@jhup
To be picky #5 and #6 only apply to "standard" MBR code, a "special" MBR may well behave differently, as an example like the grub4dos MBR does, i.e. execute the grub4dos loader in sectors 2-18.
@randomaccess
Once there is a "dd-like" or RAW image, you need to find a virtual disk software capable of mounting the "whole" disk (as an example IMDISK or the derived OSforensics OFSmount won't probably be of use as they mount only the volume).
You may want to try VMDK (which is not however "as low or possible"):
https://sites.google.com/site/chitchatvmback/vdk
in which case you might also need to make a .pln or .vmdk descriptor file with the appropriate geometry:
http://www.forensicfocus.com/Forums/viewtopic/p=6518434/#6518434
http://sanbarrow.com/vmdk/disktypes.html
or either among the MS VSS driver:
http://reboot.pro/topic/6492-virtual-storage-driver/
or Total Mounter:
http://www.kernsafe.com/product/totalmounter.aspx
these two latter ones integrate on a windows NT system at the lowest level possible and allow accessing the whole disk.
Total mounter is also Windows 7 compatible and both 32/64 bit version.
jaclaz
↧