Projects / mbrChunker


mbrChunker is a utility that allows you to mount raw disk images (created by dd, dcfldd, dc3dd, ftk imager, etc.) and create VMDK files. It does this by taking the raw image, analyzing the master boot record (physical sector 0), and getting specific information that is need to create a working VMDK file that points to your raw image. It can also extract information such as heads, cylinders, and sectors per track. With version 0.3.15, the tool now has the ability to search for hex byte offsets within any binary file. It will give you the byte location for every hex pattern found. More information about this can be found in the README.

Operating Systems

Recent releases

  •  30 Jul 2010 01:07

    Release Notes: The hex byte searching functionality was flawed and had to be rewritten. Additionally, it could not handle files larger than 2-3gb in size but now can handle files of any size given the new redesign. A -b flag was added to let the user customize how big the buffer will be when searching for your hex string. All three functions, dd2vmdk, MBR analysis, and hex byte string searching, work fine under any Linux OS.

    •  19 Jul 2010 01:03

      Release Notes: A new feature has been added that allows the end-user to search for hex byte patterns within your forensics images (or any binary file). It allows for you to enter any number of bytes for your hex pattern. It returns via stdout all locations within your binary file where that byte hex pattern was found and its corresponding byte offset location. Specifically, the idea is to incorporate this functionality against large dd imaged VMFS partitions that would grab all master boot record sectors and analyze them for the user.

      •  07 Jul 2010 22:32

        Release Notes: When doing the analysis of the partitions, it now writes to the output file that was given to it on the command line. In version 0.2, this was not the case. For example, when you run the command ./mbrChunker -i -a , the data is now saved to that output file.

        •  07 Jul 2010 00:12

          Release Notes: mbrChunker can now parse each of the primary partition entries, analyze each of the 16 byte entries for information such as boot indicator, starting head, starting sector, starting cylinder, system ID, ending head, ending sector, ending cylinder, and total sectors. It also validates the partition types of each of the partition entries. As of now, the tool can convert DD images into a flat VMDK file and analyze each of the partition entries found within the master boot record (physical sector 0) of a hard drive.

          Recent comments

          20 Jul 2010 01:57 labgeek

          Bug exists with files larger than 4GB in size, needs small redesign to fread() data in in smaller chunks (say 512 byte chucks - 1 sector), process the buffer, then keep reading/processing in data until eof.

          19 Jul 2010 16:59 labgeek

          When using the hex pattern search feature, 0.3.15 has a limitation of 512 bytes when examining that binary file or image. I will modify that and upload a patch tonight.


          Project Spotlight


          A Fluent OpenStack client API for Java.


          Project Spotlight

          TurnKey TWiki Appliance

          A TWiki appliance that is easy to use and lightweight.