Skip to content
Disk Image Parser

Series

Browser-based disk forensics

4 posts in this series. Read them in order or jump to any one.

  1. Open an E01 disk image in your browser

    Browse an Expert Witness Format (E01) image without FTK Imager or a local install. How EWF segments, compression and hashing actually work.

  2. Reading MBR and GPT partition tables by hand

    Walk the partition table of a disk image yourself: MBR's 64 bytes, the EBR chain, GPT headers, CRCs, and the offset bugs that read the wrong sector.

  3. Identify NTFS, FAT, exFAT and ext by signature

    Detect filesystems from the superblock instead of trusting the partition type byte. Magic numbers, the offsets that trip people up, and faking it.

  4. Why your disk image won't open

    A practitioner's checklist for disk images that refuse to mount: format mismatches, split sets, truncated acquisitions, wrong sector size and corruption.

All posts in this series

Open an E01 disk image in your browser
Browse an Expert Witness Format (E01) image without FTK Imager or a local install. How EWF segments, compression and hashing actually work.
e01ewfdisk-imagingdfir
Reading MBR and GPT partition tables by hand
Walk the partition table of a disk image yourself: MBR's 64 bytes, the EBR chain, GPT headers, CRCs, and the offset bugs that read the wrong sector.
mbrgptpartitionsdfir
Identify NTFS, FAT, exFAT and ext by signature
Detect filesystems from the superblock instead of trusting the partition type byte. Magic numbers, the offsets that trip people up, and faking it.
ntfsext4filesystemsdfir
Why your disk image won't open
A practitioner's checklist for disk images that refuse to mount: format mismatches, split sets, truncated acquisitions, wrong sector size and corruption.
dfirforensicstroubleshootingdisk-imaging