/4, XFS
|
||||
5. **Volume Label**: Custom label for the filesystem
|
||||
6. **Mount**: Option to mount immediately after creation
|
||||
The script will:
|
||||
1. Check filesystem tool availability
|
||||
2. Interactively prompt you for:
|
||||
- **Filename**: Output file name (default: forensic_disk.dd)
|
||||
- **Size**: Choose from presets (100MB, 500MB, 1GB, 5GB) or custom
|
||||
- **Initialization Method**: /dev/zero, /dev/urandom, or fallocate
|
||||
- **Partition Scheme**: GPT or MBR
|
||||
- **Partition Count**: 1-4 partitions
|
||||
- **Per-Partition Configuration**:
|
||||
- Filesystem type (NTFS, FAT32, exFAT, ext2/3/4, XFS, swap)
|
||||
- Size in MB (last partition uses remaining space)
|
||||
- Volume label (except for swap)
|
||||
- **Mount**: Option to mount filesystems immediately after creation
|
||||
|
||||
### Example Session
|
||||
|
||||
@ -65,6 +106,15 @@ The script will interactively prompt you for:
|
||||
Forensic Disk Image Creator
|
||||
==========================================
|
||||
|
||||
Checking filesystem tool availability...
|
||||
|
||||
✓ NTFS (mkfs.ntfs available)
|
||||
✓ FAT32 (mkfs.vfat available)
|
||||
✓ exFAT (mkfs.exfat available)
|
||||
✓ ext2/3/4 (mkfs.ext4 available)
|
||||
✓ XFS (mkfs.xfs available)
|
||||
✓ swap (mkswap available)
|
||||
|
||||
Enter output filename (default: forensic_disk.dd): ntfsdisk.dd
|
||||
|
||||
Disk Size Options:
|
||||
@ -76,24 +126,60 @@ Disk Size Options:
|
||||
|
||||
Select disk size [1-5]: 2
|
||||
|
||||
Initialization Method:
|
||||
1) /dev/zero (Fast, zeros - forensically predictable)
|
||||
2) /dev/random (Slow, random data - more realistic)
|
||||
3) fallocate (Fastest, sparse file)
|
||||
|
||||
Select initialization method [1-3]: 1
|
||||
|
||||
Partition Scheme:
|
||||
1) GPT (GUID Partition Table) - Modern, Windows 10/11 default
|
||||
2) MBR (Master Boot Record) - Legacy, compatible with older systems
|
||||
|
||||
Select partition scheme [1-2]: 1
|
||||
|
||||
How many partitions? (1-4): 2
|
||||
|
||||
==========================================
|
||||
Partition 1 Configuration
|
||||
==========================================
|
||||
|
||||
Filesystem Type:
|
||||
1) NTFS (Windows default, requires ntfs-3g)
|
||||
2) FAT32 (Universal compatibility, 4GB file limit)
|
||||
1) NTFS (Windows default)
|
||||
2) FAT32 (Universal compatibility)
|
||||
3) exFAT (Modern, large file support)
|
||||
4) ext4 (Linux default)
|
||||
5) ext3 (Older Linux)
|
||||
6) ext2 (Legacy Linux, no journaling)
|
||||
7) XFS (High-performance Linux)
|
||||
8) swap (Linux swap space)
|
||||
|
||||
Select filesystem [1-7]: 1
|
||||
Select filesystem for partition 1 [1-8]: 1
|
||||
|
||||
Enter volume label (default: FORENSIC): EVIDENCE
|
||||
Size for partition 1 in MB: 400
|
||||
|
||||
Volume label for partition 1 (default: PART1): EVIDENCE
|
||||
|
||||
==========================================
|
||||
Partition 2 Configuration
|
||||
==========================================
|
||||
|
||||
Filesystem Type:
|
||||
1) NTFS (Windows default)
|
||||
2) FAT32 (Universal compatibility)
|
||||
3) exFAT (Modern, large file support)
|
||||
4) ext4 (Linux default)
|
||||
5) ext3 (Older Linux)
|
||||
6) ext2 (Legacy Linux, no journaling)
|
||||
7) XFS (High-performance Linux)
|
||||
8) swap (Linux swap space)
|
||||
|
||||
Select filesystem for partition 2 [1-8]: 4
|
||||
|
||||
[INFO] Partition 2 will use remaining space
|
||||
|
||||
Volume label for partition 2 (default: PART2): DATA
|
||||
```
|
||||
|
||||
### Cleaning Up
|
||||
@ -102,11 +188,11 @@ When finished with your analysis, use the cleanup script:
|
||||
|
||||
```bash
|
||||
# Clean up a specific disk image
|
||||
sudo ./cleanup_forensic_disk.sh
|
||||
sudo ./cleanup.sh
|
||||
# Enter filename when prompted
|
||||
|
||||
# Or clean up all loop devices
|
||||
sudo ./cleanup_forensic_disk.sh
|
||||
sudo ./cleanup.sh
|
||||
# Type 'all' when prompted
|
||||
```
|
||||
|
||||
|
||||
511
pseudodisk.sh
511
pseudodisk.sh
@ -44,7 +44,7 @@ check_dependencies() {
|
||||
command -v dd >/dev/null 2>&1 || missing_tools+=("coreutils")
|
||||
command -v losetup >/dev/null 2>&1 || missing_tools+=("util-linux")
|
||||
command -v parted >/dev/null 2>&1 || missing_tools+=("parted")
|
||||
command -v mkfs.ext4 >/dev/null 2>&1 || missing_tools+=("e2fsprogs")
|
||||
command -v bc >/dev/null 2>&1 || missing_tools+=("bc")
|
||||
|
||||
if [ ${#missing_tools[@]} -gt 0 ]; then
|
||||
print_error "Missing required packages: ${missing_tools[*]}"
|
||||
@ -53,6 +53,57 @@ check_dependencies() {
|
||||
fi
|
||||
}
|
||||
|
||||
# Check filesystem tool availability
|
||||
check_filesystem_tools() {
|
||||
echo ""
|
||||
echo "Checking filesystem tool availability..."
|
||||
echo ""
|
||||
|
||||
# NTFS
|
||||
if command -v mkfs.ntfs >/dev/null 2>&1; then
|
||||
echo -e " ${GREEN}✓${NC} NTFS (mkfs.ntfs available)"
|
||||
else
|
||||
echo -e " ${YELLOW}✗${NC} NTFS (install: sudo apt-get install ntfs-3g)"
|
||||
fi
|
||||
|
||||
# FAT32
|
||||
if command -v mkfs.vfat >/dev/null 2>&1; then
|
||||
echo -e " ${GREEN}✓${NC} FAT32 (mkfs.vfat available)"
|
||||
else
|
||||
echo -e " ${YELLOW}✗${NC} FAT32 (install: sudo apt-get install dosfstools)"
|
||||
fi
|
||||
|
||||
# exFAT
|
||||
if command -v mkfs.exfat >/dev/null 2>&1; then
|
||||
echo -e " ${GREEN}✓${NC} exFAT (mkfs.exfat available)"
|
||||
else
|
||||
echo -e " ${YELLOW}✗${NC} exFAT (install: sudo apt-get install exfat-fuse exfat-utils)"
|
||||
fi
|
||||
|
||||
# ext2/3/4
|
||||
if command -v mkfs.ext4 >/dev/null 2>&1; then
|
||||
echo -e " ${GREEN}✓${NC} ext2/3/4 (mkfs.ext4 available)"
|
||||
else
|
||||
echo -e " ${YELLOW}✗${NC} ext2/3/4 (install: sudo apt-get install e2fsprogs)"
|
||||
fi
|
||||
|
||||
# XFS
|
||||
if command -v mkfs.xfs >/dev/null 2>&1; then
|
||||
echo -e " ${GREEN}✓${NC} XFS (mkfs.xfs available)"
|
||||
else
|
||||
echo -e " ${YELLOW}✗${NC} XFS (install: sudo apt-get install xfsprogs)"
|
||||
fi
|
||||
|
||||
# swap
|
||||
if command -v mkswap >/dev/null 2>&1; then
|
||||
echo -e " ${GREEN}✓${NC} swap (mkswap available)"
|
||||
else
|
||||
echo -e " ${YELLOW}✗${NC} swap (should be in util-linux)"
|
||||
fi
|
||||
|
||||
echo ""
|
||||
}
|
||||
|
||||
# Display banner
|
||||
show_banner() {
|
||||
echo ""
|
||||
@ -110,6 +161,29 @@ get_disk_size() {
|
||||
print_info "Selected disk size: ${DISK_SIZE_MB} MB"
|
||||
}
|
||||
|
||||
# Get initialization method
|
||||
get_init_method() {
|
||||
echo ""
|
||||
echo "Initialization Method:"
|
||||
echo " 1) /dev/zero (Fast, zeros - forensically predictable)"
|
||||
echo " 2) /dev/random (Slow, random data - more realistic)"
|
||||
echo " 3) fallocate (Fastest, sparse file)"
|
||||
echo ""
|
||||
read -p "Select initialization method [1-3]: " INIT_CHOICE
|
||||
|
||||
case $INIT_CHOICE in
|
||||
1) INIT_METHOD="zero" ;;
|
||||
2) INIT_METHOD="random" ;;
|
||||
3) INIT_METHOD="fallocate" ;;
|
||||
*)
|
||||
print_error "Invalid choice"
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
|
||||
print_info "Selected initialization method: $INIT_METHOD"
|
||||
}
|
||||
|
||||
# Get partition scheme
|
||||
get_partition_scheme() {
|
||||
echo ""
|
||||
@ -131,74 +205,154 @@ get_partition_scheme() {
|
||||
print_info "Selected partition scheme: $PARTITION_SCHEME"
|
||||
}
|
||||
|
||||
# Get filesystem type
|
||||
get_filesystem() {
|
||||
# Get number of partitions
|
||||
get_partition_count() {
|
||||
echo ""
|
||||
echo "Filesystem Type:"
|
||||
echo " 1) NTFS (Windows default, requires ntfs-3g)"
|
||||
echo " 2) FAT32 (Universal compatibility, 4GB file limit)"
|
||||
echo " 3) exFAT (Modern, large file support)"
|
||||
echo " 4) ext4 (Linux default)"
|
||||
echo " 5) ext3 (Older Linux)"
|
||||
echo " 6) ext2 (Legacy Linux, no journaling)"
|
||||
echo " 7) XFS (High-performance Linux)"
|
||||
echo ""
|
||||
read -p "Select filesystem [1-7]: " FS_CHOICE
|
||||
read -p "How many partitions? (1-4): " PARTITION_COUNT
|
||||
|
||||
case $FS_CHOICE in
|
||||
1)
|
||||
FILESYSTEM="ntfs"
|
||||
if ! command -v mkfs.ntfs >/dev/null 2>&1; then
|
||||
print_error "mkfs.ntfs not found. Install with: sudo apt-get install ntfs-3g"
|
||||
exit 1
|
||||
fi
|
||||
;;
|
||||
2) FILESYSTEM="vfat" ;;
|
||||
3)
|
||||
FILESYSTEM="exfat"
|
||||
if ! command -v mkfs.exfat >/dev/null 2>&1; then
|
||||
print_error "mkfs.exfat not found. Install with: sudo apt-get install exfat-utils"
|
||||
exit 1
|
||||
fi
|
||||
;;
|
||||
4) FILESYSTEM="ext4" ;;
|
||||
5) FILESYSTEM="ext3" ;;
|
||||
6) FILESYSTEM="ext2" ;;
|
||||
7)
|
||||
FILESYSTEM="xfs"
|
||||
if ! command -v mkfs.xfs >/dev/null 2>&1; then
|
||||
print_error "mkfs.xfs not found. Install with: sudo apt-get install xfsprogs"
|
||||
exit 1
|
||||
fi
|
||||
;;
|
||||
*)
|
||||
print_error "Invalid choice"
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
if ! [[ "$PARTITION_COUNT" =~ ^[1-4]$ ]]; then
|
||||
print_error "Invalid number. Must be between 1 and 4"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
print_info "Selected filesystem: $FILESYSTEM"
|
||||
print_info "Creating $PARTITION_COUNT partition(s)"
|
||||
}
|
||||
|
||||
# Get volume label
|
||||
get_volume_label() {
|
||||
echo ""
|
||||
read -p "Enter volume label (default: FORENSIC): " VOLUME_LABEL
|
||||
VOLUME_LABEL=${VOLUME_LABEL:-FORENSIC}
|
||||
# Get partition configurations
|
||||
get_partition_configs() {
|
||||
PARTITION_CONFIGS=()
|
||||
|
||||
for i in $(seq 1 $PARTITION_COUNT); do
|
||||
echo ""
|
||||
echo "=========================================="
|
||||
echo " Partition $i Configuration"
|
||||
echo "=========================================="
|
||||
|
||||
# Get filesystem
|
||||
echo ""
|
||||
echo "Filesystem Type:"
|
||||
echo " 1) NTFS (Windows default)"
|
||||
echo " 2) FAT32 (Universal compatibility)"
|
||||
echo " 3) exFAT (Modern, large file support)"
|
||||
echo " 4) ext4 (Linux default)"
|
||||
echo " 5) ext3 (Older Linux)"
|
||||
echo " 6) ext2 (Legacy Linux, no journaling)"
|
||||
echo " 7) XFS (High-performance Linux)"
|
||||
echo " 8) swap (Linux swap space)"
|
||||
echo ""
|
||||
read -p "Select filesystem for partition $i [1-8]: " FS_CHOICE
|
||||
|
||||
case $FS_CHOICE in
|
||||
1)
|
||||
PART_FS="ntfs"
|
||||
if ! command -v mkfs.ntfs >/dev/null 2>&1; then
|
||||
print_error "mkfs.ntfs not found. Install: sudo apt-get install ntfs-3g"
|
||||
exit 1
|
||||
fi
|
||||
;;
|
||||
2)
|
||||
PART_FS="vfat"
|
||||
if ! command -v mkfs.vfat >/dev/null 2>&1; then
|
||||
print_error "mkfs.vfat not found. Install: sudo apt-get install dosfstools"
|
||||
exit 1
|
||||
fi
|
||||
;;
|
||||
3)
|
||||
PART_FS="exfat"
|
||||
if ! command -v mkfs.exfat >/dev/null 2>&1; then
|
||||
print_error "mkfs.exfat not found. Install: sudo apt-get install exfat-fuse exfat-utils"
|
||||
exit 1
|
||||
fi
|
||||
;;
|
||||
4)
|
||||
PART_FS="ext4"
|
||||
if ! command -v mkfs.ext4 >/dev/null 2>&1; then
|
||||
print_error "mkfs.ext4 not found. Install: sudo apt-get install e2fsprogs"
|
||||
exit 1
|
||||
fi
|
||||
;;
|
||||
5)
|
||||
PART_FS="ext3"
|
||||
if ! command -v mkfs.ext3 >/dev/null 2>&1; then
|
||||
print_error "mkfs.ext3 not found. Install: sudo apt-get install e2fsprogs"
|
||||
exit 1
|
||||
fi
|
||||
;;
|
||||
6)
|
||||
PART_FS="ext2"
|
||||
if ! command -v mkfs.ext2 >/dev/null 2>&1; then
|
||||
print_error "mkfs.ext2 not found. Install: sudo apt-get install e2fsprogs"
|
||||
exit 1
|
||||
fi
|
||||
;;
|
||||
7)
|
||||
PART_FS="xfs"
|
||||
if ! command -v mkfs.xfs >/dev/null 2>&1; then
|
||||
print_error "mkfs.xfs not found. Install: sudo apt-get install xfsprogs"
|
||||
exit 1
|
||||
fi
|
||||
;;
|
||||
8)
|
||||
PART_FS="swap"
|
||||
if ! command -v mkswap >/dev/null 2>&1; then
|
||||
print_error "mkswap not found. Install: sudo apt-get install util-linux"
|
||||
exit 1
|
||||
fi
|
||||
;;
|
||||
*)
|
||||
print_error "Invalid choice"
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
|
||||
# Get size
|
||||
if [ $i -lt $PARTITION_COUNT ]; then
|
||||
read -p "Size for partition $i in MB: " PART_SIZE
|
||||
if ! [[ "$PART_SIZE" =~ ^[0-9]+$ ]] || [ "$PART_SIZE" -lt 1 ]; then
|
||||
print_error "Invalid size"
|
||||
exit 1
|
||||
fi
|
||||
else
|
||||
PART_SIZE="remaining"
|
||||
print_info "Partition $i will use remaining space"
|
||||
fi
|
||||
|
||||
# Get label (skip for swap)
|
||||
if [ "$PART_FS" != "swap" ]; then
|
||||
read -p "Volume label for partition $i (default: PART$i): " PART_LABEL
|
||||
PART_LABEL=${PART_LABEL:-PART$i}
|
||||
else
|
||||
PART_LABEL=""
|
||||
fi
|
||||
|
||||
PARTITION_CONFIGS+=("$PART_FS|$PART_SIZE|$PART_LABEL")
|
||||
print_info "Partition $i: $PART_FS, ${PART_SIZE}MB, label='$PART_LABEL'"
|
||||
done
|
||||
}
|
||||
|
||||
# Create the disk image
|
||||
create_disk_image() {
|
||||
print_info "Creating disk image file: $FILENAME (${DISK_SIZE_MB} MB)..."
|
||||
print_info "Creating disk image file: $FILENAME (${DISK_SIZE_MB} MB) using $INIT_METHOD..."
|
||||
|
||||
# Use fallocate for faster creation if available
|
||||
if command -v fallocate >/dev/null 2>&1; then
|
||||
fallocate -l ${DISK_SIZE_MB}M "$FILENAME"
|
||||
else
|
||||
dd if=/dev/zero of="$FILENAME" bs=1M count=$DISK_SIZE_MB status=progress
|
||||
fi
|
||||
case $INIT_METHOD in
|
||||
fallocate)
|
||||
if command -v fallocate >/dev/null 2>&1; then
|
||||
fallocate -l ${DISK_SIZE_MB}M "$FILENAME"
|
||||
else
|
||||
print_warning "fallocate not available, falling back to /dev/zero"
|
||||
dd if=/dev/zero of="$FILENAME" bs=1M count=$DISK_SIZE_MB status=progress
|
||||
fi
|
||||
;;
|
||||
zero)
|
||||
dd if=/dev/zero of="$FILENAME" bs=1M count=$DISK_SIZE_MB status=progress
|
||||
;;
|
||||
random)
|
||||
print_warning "Using /dev/urandom - this will be SLOW!"
|
||||
dd if=/dev/urandom of="$FILENAME" bs=1M count=$DISK_SIZE_MB status=progress
|
||||
;;
|
||||
esac
|
||||
|
||||
print_success "Disk image created"
|
||||
print_success "Disk image created with $INIT_METHOD"
|
||||
}
|
||||
|
||||
# Setup loop device
|
||||
@ -209,66 +363,93 @@ setup_loop_device() {
|
||||
print_success "Loop device created: $LOOP_DEVICE"
|
||||
}
|
||||
|
||||
# Create partition table and partition
|
||||
# Create partition table and partitions
|
||||
create_partitions() {
|
||||
print_info "Creating $PARTITION_SCHEME partition table..."
|
||||
|
||||
parted -s "$LOOP_DEVICE" mklabel "$PARTITION_SCHEME"
|
||||
|
||||
print_info "Creating partition..."
|
||||
local start_mb=1
|
||||
local part_num=1
|
||||
|
||||
if [ "$PARTITION_SCHEME" = "gpt" ]; then
|
||||
# For GPT, leave 1MB at start and end for alignment
|
||||
parted -s "$LOOP_DEVICE" mkpart primary 1MiB 100%
|
||||
else
|
||||
# For MBR
|
||||
parted -s "$LOOP_DEVICE" mkpart primary 1MiB 100%
|
||||
fi
|
||||
for config in "${PARTITION_CONFIGS[@]}"; do
|
||||
IFS='|' read -r fs size label <<< "$config"
|
||||
|
||||
if [ "$size" = "remaining" ]; then
|
||||
end="100%"
|
||||
else
|
||||
end="${start_mb}MiB + ${size}MiB"
|
||||
end=$(echo "$start_mb + $size" | bc)
|
||||
end="${end}MiB"
|
||||
fi
|
||||
|
||||
print_info "Creating partition $part_num: ${start_mb}MiB -> $end"
|
||||
|
||||
if [ "$fs" = "swap" ]; then
|
||||
parted -s "$LOOP_DEVICE" mkpart primary linux-swap "${start_mb}MiB" "$end"
|
||||
else
|
||||
parted -s "$LOOP_DEVICE" mkpart primary "${start_mb}MiB" "$end"
|
||||
fi
|
||||
|
||||
if [ "$size" != "remaining" ]; then
|
||||
start_mb=$(echo "$start_mb + $size" | bc)
|
||||
fi
|
||||
|
||||
part_num=$((part_num + 1))
|
||||
done
|
||||
|
||||
# Inform kernel about partition table changes
|
||||
partprobe "$LOOP_DEVICE"
|
||||
sleep 1
|
||||
sleep 2
|
||||
|
||||
print_success "Partition created"
|
||||
print_success "Partitions created"
|
||||
}
|
||||
|
||||
# Format the partition
|
||||
format_partition() {
|
||||
PARTITION="${LOOP_DEVICE}p1"
|
||||
# Format the partitions
|
||||
format_partitions() {
|
||||
local part_num=1
|
||||
|
||||
# Check if partition device exists
|
||||
if [ ! -e "$PARTITION" ]; then
|
||||
print_warning "Partition device $PARTITION not found, trying alternative..."
|
||||
PARTITION="${LOOP_DEVICE}1"
|
||||
fi
|
||||
|
||||
if [ ! -e "$PARTITION" ]; then
|
||||
print_error "Cannot find partition device"
|
||||
cleanup
|
||||
exit 1
|
||||
fi
|
||||
|
||||
print_info "Formatting partition with $FILESYSTEM filesystem..."
|
||||
|
||||
case $FILESYSTEM in
|
||||
ntfs)
|
||||
mkfs.ntfs -f -L "$VOLUME_LABEL" "$PARTITION"
|
||||
;;
|
||||
vfat)
|
||||
mkfs.vfat -n "$VOLUME_LABEL" "$PARTITION"
|
||||
;;
|
||||
exfat)
|
||||
mkfs.exfat -n "$VOLUME_LABEL" "$PARTITION"
|
||||
;;
|
||||
ext2|ext3|ext4)
|
||||
mkfs."$FILESYSTEM" -L "$VOLUME_LABEL" "$PARTITION"
|
||||
;;
|
||||
xfs)
|
||||
mkfs.xfs -f -L "$VOLUME_LABEL" "$PARTITION"
|
||||
;;
|
||||
esac
|
||||
|
||||
print_success "Filesystem created"
|
||||
for config in "${PARTITION_CONFIGS[@]}"; do
|
||||
IFS='|' read -r fs size label <<< "$config"
|
||||
|
||||
# Determine partition device name
|
||||
PARTITION="${LOOP_DEVICE}p${part_num}"
|
||||
if [ ! -e "$PARTITION" ]; then
|
||||
PARTITION="${LOOP_DEVICE}${part_num}"
|
||||
fi
|
||||
|
||||
if [ ! -e "$PARTITION" ]; then
|
||||
print_error "Cannot find partition device for partition $part_num"
|
||||
cleanup
|
||||
exit 1
|
||||
fi
|
||||
|
||||
print_info "Formatting partition $part_num ($PARTITION) with $fs filesystem..."
|
||||
|
||||
case $fs in
|
||||
ntfs)
|
||||
mkfs.ntfs -f -L "$label" "$PARTITION"
|
||||
;;
|
||||
vfat)
|
||||
mkfs.vfat -n "$label" "$PARTITION"
|
||||
;;
|
||||
exfat)
|
||||
mkfs.exfat -n "$label" "$PARTITION"
|
||||
;;
|
||||
ext2|ext3|ext4)
|
||||
mkfs."$fs" -L "$label" "$PARTITION"
|
||||
;;
|
||||
xfs)
|
||||
mkfs.xfs -f -L "$label" "$PARTITION"
|
||||
;;
|
||||
swap)
|
||||
mkswap -L "SWAP$part_num" "$PARTITION"
|
||||
;;
|
||||
esac
|
||||
|
||||
print_success "Partition $part_num formatted"
|
||||
part_num=$((part_num + 1))
|
||||
done
|
||||
}
|
||||
|
||||
# Cleanup function
|
||||
@ -279,22 +460,41 @@ cleanup() {
|
||||
fi
|
||||
}
|
||||
|
||||
# Mount the filesystem
|
||||
mount_filesystem() {
|
||||
# Mount filesystems
|
||||
mount_filesystems() {
|
||||
echo ""
|
||||
read -p "Do you want to mount the filesystem now? (y/n): " MOUNT_NOW
|
||||
read -p "Do you want to mount the filesystem(s) now? (y/n): " MOUNT_NOW
|
||||
|
||||
if [ "$MOUNT_NOW" = "y" ]; then
|
||||
MOUNT_POINT="/mnt/forensic_disk_$$"
|
||||
mkdir -p "$MOUNT_POINT"
|
||||
local part_num=1
|
||||
MOUNT_POINTS=()
|
||||
|
||||
print_info "Mounting to $MOUNT_POINT..."
|
||||
mount "$PARTITION" "$MOUNT_POINT"
|
||||
|
||||
print_success "Filesystem mounted at: $MOUNT_POINT"
|
||||
print_info "To unmount: sudo umount $MOUNT_POINT"
|
||||
|
||||
MOUNTED=true
|
||||
for config in "${PARTITION_CONFIGS[@]}"; do
|
||||
IFS='|' read -r fs size label <<< "$config"
|
||||
|
||||
# Skip swap partitions
|
||||
if [ "$fs" = "swap" ]; then
|
||||
print_info "Skipping mount for swap partition $part_num"
|
||||
part_num=$((part_num + 1))
|
||||
continue
|
||||
fi
|
||||
|
||||
PARTITION="${LOOP_DEVICE}p${part_num}"
|
||||
if [ ! -e "$PARTITION" ]; then
|
||||
PARTITION="${LOOP_DEVICE}${part_num}"
|
||||
fi
|
||||
|
||||
MOUNT_POINT="/mnt/forensic_p${part_num}_$$"
|
||||
mkdir -p "$MOUNT_POINT"
|
||||
|
||||
print_info "Mounting partition $part_num to $MOUNT_POINT..."
|
||||
mount "$PARTITION" "$MOUNT_POINT"
|
||||
|
||||
print_success "Partition $part_num mounted at: $MOUNT_POINT"
|
||||
MOUNT_POINTS+=("$MOUNT_POINT")
|
||||
|
||||
part_num=$((part_num + 1))
|
||||
done
|
||||
fi
|
||||
}
|
||||
|
||||
@ -307,14 +507,38 @@ show_summary() {
|
||||
echo ""
|
||||
echo "Image File: $(realpath $FILENAME)"
|
||||
echo "Size: ${DISK_SIZE_MB} MB"
|
||||
echo "Init Method: $INIT_METHOD"
|
||||
echo "Partition Scheme: $PARTITION_SCHEME"
|
||||
echo "Filesystem: $FILESYSTEM"
|
||||
echo "Volume Label: $VOLUME_LABEL"
|
||||
echo "Loop Device: $LOOP_DEVICE"
|
||||
echo "Partition: $PARTITION"
|
||||
if [ "$MOUNTED" = true ]; then
|
||||
echo "Mount Point: $MOUNT_POINT"
|
||||
echo ""
|
||||
echo "Partitions:"
|
||||
|
||||
local part_num=1
|
||||
for config in "${PARTITION_CONFIGS[@]}"; do
|
||||
IFS='|' read -r fs size label <<< "$config"
|
||||
|
||||
PARTITION="${LOOP_DEVICE}p${part_num}"
|
||||
if [ ! -e "$PARTITION" ]; then
|
||||
PARTITION="${LOOP_DEVICE}${part_num}"
|
||||
fi
|
||||
|
||||
if [ "$fs" = "swap" ]; then
|
||||
echo " [$part_num] $PARTITION - $fs (${size}MB)"
|
||||
else
|
||||
echo " [$part_num] $PARTITION - $fs (${size}MB) - '$label'"
|
||||
fi
|
||||
|
||||
part_num=$((part_num + 1))
|
||||
done
|
||||
|
||||
if [ ${#MOUNT_POINTS[@]} -gt 0 ]; then
|
||||
echo ""
|
||||
echo "Mount Points:"
|
||||
for mp in "${MOUNT_POINTS[@]}"; do
|
||||
echo " $mp"
|
||||
done
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo "=========================================="
|
||||
echo " Forensic Analysis Commands"
|
||||
@ -327,23 +551,15 @@ show_summary() {
|
||||
echo "Hex editor analysis:"
|
||||
echo " hexdump -C $FILENAME | less"
|
||||
echo " xxd $FILENAME | less"
|
||||
echo " sudo apt-get install bless # GUI hex editor"
|
||||
echo " bless $FILENAME"
|
||||
echo ""
|
||||
echo "Mount the image later:"
|
||||
echo " sudo losetup -f $FILENAME"
|
||||
echo " sudo losetup -l # List loop devices"
|
||||
echo " sudo mount /dev/loopXp1 /mnt/mountpoint"
|
||||
echo ""
|
||||
echo "Analyze with forensic tools:"
|
||||
echo " sudo apt-get install sleuthkit"
|
||||
echo " mmls $FILENAME # Show partition layout"
|
||||
echo " fsstat -o 2048 $FILENAME # Filesystem details"
|
||||
echo " fls -o 2048 $FILENAME # List files"
|
||||
echo " mmls $FILENAME"
|
||||
echo ""
|
||||
echo "Clean up (when done):"
|
||||
if [ "$MOUNTED" = true ]; then
|
||||
echo " sudo umount $MOUNT_POINT"
|
||||
if [ ${#MOUNT_POINTS[@]} -gt 0 ]; then
|
||||
for mp in "${MOUNT_POINTS[@]}"; do
|
||||
echo " sudo umount $mp"
|
||||
done
|
||||
fi
|
||||
echo " sudo losetup -d $LOOP_DEVICE"
|
||||
echo ""
|
||||
@ -357,12 +573,14 @@ main() {
|
||||
show_banner
|
||||
check_root
|
||||
check_dependencies
|
||||
check_filesystem_tools
|
||||
|
||||
get_filename
|
||||
get_disk_size
|
||||
get_init_method
|
||||
get_partition_scheme
|
||||
get_filesystem
|
||||
get_volume_label
|
||||
get_partition_count
|
||||
get_partition_configs
|
||||
|
||||
echo ""
|
||||
echo "=========================================="
|
||||
@ -370,9 +588,20 @@ main() {
|
||||
echo "=========================================="
|
||||
echo "Filename: $FILENAME"
|
||||
echo "Size: ${DISK_SIZE_MB} MB"
|
||||
echo "Init Method: $INIT_METHOD"
|
||||
echo "Partition Scheme: $PARTITION_SCHEME"
|
||||
echo "Filesystem: $FILESYSTEM"
|
||||
echo "Volume Label: $VOLUME_LABEL"
|
||||
echo "Partitions: $PARTITION_COUNT"
|
||||
|
||||
for i in $(seq 1 $PARTITION_COUNT); do
|
||||
config="${PARTITION_CONFIGS[$((i-1))]}"
|
||||
IFS='|' read -r fs size label <<< "$config"
|
||||
if [ "$fs" = "swap" ]; then
|
||||
echo " [$i] $fs (${size}MB)"
|
||||
else
|
||||
echo " [$i] $fs (${size}MB) - '$label'"
|
||||
fi
|
||||
done
|
||||
|
||||
echo ""
|
||||
read -p "Proceed with creation? (y/n): " CONFIRM
|
||||
|
||||
@ -384,8 +613,8 @@ main() {
|
||||
create_disk_image
|
||||
setup_loop_device
|
||||
create_partitions
|
||||
format_partition
|
||||
mount_filesystem
|
||||
format_partitions
|
||||
mount_filesystems
|
||||
|
||||
show_summary
|
||||
}
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user