libyal / libbfoverlay Goto Github PK

Using vshadowmount fails on an image mounted with ewfmount+bdemount with "libvshadow_ntfs_volume_header_read_file_io_handle: unable to read NTFS volume header data at offset: 254862852096 (0x3b57028000)"
The bde1 reports a size of 254862852096 byte (using ls -l "/mnt/1921/001/bde/bde1")

I constructed the following 3 line bfoverlaymount descriptor file named "1921_001_overlay" and placed next to the bfoverlaymount binary:

layer: offset=0 size=254862856192
layer: offset=0 size=254862852096 file="/mnt/1921/001/bde/bde1" file_offset=0
layer: offset=254862855680 size=512 file="/mnt/1921/001/bde/bde1" file_offset=0

This fails as follows:

# ./bfoverlaymount -v 1921_001_overlay /mnt/1921/001/overlay/
bfoverlaymount 20210717

Unable to open source descriptor file
libbfoverlay_descriptor_file_read: unsupported basic file overlay descriptor file signature.
libbfoverlay_descriptor_file_read_file_io_handle: unable to read descriptor file.
libbfoverlay_internal_handle_open_read: unable to read descriptor file.
libbfoverlay_handle_open_file_io_handle: unable to read from file IO handle.
libbfoverlay_handle_open: unable to open handle: 1921_001_overlay.
mount_handle_open: unable to open handle.

Please point me to a description of the needed file signature?
Thank you for your numerous open source IT forensics tools.

• add support for 0-byte filled virtual file
• add support to expose data in file from a specific offset e.g. to expose a single volume within partitioned image
• add support to fix corrupted/truncated live images of an NTFS volume
• add support to overlay recovered data on top of data in file, e.g. to implement libyal/libvshadow#18
• add write support, e.g. to replace EWF delta files libyal/libewf#36