Member Avatar for tony75

Hi
I wonder if there is any tools for linux that convert .bin dump to .dd or .img dump file?

..

Edited by tony75
  • 3 Contributors
  • 9 Replies
  • 7K Views
  • 2 Days Discussion Span
  • Latest Post Latest Post by Gribouillis

Dani AI

Generated

If the .bin is a phone dump (not a CD image), tools that target ISO/CD formats will fail, as you saw with the "This image is not CD IMAGE" error. For most forensics tools, .dd and .img simply mean a raw, byte-for-byte disk image. The key is to verify whether your .bin is already raw.

  • Identify the format first:

    file dump.bin
binwalk dump.bin

    If file reports a partition table or filesystem (e.g., MBR/GPT, ext4, f2fs), it is likely raw already. In that case, "conversion" is just a byte-for-byte copy or rename:

    cp --sparse=always --reflink=auto dump.bin dump.dd

  • Validate by mounting read-only with a loop device:

    sudo losetup --find --show -r dump.bin
# note the /dev/loopX it prints
sudo kpartx -av /dev/loopX
sudo mount -o ro /dev/mapper/loopXp1 /mnt

    If it mounts, your tool should accept the same bytes as .dd/.img.

  • If it is a container with embedded partitions, find offsets and carve:

    mmls dump.bin        # from The Sleuth Kit
# suppose partition starts at sector S (512-byte sectors):
dd if=dump.bin of=part1.img bs=512 skip=S count=... status=progress

For evidence handling, work on a copy, use read-only mounts, and hash before/after:

sha256sum dump.bin dump.dd

Useful references: The Sleuth Kit, binwalk, .

Recommended Answers

All 9 Replies

Member Avatar for Gribouillis

I never tried this, but the iat tool is a converter to iso9660 (see here for example), then here is a discussion about iso and img...

Member Avatar for tony75

Thanks but I think its Converting from .bin to .iso!

Member Avatar for mike_2000_17

iso and img are the same thing. They are two possible extensions for the same file format.

Member Avatar for tony75

Thanks Sir
Bu it seems the software that I uset for invistigation not accept .iso extention just .img extention.

Edited by tony75
Member Avatar for Gribouillis

Use

iat my_image.bin > my_new_image.img
Member Avatar for tony75

Thanks Gribouillis

I got this error when I ran the commands
Detect Signature RAW 2 at 103699115
Detect Signature RAW 2 at 105979979
Detect Signature RAW 2 at 105980075
Detect Signature RAW at 132579131
Detect Signature RAW at 132710075
Image is broken
This image is not CD IMAGE

my .bin file its the dump of mobile phone

Edited by tony75
Member Avatar for Gribouillis

Well, as I told you, I never used these tools. The iat man page says

iat - converts many CD-ROM image formats to iso9660.

but your mobile phone is not a CD-ROM, which could explain the error message

This image is not CD IMAGE

There is another tool named bchunk which you could give a try.

Member Avatar for mike_2000_17

I've recently did a conversion from bin/cue to iso with bchunk and it worked just fine:

$ bchunk IMAGE.bin IMAGE.cue IMAGE.iso

I'm not sure if you can omit the .cue file (can the .bin work alone?), but if you have it, then this certainly works.

But it seems the software that I use for investigation does not accept .iso extention just .img extention.

If your software just doesn't accept the iso extension, you just have to change your iso file's extension to .img. Like I said, the format is the same, it's just a different extension. Simply renaming the file with the correct extension should work:

$ mv IMAGE.iso IMAGE.img
Member Avatar for Gribouillis

There is a (old) page in french here where they explain how to omit the .cue file by writing a small script (which they name biniso).

Edited by Gribouillis
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.