How to open .DD file to analyze it?

I am new to this process and I'm struggling a bit. I was given a .dd file to analyze as an assignment in my current college course. I am using Sans Sift in a virtual box environment, but I have no idea how to open this file. I saved it to my desktop and all attempts by me (in terminal) to open it have failed.

Can anyone detail the process as how to properly open this type of file for analysis? If more information is needed, I will do my best to explain. We are attempting to look at the FAT and derive information from it.

2 Answers

The DD file is a disk image file and a replica of a hard disk drive.

The file that has a .dd extension is usually created with an imaging tool called DD.

The utility provides a command line interface to create disk images on a system running UNIX and GNU/LINUX OS.

To see what structure the file has, you can use fdisk:

sudo fdisk -l file.dd

fdisk shows only the type of partition but not the file system to know it is necessary to use cfdisk.

sudo cfdisk file.dd

So we will know what file system it is.

To know where the partition to mount begins in bytes, it is necessary to see the Start column.

Assuming you start at sector 92408 and each sector is 512 bytes.

The beginning of the partition in bytes will be 92408 * 512, this is what is known as offset.

The shell can do the necessary multiplication to calculate the offset by typing

$((92408 * 512))

Once we have everything we need, we are going to mount a dd image by typing:

sudo mount -t filesystem -o loop, ro, offset = $ ((start * 512)) file.dd mount_point -t: we indicate the file system -o: indicates options for mount loop: it is necessary to convert a static image into a dynamic image. ro: is in read mode (read-only) offset: indicates where the partition to mount begins in bytes start: is the data corresponding to the start column of fdisk or cfdisk

To compliment existing answer I would recommend to use kpartx.

It is installable by

sudo apt-get install kpartx

and allows to create loop devices for the dd-image:

sudo kpartx -a -v file.dd

and then you can find the files in the /dev/mapper/ directory.