Sign in to follow this  
Followers 0
thepcdude

Make an image of a storage device

7 posts in this topic

Hello again. I have a question, two parts. I'm not even sure how I'm going to do this... I basically want to compare the contents of a device before and after a change on it occurs. I basically want to find where this change occurs, what file, etc. Specifically, it's an iTouch. So, Linux detects it as a storage device, etc. Although, through the USB cable, you cannot peer into it's files. You have to ssh into it. I have access to it right now, and basically, how would I go about this if I only have ssh access to it O_o I need to know what file is changed when I make a change on the ipod. Thanks in advance.

0

Share this post


Link to post
Share on other sites

Well, if you have "ssh access" to it, it means you can input commands, so the statement "you can't peer into its files" doesn't make any sense in that context. You say you want to know which file is changed, but you don't mention what kind of change you're making on the iPod, so it's impossible to answer your question.

0

Share this post


Link to post
Share on other sites
Although, through the USB cable, you cannot peer into it's files. You have to ssh into it.

Enough said.

And second, it doesn't matter what file, because the thing is I don't know the file that is being changed. So I was hoping theres some command to maybe make a .bin file of the whole ipod, and then make another after the change to compare O_o

0

Share this post


Link to post
Share on other sites

Something like this. He uses netcat and some other stuff to completely dump the user partition of the iPhone to his comp and uses a file carver to grab out all the files. This is what I'm aiming for. I basically am curious about what commands are used in this.

0

Share this post


Link to post
Share on other sites

The iPhone and the iPod are two completely different devices, so there's no use in showing me someone dumping the memory contents of the former one's partition.

You might try this:

http://people.csail.mit.edu/adonovan/hacks/ipod.html

And just use dd to copy the contents of mounted partition into one file, but I don't promise that it will work.

0

Share this post


Link to post
Share on other sites
The iPhone and the iPod are two completely different devices, so there's no use in showing me someone dumping the memory contents of the former one's partition.

You might try this:

http://people.csail.mit.edu/adonovan/hacks/ipod.html

And just use dd to copy the contents of mounted partition into one file, but I don't promise that it will work.

Sorry, should've been more descriptive, its an iPod Touch, they basically run the same OS and are extremely alike... and thanks for the link, It might be useful.

0

Share this post


Link to post
Share on other sites

I don't have an iPod, but if you can ssh into it, you should be able to 'dd' the drive and create an image. Maybe pipe it through telnet or netcat with a listening port on your local machine that pipes it into a file...

0

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now
Sign in to follow this  
Followers 0