Skip to content
Disk Image Parser

Posts tagged: #dfir

← Back to all posts
Why your disk image won't open
A practitioner's checklist for disk images that refuse to mount: format mismatches, split sets, truncated acquisitions, wrong sector size and corruption.
dfirforensicstroubleshootingdisk-imaging
Identify NTFS, FAT, exFAT and ext by signature
Detect filesystems from the superblock instead of trusting the partition type byte. Magic numbers, the offsets that trip people up, and faking it.
ntfsext4filesystemsdfir
Open an E01 disk image in your browser
Browse an Expert Witness Format (E01) image without FTK Imager or a local install. How EWF segments, compression and hashing actually work.
e01ewfdisk-imagingdfir
Reading MBR and GPT partition tables by hand
Walk the partition table of a disk image yourself: MBR's 64 bytes, the EBR chain, GPT headers, CRCs, and the offset bugs that read the wrong sector.
mbrgptpartitionsdfir