search

libyal / libewf-legacy

Legacy version of libewf
GNU Lesser General Public License v3.0
10 stars 5 forks source link

How can I prepend data (e.g. partition table) to an EWF single-volume image? #23

Closed JustMyGithub closed 1 year ago

JustMyGithub commented 1 year ago

In order to convert a huge e01 from volume image to disk image I would like to prepend blocks in an existing (segmented) image like

old.e01 old.e02 old.e03 ... + prepend.e01 becoming prepend+old.e01 old.e02 old.e03

It should be possible to only edit old.e01 and thereby a much smaller amount of data compared to export both images, binary merge and recreation of e01. As e01 itself does not care about the size of each segment it should not be a problem per-se. Change the number of blocks in the header, fix header CRC, append blocks of prepend.e01 to new header, append blocks of old.e01 to new_header+blocks_of_prepend.e01 and append a md5 to it, right?

joachimmetz commented 1 year ago

Have a look at https://github.com/libyal/libbfoverlay it might be able to do what you want without bothering to do trickery at the EWF level

Some examples https://github.com/libyal/libbfoverlay/wiki/Examples

JustMyGithub commented 1 year ago

If I understand you correctly your idea is to mount the e01 using ewfmount and on top of that do another mount with libbfoverlay to have a virtual device that consist of the gpt header followed by the bytes of the mounted e01-image, right?

As the tool that has problems handling the partition image does not accept a virtual drive as input this is not a workaround, sadly.

This can likely reduce the number of full-rewrites to 1, but not eliminate the (in theory) unneeded rewrites completely.

joachimmetz commented 1 year ago

If I understand you correctly your idea is to mount the e01 using ewfmount and on top of that do another mount with libbfoverlay to have a virtual device that consist of the gpt header followed by the bytes of the mounted e01-image, right?

correct

As the tool that has problems handling the partition image does not accept a virtual drive as input this is not a workaround, sadly.

bfoverlaymount and ewfmount both expose a "RAW storage media image" file, not a virtual mounted drive. Otherwise you can always create an E01 of that image but requires more IO and storage.

joachimmetz commented 1 year ago

No reaction for original reporter closing issue.