Strange Artifacts – Wubi


I don’t speak French. I learned it at school and don’t use it much but, if it was a pinch, I could probably remember enough to get by. The same goes for using linux. I know a lot of the basic commands and how to set things up so that it is usable, but I’m not about to go recompiling kernel source code (sorry Hal). I’m pretty sure that owning a Mac, and using Macs at work have helped me learn the basics.

Having said that, I recently rekindled my love affair with linux, well, Ubuntu. I was looking for a Windows solution to a specific problem only to find that I would have to spend a good sum of money in attempting to solve the issue. As I was researching a solution I found that linux was equipped to deal with the situation at no cost and a small learning curve. My only issue was that I didn’t want to repartition my hard drive. I kinda have things set up the way I like them.

Enter Wubi (http://www.ubuntu.com/download/ubuntu/windows-installer).

Wubi is short for “Windows Ubuntu Installer”. You download the software inside Windows and run the installer. There is no partitioning, and the installation is quick and painless. Now, when you reboot, you are presented with an option to boot Windows or Ubuntu. This is all handled by the Windows loader, not a single mention of grub anywhere.

Once loaded you are presented with a complete installation of Ubuntu. But where is it installed?

I booted back into Windows and did some digging. In the directory “C:\ubuntu\disks” I found two files. One of which was named “root.disk”. I decided to throw caution to the wind and throw the file into FTK Imager as an image file…

It worked!

Before me I saw the complete Ext3 file system for my Ubuntu installation. Outstanding, but also a little scary. Still a little something to watch for when conducting your next investigation.

There is also something similar for linux called “lubi”. But I’m not sure I could bring myself to use a product with that particular name.


Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.