Session 07 - Splitting Images

Requirements are found here

Sometimes, and for various reasons, you might need to split big image files into smaller chunks. For example, if you're requested to supply the image file on multiple Blu-ray discs, or whatever. It happens. So, here's how to do that, albeit with a much smaller file.

As with the log files earlier, transfer the practical.floppy.dd to your machine, then create an appropriate directory:

$ mkdir -p ~/analysis/splitters

Move the file practical.floppy.dd to that directory. If you don't know how to move a file, go back through the labs, or look it up.

Hint: mv

Now split the file into 360k chunks:

$ split -b 360k practical.floppy.dd image.split.

We could use split -d -b 360k practical.floppy.dd image.split. if a newer version of split is installed. -d gives decimal numbering.

Let's have a look at what split produced:

$ ls -l image.split.a*

Now, let's fuse them back together using the concatenate command, cat:

$ cat image.split.aa image.split.ab image.split.ac image.split.ad > image1.new

Bit annoying, so how about we try it like this:

$ cat image.split.* > image2.new

Double-check we have two extra image*.new files:

$ ls -l

Now, let's have Linux figure out if the fingerprints still match for the original file and the two newly fused files; technically there should be no difference, but we will only be able to tell after generating hash sums:

$ sha1sum image1.new image2.new practical.floppy.dd

And? If they are different, then you need to go back and double-check where you went wrong.

Let's do the same, but with dd

This could be used on a real block device (i.e., hard disk, CD, etc.).

$ dd if=practical.floppy.dd | split -b 360k - floppy.split.

Double-check we have our split files:

$ ls -l

Now check that split files would generate the same hashes if we were to concatenate them in memory:

$ cat floppy.split.a* | sha1sum

Looking good? Let's create a complete image out of the split files then:

$ cat floppy.split.a* > new.floppy.image

Double-check:

$ ls -lh

And, once again, verify the hash:

$ sha1sum new.floppy.image

In fact, let's check all splits and assembled files:

$ sha1sum *