RAW copy of disk

Index > Windows > RAW copy of disk

Author

Thread

N-LG

Joined: 14 Feb 2019
Posts: 40
Location: france

N-LG 11 Nov 2019, 16:25

hello,
i have to make a raw image of a disk on Windows and to copy this image to an other disk (like DD command in linux)

how can i do that?

11 Nov 2019, 16:25

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20335
Location: In your JS exploiting you and your system

revolution 11 Nov 2019, 17:13

You can call CreateFile with the name "\\.\PhysicalDriveX" where X is the drive number, 0=first, 1=second, ...

Then you call ReadFile/WriteFile to transfer the data.

Last edited by revolution on 11 Nov 2019, 18:08; edited 1 time in total

11 Nov 2019, 17:13

Mike Gonta

Joined: 26 Dec 2010
Posts: 243

Mike Gonta 11 Nov 2019, 18:02

N-LG wrote:

i have to make a raw image of a disk on Windows and to copy this image to an other disk (like DD command in linux)
how can i do that?

Like dd command in Windows.

_________________
Mike Gonta
look and see - many look but few see

https://mikegonta.com

11 Nov 2019, 18:02

N-LG

Joined: 14 Feb 2019
Posts: 40
Location: france

N-LG 11 Nov 2019, 18:27

thanks for the dd for Windows, but i want to devellop a software more simply accessible with a small graphic menu

I imagine that the seek function will get that size of the disk, and with an opening of the disk with the function createfile, is it possible to obtain the name / serial number of the disk?

11 Nov 2019, 18:27

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20335
Location: In your JS exploiting you and your system

revolution 11 Nov 2019, 18:45

N-LG wrote:

I imagine that the seek function will get that size of the disk, and with an opening of the disk with the function createfile, is it possible to obtain the name / serial number of the disk?

After you have the handle from CreateFile you can call DeviceIoControl with the parameter IOCTL_DISK_GET_LENGTH_INFO to get the size.

11 Nov 2019, 18:45

N-LG

Joined: 14 Feb 2019
Posts: 40
Location: france

N-LG 11 Nov 2019, 19:51

i found https://msdn.microsoft.com/en-us/windows/apps/aa363979(v=vs.110) with all the possible value of dwIoControlCode in the DeviceIoControl function but i never found the numerical value. where can i found this?

11 Nov 2019, 19:51

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20335
Location: In your JS exploiting you and your system

revolution 11 Nov 2019, 19:58

N-LG wrote:

i found https://msdn.microsoft.com/en-us/windows/apps/aa363979(v=vs.110) with all the possible value of dwIoControlCode in the DeviceIoControl function but i never found the numerical value. where can i found this?

The numerical values are in the C header files.

For the one I mentioned above:
IOCTL_DISK_GET_LENGTH_INFO = 0x0007405c

11 Nov 2019, 19:58

N-LG

Joined: 14 Feb 2019
Posts: 40
Location: france

N-LG 11 Nov 2019, 23:15

correct me if i dont undestand because i never use C

this define the value:

Code:

#define IOCTL_DISK_GET_LENGTH_INFO          CTL_CODE(IOCTL_DISK_BASE, 0x0017, METHOD_BUFFERED, FILE_READ_ACCESS)

this is the calculation for this value

Code:

#define CTL_CODE( DeviceType, Function, Method, Access ) (                 \
    ((DeviceType) << 16) | ((Access) << 14) | ((Function) << 2) | (Method) \
)

and this is the constant to use

Code:

#define IOCTL_DISK_BASE                 FILE_DEVICE_DISK

#define METHOD_BUFFERED                 0

#define FILE_READ_ACCESS          ( 0x0001 )    // file & pipe

#define FILE_DEVICE_DISK                0x00000007

with this calculation i found 7405Ch too but i want to be sure to be able to find the other value by myself

11 Nov 2019, 23:15

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20335
Location: In your JS exploiting you and your system

revolution 12 Nov 2019, 04:00

N-LG wrote:

correct me if i dont undestand ...

Your calculation is correct.

You can also replicate the headers files in assembly and then all the values will defined.

12 Nov 2019, 04:00

typedef

Joined: 25 Jul 2010
Posts: 2909
Location: 0x77760000

typedef 27 Nov 2019, 11:09

N-LG wrote:

hello,
i have to make a raw image of a disk on Windows and to copy this image to an other disk (like DD command in linux)

how can i do that?

How are you going to handle the case were in the middle of copying data from one storage to another, either of the devices were being written to (or read from). You could end up with inconsistent data.

Wouldn't you have to have the disk "offline" first?

27 Nov 2019, 11:09

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20335
Location: In your JS exploiting you and your system

revolution 27 Nov 2019, 11:20

typedef wrote:

N-LG wrote:
hello,
i have to make a raw image of a disk on Windows and to copy this image to an other disk (like DD command in linux)

how can i do that?

How are you going to handle the case were in the middle of copying data from one storage to another, either of the devices were being written to (or read from). You could end up with inconsistent data.

Wouldn't you have to have the disk "offline" first?

Yes, you shouldn't be booting/running from the source disk unless you don't care about consistency.

27 Nov 2019, 11:20

< Last Thread | Next Thread >

Forum Rules:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum