using image files created by testdisk

[Nigel Bruce]

I have a 70gb image.dd file now and I can view the hex code in hexeditor, how do I capture and return files found that are needed to usable form again?  I read first step is to rename the image file by changing the *.dd extension to *.img,   I need to "carve out" specific files from the image.

The mbr tool was really cool, I was backing up several boot record copies to sectors 2-10 and then changing the signature bytes in the copies and changing the partition table entries trying everything I could think of with what there was to work with in mbrtool to make the drive usable again, to no avail unfortunately but the experience is priceless, thanks so much for all of these utilities.

The stumbling block was LBA 48bit drive size limitation from nt 5.0 and below to xp, vista and 7.  I messed with the drive geometry, upgraded w2k to sp4 and still couldn't get the LBA48 working.  mbrtool kept reading the drive as limited to 137gbs  2088/255/63.  the mbr was reporting only 240 heads so I changed it to 255 and then imaged the drive.  Got over 70gbs for an image and I can see the code now,  need to extract the files how do I do that?

Thanks for any help,  nigel 

[Joep]

Hello,

If the dd image is raw (so you didn't compress it) you should be able to mount it. I think Linux should allow you to do that but I am not familiar enough with Linux to tell you how.

In Windows, winimage may be able to do it (I'd try if I were you)? Wait; this may be what you want (if using Windows): http://osforensics.com/tools/mount-disk-images.html

If the volume captured was corrupt however, you may need something like our iRecover to rebuild a virtual file system and extract data.