Lect13 - Advanced dd

Question 1

What are the four steps to carve for a file using xxd and dd?

Answer 1

1. Look for file signature using:
   xxd | grep ffd8
2. Look for end signature using:
   xxd | grep ffd9
3. Calculate file count:
   End of sig - start of sig = size of file
4. Carved file out using DD

Question 2

How does the dd command looks like to carve a file?

Answer 2

dd if=/dev/sda of=data.raw bs=1 skip=446 count=64

skip =

Where to start within our input file. This is based on the bs= parameter:

bs=512 skip=63 - we skip 512*63 bytes (32256 bytes)

bs=1 skip 446 - we skip 446*1 bytes (446 bytes)

count =

How many chunks. This is also based on the bs= parameter:

bs=512 count=2 - we copy 512*2 bytes (1024 bytes)

bs=1 count=64 - we copy 64*1 bytes (64 bytes)

Question 3

How can you carve out partitions?

Answer 3

1. Check partitions with fdisk or gdisk
2. Take note of bs=
3. Use START & LENGTH and BLOCKSIZE for dd

dd if=able_3.raw of=able_3.part1.raw bs=512 skip=2048 count=102400