To mount a partition from a dd image earlier, you had to first run 'mmls' or 'fdisk -l' to determine the starting offset of the partition, then run the 'mount' command specifying the correct partition type, offset and mount point. But I've always wanted an easier way to do this, preferably a one click or single command that automatically figures out this info and mounts all partitions just as the system auto-mounts an inserted USB disk.
'udisks' is the utility ubuntu uses to determine disk geometry, partitions, offsets and auto-mount them when you insert a new disk (removable or fixed) into your system. udisks can do the same job when a DD image is supplied via the loopback option. The loopback functionality existed even before but it would not work with DD images in older versions.
So whats the command to do this?
Now for the automation part, how do we do this via a right-click menu on Nautilus?
This is easily accomplished with the 'Nautilus-Actions Configuration Tool'. This can be installed via the 'Ubuntu Software Center'. Launch it and create a new 'action' entry in the items list on the left.
Go to the command tab. For Path, type 'udisksctl'. For Paremeters, 'loop-setup -r -f %f' See screenshot below.
You can optionally define a Basename filter (under Basenames tab) so that the particular option only shown up on filenames that have the extension DD. However do note that many dd images do not have the DD extension.
Now, most evidence we use is not a DD image but an Encase E01 file. This would be really great if we could also automate mounting of partitions from Encase E01 files. In the next blog entry, we will see how you can do exactly that.
'udisks' is the utility ubuntu uses to determine disk geometry, partitions, offsets and auto-mount them when you insert a new disk (removable or fixed) into your system. udisks can do the same job when a DD image is supplied via the loopback option. The loopback functionality existed even before but it would not work with DD images in older versions.
So whats the command to do this?
udisksctl loop-setup -r -f MyImage.DDThe -r option makes it a read-only mount. No root privilege is required, and all partitions are auto-mounted (under /media/<user>/..) and appear in Files explorer.
Now for the automation part, how do we do this via a right-click menu on Nautilus?
This is easily accomplished with the 'Nautilus-Actions Configuration Tool'. This can be installed via the 'Ubuntu Software Center'. Launch it and create a new 'action' entry in the items list on the left.
Go to the command tab. For Path, type 'udisksctl'. For Paremeters, 'loop-setup -r -f %f' See screenshot below.
You can optionally define a Basename filter (under Basenames tab) so that the particular option only shown up on filenames that have the extension DD. However do note that many dd images do not have the DD extension.
Now, most evidence we use is not a DD image but an Encase E01 file. This would be really great if we could also automate mounting of partitions from Encase E01 files. In the next blog entry, we will see how you can do exactly that.
