Loading ...
Sorry, an error occurred while loading the content.
 

Re: [linux_forensics] Odd sector/USB/VMWare question

Expand Messages
  • Enda Cronnolly
    Quoting: Steve Fowler
    Message 1 of 5 , Apr 1, 2004
      Quoting: "Steve Fowler" <sfowler@data-....


      > So tell us Cory, what'd you get?

      I threw this question out on the Bochs developers mailing list
      http://bochs.sourceforge.net

      Because the block device is implemented as a file by linux, and because it
      inherently gets a 1k block size, nothing that accesses the disk "through"
      linux and its block device representation will see the odd sector at the end
      of a disk.

      For this Vmware idea to work, it would have to interact with the hardware
      device directly as if it were "the" driver for the device, and then supply
      the data to both itself and back to linux. Does that sound like the
      operations of Vmware?

      Meanwhile to get your odd sectored disks imaged, consider using:
      http://www.feyrer.de/g4u/

      -Enda.

      > =========
      > At 01:56 PM 3/16/04, you wrote:
      > >I've got (what I consider to be) a fairly unique question. I thought it
      > >best to bounce this off the group before I go do anything crazy like
      > >"experiment" or "check for myself" so here we are. ;)
      > >
      > >Let's say I'm running VMWare 4.x with $INSERT_LINUX_FLAVOR_HERE as the
      host
      > >OS. I install {Free|Net|Open}BSD, or, heaven forbid, Windows, inside
      VMWare
      > >as a guest OS. I place a hard drive with an odd number of total sectors
      > >into a USB caddy and plug this into my Linux box. I connect the USB
      device
      > >to the VMWare virtual machine. I image the drive with [s]dd in
      > >BSD[Windows].
      > >
      > >How many sectors do I get? Do I get n (as expected in BSD/Windows) or
      n-1
      > >(as in Linux)?
      > >
      > >Has anyone tested this previously? Does anyone have any brilliant insight
      > >into how Linux/VMWare handle the USB handoff? Does anyone care?
      > >
      > >Thanks,
      > >
      > >Cory Altheide
      > >Senior Network Forensics Specialist
      > >NNSA Information Assurance Response Center (IARC)
      > >altheidec@...
      > >
      > >
      > >
      > >
      > >Yahoo! Groups Links
      > >
      > >
      > >
      > >
      >
      >
      >
      >
      > Yahoo! Groups Links
      >
      >
      >
      >
      >
      >
    • Altheide, Cory B. (IARC)
      Sorry I didn t reply sooner - I haven t had a chance to test this yet as I m currently tasked with real work instead of fun research. ;) Cory Altheide
      Message 2 of 5 , Apr 7, 2004
        Sorry I didn't reply sooner - I haven't had a chance to test this yet as I'm
        currently tasked with "real work" instead of "fun research." ;)

        Cory Altheide
        Senior Network Forensics Specialist
        NNSA Information Assurance Response Center (IARC)
        altheidec@...


        > -----Original Message-----
        > From: Steve Fowler [mailto:sfowler@...]
        > Sent: Wednesday, March 31, 2004 12:40 PM
        > To: linux_forensics@yahoogroups.com
        > Subject: Re: [linux_forensics] Odd sector/USB/VMWare question
        >
        >
        > So tell us Cory, what'd you get?
        >
        > =========
        > At 01:56 PM 3/16/04, you wrote:
        > >I've got (what I consider to be) a fairly unique question.
        > I thought
        > >it best to bounce this off the group before I go do anything
        > crazy like
        > >"experiment" or "check for myself" so here we are. ;)
        > >
        > >Let's say I'm running VMWare 4.x with
        > $INSERT_LINUX_FLAVOR_HERE as the
        > >host OS. I install {Free|Net|Open}BSD, or, heaven forbid, Windows,
        > >inside VMWare as a guest OS. I place a hard drive with an
        > odd number
        > >of total sectors into a USB caddy and plug this into my
        > Linux box. I
        > >connect the USB device to the VMWare virtual machine. I image the
        > >drive with [s]dd in BSD[Windows].
        > >
        > >How many sectors do I get? Do I get n (as expected in
        > BSD/Windows) or
        > >n-1 (as in Linux)?
        > >
        > >Has anyone tested this previously? Does anyone have any brilliant
        > >insight into how Linux/VMWare handle the USB handoff? Does
        > anyone care?
        > >
        > >Thanks,
        > >
        > >Cory Altheide
        > >Senior Network Forensics Specialist
        > >NNSA Information Assurance Response Center (IARC)
        > altheidec@...
        > >
        > >
        > >
        > >
        > >Yahoo! Groups Links
        > >
        > >
        > >
        > >
        >
        >
        >
        >
        > Yahoo! Groups Links
        >
        >
        >
        >
        >
        >
      Your message has been successfully submitted and would be delivered to recipients shortly.