Preparations

A

If you want to edit the registry in order to make sure that winfe starts with the fixed disks unmounted , I have found this workaround  Make a folder in C: called copyreg

The folder copyreg must contain the following files you can get from c:\windows\system32  
reg.exe, regedt32.exe, regini.exe, registeriepkeys.exe , regsvc.dll, regsvr32.exe

B

I have made a folder c:\programs with subfolders, in which I put all
my standalone programs.

-Subfolder FILEMANAGER contains Explorer++.exe, and a twin-pane manager like Twodirs or Unreal Commander (which has an outstanding built-in search tool,that
works with regular expressions). If you unpack the setup with Uniextract.exe,
you can use it as a standalone app.

-subfolder FAU contains the dd from the Forensic Acquisition utilities
-subfolder DD with the dd.exe from John Newbigin and dd ODIN
-subfolder OPERA with opera.oneuse.

Download "keyboard.exe" (at your own risk : I took it from a bartpe via bittorrent)


The steps for making a winfe disk

Start, Run, enter the command : net user administrator /active:yes

Restart your computer, and log on into the Administrator account

Open  a command prompt as admin.

(To start a command prompt session with full Administrator rights, right-click the Command Prompt Accessories shortcut (Start, Programs, Accessories, Command Prompt) and select Run as administrator from the displayed context menu.When you run as Administrator, the command prompt title will show as Administrator: Command Prompt instead of the regular C:\Windows\system32\cmd.exe making it easier to tell when multiple command prompt windows are running)

Enter the command :

cd c:\Program Files\Windows AIK\Tools\PETools\

Then you enter

cmd /k copype.cmd x86 c:\WinFEx86

Before you mount everything, youll have to remove

the file bootfix.bin  in c:\WinFEx86\ISO\boot.

This bootfix.bin gives you the choice : start from cd, or not.

You navigate to

cd c:\program files\windows AIK\Tools\Petools\

Now we will mount everything with the following command :

imagex /mountrw C:\WinFEx86\ISO\sources\boot.wim 1 C:\WinFEx86\mount

If you want to change keyboards easily, youll need the file keyboard.exe,

which you can download here:

and youll need to copy it to :

C:\WinFEx86\mount\windows\system32

With WinFe mounted, you can copy all the programs you have
collected in the folder C:\programs to the folder C:\WinFEx86\mount\Program Files

Be sure to always close the Windows explorer window.

You dont want it to be open, when you unmount everything.

navigate to this directory :

cd c:\program files\windows AIK\Tools\Petools

In order to install special drivers youll need, youll

have to do commands like this :

peimg.exe /inf=X:\Windows\System32\SATADRIVER\WINXP\fast.inf C:\WinFEx86\mount\Windows

or peimg.exe /inf=X:\Windows\System32\SATADRIVER\WINXP\fast.inf C:\WinFEx86\mount\Windows

Youll see the message : installing inf package.

In order to add additional packages :

cd c:\program files\windows AIK\Tools\Petools

peimg /list /image=c:\WinFEx86\mount

The Packages will be listed, with a minus sign to the left of the package name.

We are going to add 2 Packages to the Windows directory in the WinPE image. Type the following:
cd c:\program files\windows AIK\Tools\Petools\

peimg /install=WinPE-WMI-Package C:\WinFEx86\mount\Windows

peimg /install=*XML* C:\WinFEx86\mount\Windows <enter>
peimg /install=WinPE-Scripting-Package C:\WinFEx86\mount\Windows

Now type: peimg /list /image=C:\WinFEx86\mount\

You will see a + sign next to the WinPE scripting, wmi and XML packages.

If you want to be sure your hard disks are not mounted, when you image

them, then be sure to edit the registry. If you prefer all your hard disks

mounted, and you dont want to use the cd in a forensic environment,

but only for ordinary imaging, then you skip the registry steps.

navigate to :

cd c:\WinFEx86

Then do the following command :

copy C:\copyreg

the six files, called reg.exe, etcetera, that I had you put in the folder

c:\copyreg, will now be in C:\WinFEx86

Now well change the registry.

cd c:\Winfex86

REG LOAD HKLM\WINFE2 .\mount\Windows\System32\config\SYSTEM

(the following sentence will turn off auto-mounting of fixed hard drives)

REG ADD HKLM\WINFE2\ControlSet001\Services\MountMgr /v NoAutoMount /t REG_DWORD /d 1 /f

REG ADD HKLM\WINFE2\ControlSet001\Services\partmgr\Parameters /v SanPolicy /t REG_DWORD /d 3 /f

REG UNLOAD HKLM\WINFE2

Now you copy the contents of your C:\programs, where you put all

your necessary standalones, to  c:\WinFe\mount\Program Files

Now we can unmount

cd c:\Program Files\Windows AIK\Tools\x86

imagex.exe /unmount /commit C:\WinFEx86\mount

This takes quite a while

We can make the iso

cd c:\program files\windows aik\toolsx86

oscdimg -n -m -o -bC:\WinFEx86\etfsboot.com C:\WinFEx86\ISO C:\WinFEx86\WinFEX86.iso

You can then burn the iso with Imgburn

This is the procedure : in order to learn how to mount disks readonly and such,

you will have to learn all the commands of diskpart.exe.

I have made this disk  instead of downloading a torrent from the dark

abyss of the web  in order to be able to image my hard disks with my

favourite program : dd.exe  for windows from John Newbigin.

http://www.chrysocome.net/dd

You can  take version 0.5 , or the newly compiled version 0.6 beta

on the site of webconverger;

http://webconverger.com/dd.exe

1. Make sure the the selection of drive e
is working

//

 dd --list      output to txt-file :  dd --list 2> output.txt

I takes a long time to image a disk, but the result is flawless.

Ive imaged Vista, windows 7, dualboot disks, etc.
When you re-image back to another disk, be sure that this one
is zero-filled. I always do this with Hirens boot cd, that contains
all the Hard disk tools from every hard disk manufacturer on the
planet, or almost.

For zero-filling, the following terms can be found :
erase disk, low level format, or fill drive with zeroes

Use of this disk to back up your hard drive to an external hard drive

I have a laptop with two hard drives, and want to back up the
first hard drive to an external hard drive.

preparations :

be sure your external drive is formatted NTFS.
Then theres no need for splitting the backup in chunks of 2 gb,
because NTFS can handle large files.

You attach the hard drive (via a hard disk enclosure, or
via an usb-atapi cable)

You change the boot order in the bios, so the cd boots first.

Then you start with a command window.

Attention : once you close the command window, the computer shuts down.

Once you see the command window, type

keyboard.exe

This will give you the option to choose a localized keyboard, like belgian

You type

be

Then hit ENTER twice.

You will have to open a second command window to use your belgian azerty
keyboard.

Written by gverswijvel 

August 9, 2009 at 4:18 pm

Posted in Uncategorized

Tagged with dd.exe, forensic boot cd, make hard drive image with dd.exe for windows, winfe, winpe



Pages
About
Search

search site archives
Blogroll
WordPress.com
WordPress.org
Archives
August 2009
Categories
Uncategorized 
Meta
Log in
Site Feed
Comments Feed
Back to top


Blog at WordPr