2
I need to examine and extract files from various storage devices and always run them through a quarantine station. But sometimes all I need to do is copy and store the contents in a raw image format, such as .DD or .eo1
I know I can detect viruses if I access the logical file system from the HDD. But if I wanted to forgo this step and just keep the raw image, would an antiviral program detect viruses in the raw image? Thanks.
1I suspect not ... – DavidPostill – 2017-04-18T22:35:09.403
If you can mount the image as a virtual drive, you should be able to scan it, but not directly as an image itself. – acejavelin – 2017-04-18T22:41:57.783
Don't virus scanners search for "magic bits" of viruses? But only in certain files & places? If the image isn't compressed and you searched the entire fs image you could probably find them, but that would search all the free space and data files too, taking much much longer than mounting the images & searching "properly" – Xen2050 – 2017-04-18T22:53:52.447
Even if Xen2050's idea works and it discovered a virus snippet, all it could do would be to quarantine the entire image. You would then need to unquarantine and mount it, and process it again to find the actual infected file. – fixer1234 – 2017-04-19T04:29:03.637
Huh, I think it's not possible or at least very hard to AVs to detect and isolate the virus on RAW. Aggre with fixer1234 it will quarantine the entire image. – Strepsils – 2017-04-28T13:06:09.533