All disks are block devices… blah… Volumes, partitions, file systems, ???

Imaging Tools

Software for pulling the bits off a disk. Note that forensicswiki.org has some useful info on this.

• Disk Imaging@forensicswiki.org
• AIR - Automated Image and Restore
• dskdump
• ddrescue@forensicswiki.org
• dcfldd@forensicswiki.org
• rdd, ‘robust with respect to read errors’.
• AcetoneISO
• Snorkel, which is Java, and interesting, but closed-source and by-arrangement.
• PyFlag includes disk forensics

Drive Emulation

• CDemu, a CD/DVD drive emulator for Linux
• Mount raw CD-ROM image - this has some good info.
• DAEMON Tools for Windows

Converting between image formats

• A list of tools for linux
• CloneCD image to ISO image file converter

File System Support

How to interpret the bits of a disk image and turn it into a set of files. e.g. NTFS, FAT, ADFS, ISO, etc.

• Comparison of file systems
• File Systems@forensicswiki.org
• LIBDSK is a library for accessing discs and disc image files.
• ADFS
  • Reading DFS and ADFS floppy disks under Linux
  • FUSE ADFS
• Linux kernel file system support