In fact this version is not scriptable.

One you try to win32dd.exe like
> path/win32dd.exe /f pouet.bin
you will get this error every time.

You have to run it from the current directory everytime
> win32dd.exe /f pouet.bin

Error: InstallDriver Cannot start service (Err=0×00000002).
-> Error: Cannot open \\.\win32dd.

I’ve seen it on 32 bit installs of XP SP2 (2 gigs RAM) and SP3 (8 gigs, 32bit system == 4 available). I seem to run into it after killing or interrupting the imaging process. Haven’t found a way to fix / repair it yet.

Error: InstallDriver Cannot start service (Err=0×00000002).
-> Error: Cannot open \\.\win32dd.

Error: InstallDriver cannot start service (Err=0×00000002)
Error: Cannot open \\.\win32dd

I tested it with win32dd of USB-Dongle, CD and HDD. Is the same error!

The System:
Win32 XP Professional SP3 (German)
Athlon AMD64-Dual Core 2100+
4 GB DDR II RAM
No writeblocker

thanks for the quick reply. Thank you also for updating the help. It looks much more pretty now.
Yes people can use piping, I like it too. But there are many investigators with some kind of fear or phobia of command lines especially of piping. So an option /l, automatically creating a log with the same name as the Dumpfile.log could help a little to get over that fear to force them to use such tools. That’s not vital for me but for some of my class members…
The hash computing on the receiving site (piped into a file ;-)) would document the correct network transmission of the dump in one go. Otherwise I have to use md5sum or something else after the acquisition.
You know criminal procedures are procedures in writing…

CU

Michael

Thank you very much for your feedback!
I was not really sure about report-option-feature but it looks like people really appreciate the detailed output of windd about the memory status. I was like “Oh people can still pipe the output so it doesnt really matter” so I added the “/a” option in case people would use piping.

Why would you see a such feature? What would be the difference with the piped report?

Indeed, for the hash function it is only computed from sender side because this is the most critical part. I assumed the received can still use a third party software like hashdeep from Jesse Kornblum (http://jessekornblum.com/tools/)

I updated the help output for “/c”, “/s” and “/a” options.

Thanks!

I did some testing and really like this new version very much. The inbuilt network capabilities are splendid.

What I miss is an option to write a log. Currently I use a pipe to create one. The hash functionality is vital for forensic purposes. Sadly the option /s is accepted by both the sender and receiver side of the network connection but only the sender computes a hash. Could you add such procedure for the receiving side too to document that the data was transmitted unchanged anyway.

TNX in advance

Michael

great stuff! The only minor thing I’ve found is a truncated description of the /d – option within the help. Seems to work anyway. ;-)

Cu

Michael

win32dd.exe /d /f microsoftdump.dmp
for a modern Microsoft dump, to analyze with Windbg.

or

win32dd.exe /f rawdump.bin
for a raw dump.