Dissect support for disks without partition table.

[matrimc-dev]

Hello!

Hope you are doing well.
I'm using dissect to traverse disks in customer environment and I currently encountered an issue with a certain disk type. Specifically, when handling a disk without partition table. Linux systems are allowing this scenario, i.e. instead of creating partition table with single partition on disk, there is a way to format a new partition on the disk directly (example of command: sudo mkfs -t ext4 /dev/sdb).

When encountering this situation, my code fails when trying to perform volume.open(disk) with the following exception:

('Unable to detect a valid partition scheme:

• Invalid MBR boot signature. Expected 0xaa55, got 0x0.
• Invalid MBR boot signature. Expected 0xaa55, got 0x0.
• Invalid APM signature, expected 'PM', got b'\x00\x00'.
• Invalid BSD disklabel magic, expected 0x82564557 or 0xc4464c59, got 0x0.',)

which totally makes sense since there is no valid partition scheme, the disk only has one partition without any table.

The question is - is this scenario supported in Dissect? Are there any plans to support it later if it isn't?

Thank you and have a great day!
Igor Grossman

[Schamper]

Hi Igor,

Thank you for your message, are you able to share your code?

The dissect.target project handles these complex scenarios and more, such as encrypted volumes, volume based RAID (or another form of LVM) and multivolume filesystems: https://github.com/fox-it/dissect.target/blob/9d13f89f5cbd9459ef2d615445acc333ed3eedfc/dissect/target/target.py#L752-L875

These scenarios are automatically handled if you use the Target object, for example by using Target.open(path_to_file), or Target.open_all(path_to_file) to handle more complex targets, including possible nested virtual machines.

Hope that answers your question!

[matrimc-dev]

It's extfs without partitions (i.e. disk is the only partition) which you helped me to connect to. The full stack trace is:

File "/Users/igrossman/PolyrizeNew/.venv/lib/python3.12/site-packages/IPython/core/interactiveshell.py", line 3579, in run_code
exec(code_obj, self.user_global_ns, self.user_ns)
File "", line 1, in
child_entries = sorted(self._file_system.scandir(path=dir_to_traverse), key=lambda entry: entry.name)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/Users/igrossman/PolyrizeNew/.venv/lib/python3.12/site-packages/dissect/target/filesystem.py", line 1638, in scandir
for entry in super().scandir():
^^^^^^^^^^^^^^^^^
File "/Users/igrossman/PolyrizeNew/.venv/lib/python3.12/site-packages/dissect/target/filesystem.py", line 1553, in scandir
for entry in fsentry.scandir():
^^^^^^^^^^^^^^^^^
File "/Users/igrossman/PolyrizeNew/.venv/lib/python3.12/site-packages/dissect/target/filesystems/extfs.py", line 77, in scandir
for fname, f in self.entry.listdir().items():
^^^^^^^^^^^^^^^^^^^^
File "/Users/igrossman/PolyrizeNew/.venv/lib/python3.12/site-packages/dissect/extfs/extfs.py", line 341, in listdir
self._dirlist = {node.filename: node for node in self.iterdir()}
^^^^^^^^^^^^^^
File "/Users/igrossman/PolyrizeNew/.venv/lib/python3.12/site-packages/dissect/extfs/extfs.py", line 350, in iterdir
buf = self.open()
^^^^^^^^^^^
File "/Users/igrossman/PolyrizeNew/.venv/lib/python3.12/site-packages/dissect/extfs/extfs.py", line 449, in open
if self.inode.i_flags & c_ext.EXT4_INLINE_DATA_FL or (self.filetype == stat.S_IFLNK and self.size < 60):
^^^^^^^^^^
File "/Users/igrossman/PolyrizeNew/.venv/lib/python3.12/site-packages/dissect/extfs/extfs.py", line 225, in inode
self._inode = self._read_inode()
^^^^^^^^^^^^^^^^^^
File "/Users/igrossman/PolyrizeNew/.venv/lib/python3.12/site-packages/dissect/extfs/extfs.py", line 220, in _read_inode
return c_ext.ext4_inode(self.extfs.fh)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/Users/igrossman/PolyrizeNew/.venv/lib/python3.12/site-packages/dissect/cstruct/types/structure.py", line 82, in call
return super().call(*args, **kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/Users/igrossman/PolyrizeNew/.venv/lib/python3.12/site-packages/dissect/cstruct/types/base.py", line 40, in call
return cls._read(stream)
^^^^^^^^^^^^^^^^^
File "", line 7, in _read
EOFError

The way I connect to it is as you've suggested (and it works for root folder but not subdirectories):
t = Target()
t.disks.add(RawContainer(disk))
t.apply()
and then I use t.fs as filesystem and run scandir() on it.

[matrimc-dev]

@Schamper Hello Eric,

Hope you are doing well.

Just wanted to ask if I can provide any additional information that can help to find the issue.

Thank you and have a great day!
Igor

[Schamper]

Hi @matrimc-dev, unfortunately it's a bit difficult to debug without having a reproducible file.

• Have you tried running it on the same file but directly on your disk, instead of through the HTTP connection?
• Is it possible to reproduce or create a reproducible file?

[matrimc-dev]

Hello @Schamper ,

Hope you are doing well!

We've created the reproducible file, but it's too large to attach here (857MB). How can I pass it to you?
Thank you and have a great day,
Igor

[Schamper]

Are you able to upload it somewhere and email it to us? You can email a link to dissect@fox-it.com.

Otherwise you can maybe create a temporary repository and upload it as an LFS file 😄.