I need to overwrite certain files in a raw disk image without modifying the disk image too much. Ideally, only certain strings should be overwritten, but this will probably not be possible. That is why I am now trying to overwrite the whole block.
Thanks to Sleuthkit I was able to find the inode and the direct blocks of the file. I also know the offset of the volume that contains the partition system in sectors. Is there a way to overwrite all/one blocks with dd? I think it should be quite easy if i could calculate the block offset?
Thank you very much
Asked by unrealwombat
(11 rep)
Apr 7, 2022, 04:20 PM