linuxbashshellmountdiskimage

Shell Script Disk Image Analysis

I’m a beginner programmer and I'm try to learn how to successfully mount a disk image and analyse it but can't fine any guides online or any mention on web pages. I’ve set myself the task as I’m thinking of joining a computer forensics course next year and believe these skills will give me a head start.

This is the code I've made so far but I've become stuck. I want the script to be able to extract command history data for all users, and also log successful and unsuccessful login attempts from log files such as /var/log/wtmp.

I’m not exactly looking for someone to complete the code (as that would be counterproductive) but to point me towards hints and tips, guides and tutorials to get over these early stage of programming.

#!/bin/bash
mount="/myfilesystem"

if grep -qs "$mount" /proc/mounts; then
  echo "It's mounted."
else
  echo "It's not mounted."
  mount "$mount"
  if [ $? -eq 0 ]; then
   echo "Mount success!"
  else
   echo "Something went wrong with the mount..."
  fi
fi


sudo fdisk -l | grep/bin /sbin
Solution

  • For mounting a filesystem, you need two arguments at least.

    1. The image file or block device to be mounted and
    2. The place where to mount it in your filesystem

    So, if you want to mount some external USB drive, that e.g. shows as /dev/sda and has a single partition (sda1), you need to do the following:

    1. Find or create a directory to mount your device (easiest as root), say you created a directory /root/mountpoint
    2. Execute the mount command: mount /dev/sda1 /root/mountpoint

    You then can step into the mounted filesystem cd /root/mountpoint and look around.

    Just as a sidenote: For forensics, you should always draw an image from the device (e.g. dd if=/dev/sda1 of=/root/disk.img) to avoid destroying any evidence and then mount it through the loop driver (losetup /dev/loop1 /root/disk.img; mount /dev/loop1 /root/mountpoint).

    Hope this gives you a hint to start over...