Hi
I hope my topic is in the right sector, for it is a general one. I would like to learn to do diy disk imaging, be it a floppy, cd, hdd. My question to the wise and knowing: Where might one start? Is this a subject only for the 16 bit netherworld or be there a path in the light of 32 bit reason? Any feedback is welcome.
many thanks locche
You can read a disk by opening it as the magic file "\\.\X:" (replace X with the drive letter) Read the documentation for CreateFile (it's all in there.)
After that, you just treat the whole disk as one big file -- in your case, create another 'normal' file to write to, read chunks for the disk 'file' and write them to this new file. Close all handles when you're finished. Done :wink
Tedd,
Does that include c:? Can you get to any sector including bad sectors, really secret file space like the forensic files?
Dave.
Yes it includes C:
You'd have to navigate the filesystem yourself, but other than that, I don't think there's anything stopping you from accessing a particular area (possibly with the exception of locked parts of the disk, which should only be temporary) and therefore, any particular file, if you can find it.
What about \userprofile\NTUSER.DAT? Registry data?
It would be a whole lot easier to just use any of the dozen-or-so Norton Ghost clones out there (in a DOS-like environment) to completely bypass any semantics -- because I really doubt any user-mode code will have complete access to the entire system partition.
Booting the system with a BartPE disc or a Win PE disc can solve the locked regions problems. Some tools like DriveImage XML are using the Microsoft Volume Shadow Service (VSS) to read discs in use.
Hello Tedd
Thanks for pointing out the direction. I find that really excellent. One problem I suffer with programming is to find an idea to keep me interested long enough to perservere through the pains of learning. So when you finally do have an appealing idea, it's nice to have a place to start the meal.
Cheers Locche