ArsenalRecon / Arsenal-Image-Mounter

Arsenal Image Mounter mounts the contents of disk images as complete disks in Microsoft Windows.
https://ArsenalRecon.com/weapons/image-mounter
Other
496 stars 85 forks source link

I encountered a problem #27

Closed Keops10 closed 7 months ago

Keops10 commented 1 year ago

Hello When I want to run Managed Source, I encounter the error in the picture, can you help me how to solve it?

LTRData commented 1 year ago

Yes, I will write a "how-to build" soon with some information about this. But in short:

The first message is just about the documentation project. You can ignore that, it is not required for building the dlls. It requires Sandcastle if you anyway want to build it.

The second problem is that the projects depend on a fork of DiscUtils that is not yet on NuGet (but will probably be soon). The fork source is here: https://github.com/LTRData/DiscUtils You can build from that source and feed Arsenal Image Mounter build with the nuget package files you will get as output (add a local directory nuget search paths in visual studio nuget settings).

Hope this helps! There will otherwise soon be a major layout change to this project with all VB code converted to C# etc and I will try to make it only dependent on packages available through online repositories.

Keops10 commented 1 year ago

Thanks for the help. I will post the result here. yes I will look forward to the project going through C#.

LTRData commented 1 year ago

Quick update, the DiscUtils dependencies are now on NuGet and should be possible to restore automatically during Arsenal Image Mounter build process.

Keops10 commented 1 year ago

You're amazing my friend, thank you. We are waiting for the c# conversion for Arsenal Imager at this speed :)

LTRData commented 1 year ago

That is the old mount tool GUI application that is pretty much a proof-of-concept sample application that shows how to consume API etc. It is a bit limited, for example it does not use our generic write filter driver. For write-temporary operation it relies on support through the backend image file format provider. That means that for example vdi, vhdx etc where it can create a temporary differencing image is supported. Some old versions of libewf.dll also had a write-temporary feature. Raw/dd formats are not supported in write-temporary mode in that application.

You can however do that at command line: aim_cli --mount --filename=image.dd --writeoverlay=image.diff

The next message, I would guess, is probably shown because you have a version of libewf.dll somewhere that is built without some required options. We have versions built with all options needed available in this repository.

The conversion of the code is mostly done but I need some more tests and coordinate it with some other changes and projects. It will probably arrive on GitHub in about a week.

Keops10 commented 1 year ago

I am using the libewf version from this repository. This error may be related to this version then. As far as I understand, there is no write support for images in E01 format in the current version.

LTRData commented 1 year ago

I am using the libewf version from this repository. This error may be related to this version then. As far as I understand, there is no write support for images in E01 format in the current version.

It depends on what you want to do. If you want to create a new e01 image file from for example a hard drive, that is possible at command line: aim_cli --device=\\?\physicaldrive3 --saveas=D:\new_image.e01

If you have an existing e01 image and you want to mount that in write-temporary mode: aim_cli --mount --filename=D:\new_image.e01 --writeoverlay=D:\new_image.diff

It is not possible to modify an existing e01 image. That is by design. It is a forensics image format.

LTRData commented 1 year ago

I have not seen that particular version, but I have seen some other C# conversions before. However, I want to clean up a bit and refactor the layout to a bit more reasonable logic in namespaces etc. Those are breaking changes, but it should be reasonably easy to find corresponding classes in new namespaces anyway.

I am also about to prepare better examples on how to use the libraries in PowerShell to identify volumes and mount points for mounted images etc.

LTRData commented 1 year ago

That is possible already in the Arsenal Image Mounter application running in free mode. Have you checked it? https://arsenalrecon.com/products/arsenal-image-mounter

LTRData commented 1 year ago

If you then want to use the API for it from another application, I will prepare some examples together with next update of the repository here. But in general, the source for the command line tool shows roughly how it is done.

Keops10 commented 1 year ago

hello again, I saw that an image belonging to ubuntu is not mounted, how can I overcome this?

LTRData commented 1 year ago

hello again, I saw that an image belonging to ubuntu is not mounted, how can I overcome this?

You mean not mounted as in mounted, but you cannot see the files in Windows Explorer?

You can either use an ext file system driver for Windows to mount the Linux file system, or use our application in proffesonal mode to mount in "file system driver bypass mode".

There are probably other ways too. It is practically speaking like when you attach a physical Linux disk to a Windows machine.