DDI config manipulation

47 views
Skip to first unread message

Courtney Webb

unread,
Mar 8, 2015, 3:22:25 AM3/8/15
to datarecovery...@googlegroups.com
Hi. During Scott's class I remember him talking about some people in this group who had developed their own method of manipulating the DDI config to only image certain areas. I believe this was before the DDI could do logical imaging based on MFT entries etc. Was hoping to get in touch with those people, or anyone else that may have figured out how the config works, such as offsets, byte value meaning. 

Thanks
Courtney  

Frank Meincke

unread,
Mar 8, 2015, 1:26:46 PM3/8/15
to datarecovery...@googlegroups.com
Hello Courtney,
I usually use the DRE to do my configurations.  This way I can select the files I need first and from there you can configure the imaging algorithm. After I get the key files, I go after the rest of them (except windows and other non-data files).  If you were looking for something else, please let me know.
Frank

Alandata Recovery

unread,
Mar 8, 2015, 1:47:57 PM3/8/15
to datarecoveryce.

Are you trying to write some programs to manipulate the ddi maps?
They are documented in some posts. And they aren't hard to figure out.
The maps are
LBA = what's been copied
Head map
Select map
There is the log
At EOD is the Deepspar signature that points to the config area and all the maps.
Do you want to write some programs?

--
You received this message because you are subscribed to the Google Groups "DataRecoveryCertification" group.
To unsubscribe from this group and stop receiving emails from it, send an email to datarecoverycertif...@googlegroups.com.
To post to this group, send email to datarecovery...@googlegroups.com.
Visit this group at http://groups.google.com/group/datarecoverycertification.
For more options, visit https://groups.google.com/d/optout.

Courtney Webb

unread,
Mar 17, 2015, 1:44:21 AM3/17/15
to datarecovery...@googlegroups.com
Thanks for those posts.

Yes I am looking into how to convert the imaging maps between hardware tools. I often have a need to get the most data possible (as opposed to a time/cost scenario), and not surprisingly have had different results with different tools. It would be great if the second tool could just focus on the areas not already read.


Reply all
Reply to author
Forward
0 new messages