Search the Community

In my never-ending quest to help people recover data from failing hard drives I am constantly trying new things. My most recent way of handling the REALLY ugly situations has been to create a forensic image of the failing drive with WinHex, and when the drives are REALLY bad I hook them up with a USB bridge that seems to have its own timeout for bad sectors and again turn to WinHex. The only bummer is that I am a big fan of BinaryBiz VirtualLab but that can not open the RAW images created by WinHex. R-Studio does fine, and is OK, but I just prefer VirtualLab.... So I got to thinking and started investigating software to mount the RAW images and almost got locked in to another for-pay piece of software to do it when I came across the fact that Windows 7 can mount it using DiskPart. A few experiments later I have what I bring you now - a very quick, and FREE, way to mount those images using native a Windows utility. ;~ Convert a RAW hard drive image to a VHD image, then mount it via DiskPart for data recovery. Readonly is used to ensure that no corruption of the image is allowed to happen. ;~ Coded by Ian Maxwell (llewxam @ www.autoitscript/forum) ;~ Autoit 3.3.6.1 ;~ You must have VhdTool.exe in the script dir to run/compile, please download it at http://archive.msdn.microsoft.com/vhdtool ;~ ensure minimum OS build, this feature is not available on OSs older than Windows 7 #RequireAdmin If @OSBuild < 7600 Then MsgBox(16, "ERROR", "You must have at least Windows 7 to support loading VHD images via DiskPart.") Exit Else FileInstall("VhdTool.exe", @TempDir & "\VhdTool.exe", 1) EndIf $RawImage = FileOpenDialog("Select the original RAW hard drive image", @DesktopDir, "All (*.*)") $YesOrNo = MsgBox(4 + 32, "Convert?", "Do you need to convert this image to a VHD?" & @CR & "(This only needs to be done once)") If $YesOrNo == 6 Then ShellExecuteWait(@TempDir & "\VhdTool.exe", "/convert " & $RawImage & " /quiet") EndIf ;~ build the list of functions for DiskPart to use for mounting the image and setting the readonly flag FileDelete(@TempDir & "\mount.txt") $Mount = FileOpen(@TempDir & "\mount.txt", 1) FileWriteLine($Mount, "sel vdisk file='" & $RawImage & "'") FileWriteLine($Mount, "attach vdisk") FileWriteLine($Mount, "attributes disk set readonly") FileClose($Mount) ShellExecuteWait("diskpart.exe", "/s " & @TempDir & "\mount.txt") ;~ build the list of functions for DiskPart to use for unmounting the image FileDelete(@TempDir & "\unmount.txt") $Unmount = FileOpen(@TempDir & "\unmount.txt", 1) FileWriteLine($Unmount, "sel vdisk file='" & $RawImage & "'") FileWriteLine($Unmount, "detach vdisk") FileClose($Unmount) ;~ place a shortcut on the desktop for the unmounting of the image FileDelete(@DesktopDir & "\Unmount Virtual Disk.bat") $Batch = FileOpen(@DesktopDir & "\Unmount Virtual Disk.bat", 1) FileWriteLine($Batch, "diskpart /s " & @TempDir & "\unmount.txt") FileClose($Batch) MsgBox(0, "Done", "Your image has been mounted. To unmount the image use the Unmount Virtual Disk.bat file placed on your desktop.") I have not added any error checking, as it has simply not failed yet. OK, horrible reason I am the first to admit, but if there is enough interest in this then I will pursue it by catching the StdOut. For now, consider this a taste of things on my mind...... Enjoy Ian