Barny's Journal: Mounting a DD imaged drive

Seems like basic stuff, but just getting into the more nitty gritty data recovery work and this has been an invaluable guide.

> Another hack you can try is use to use '--offset' option of
> 'losetup'. First figure out from which byte, NTFS partition starts in
> disk image, and then you create a loopback back device for that image
> and the starting offset using 'losetup' and finally 'mount' the
> loopback as NTFS partition :) .

Here's more detail on how to do that

# losetup /dev/loop0 /path/to/diskimage
# fdisk -l /dev/loop0
(example)
Disk /dev/sdb: 160.0 GB, 160041885696 bytes
255 heads, 63 sectors/track, 19457 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

      Device Boot Start End Blocks Id System /dev/sdb1 * 1 1044 8385898+ c W95 FAT32 (LBA) /dev/sdb2 1045 19457 147902422+ 83 Linux

suppose you want to mount the partition on sdb2, the offset for that
would be 8225280 * 1045 = 8595417600.

detach the disk image
# losetup -d /dev/loop0
and setup the loop for the partiion
# losetup -o8595417600 /dev/loop0 /path/to/diskimage
and mount it
# mount -t fstype /dev/loop0 /path/to/mountdir

> Please do post your results, if you're successful :)

I second that, I'm curious to know if it works

oh, and make a backup just in case :)
--

Re: "loopback mount" hard-drive image created with dd?

by Remy Blank-2 :: Rate this Message:

| View Threaded | Show Only this Message
Yahya Mohammad wrote:

> # losetup /dev/loop0 /path/to/diskimage
> # fdisk -l /dev/loop0
> (example)
> Disk /dev/sdb: 160.0 GB, 160041885696 bytes
> 255 heads, 63 sectors/track, 19457 cylinders
> Units = cylinders of 16065 * 512 = 8225280 bytes
>
> Device Boot Start End Blocks Id System
> /dev/sdb1 * 1 1044 8385898+ c W95 FAT32 (LBA)
> /dev/sdb2 1045 19457 147902422+ 83 Linux
Thanks for the tip! I didn't know you could mount a whole disk image as
loopback, and see the partition table with fdisk. I always printed the
partition table before making the disk image.

> I second that, I'm curious to know if it works

It does, I have done it before, but there's a special case for the first
partition of the disk. According to your output of fdisk, it is supposed
to start at cylinder 1. However, if you run fdisk with the -u option
(giving the positions and sizes in sectors), you get the following:

(example)
# fdisk -lu /dev/loop0

Disk /dev/loop0: 10.0 GB, 10056130560 bytes
240 heads, 63 sectors/track, 1299 cylinders, total 19640880 sectors
Units = sectors of 1 * 512 = 512 bytes
Disk identifier: 0xc1afc1af

              Device Boot Start End Blocks Id System /dev/loop0p1 * 63 4097519 2048728+ b W95 FAT32 /dev/loop0p2 4097520 8195039 2048760 5 Extended /dev/loop0p5 4097583 8195039 2048728+ b W95 FAT32

That is, the first partition starts at sector 63, i.e. at an offset
value of 63 * 512 = 32256.

> oh, and make a backup just in case :)

And mount the filesystem read-only with the "ro" mount option.

-- Remy

signature.asc (194 bytes) Download Attachment

Re: Re: "loopback mount" hard-drive image created with dd?

by Tom FÃrster :: Rate this Message:

| View Threaded | Show Only this Message
Remy Blank wrote:

> Yahya Mohammad wrote:
>> # losetup /dev/loop0 /path/to/diskimage
>> # fdisk -l /dev/loop0
>> (example)
>> Disk /dev/sdb: 160.0 GB, 160041885696 bytes
>> 255 heads, 63 sectors/track, 19457 cylinders
>> Units = cylinders of 16065 * 512 = 8225280 bytes
>>
>> Device Boot Start End Blocks Id System
>> /dev/sdb1 * 1 1044 8385898+ c W95 FAT32 (LBA)
>> /dev/sdb2 1045 19457 147902422+ 83 Linux
>
> Thanks for the tip! I didn't know you could mount a whole disk image as
> loopback, and see the partition table with fdisk. I always printed the
> partition table before making the disk image.
>
>> I second that, I'm curious to know if it works
>
> It does, I have done it before, but there's a special case for the first
> partition of the disk. According to your output of fdisk, it is supposed
> to start at cylinder 1. However, if you run fdisk with the -u option
> (giving the positions and sizes in sectors), you get the following:
>
> (example)
> # fdisk -lu /dev/loop0
>
> Disk /dev/loop0: 10.0 GB, 10056130560 bytes
> 240 heads, 63 sectors/track, 1299 cylinders, total 19640880 sectors
> Units = sectors of 1 * 512 = 512 bytes
> Disk identifier: 0xc1afc1af
>
> Device Boot Start End Blocks Id System
> /dev/loop0p1 * 63 4097519 2048728+ b W95 FAT32
> /dev/loop0p2 4097520 8195039 2048760 5 Extended
> /dev/loop0p5 4097583 8195039 2048728+ b W95 FAT32
>
> That is, the first partition starts at sector 63, i.e. at an offset
> value of 63 * 512 = 32256.
>
>> oh, and make a backup just in case :)
>
> And mount the filesystem read-only with the "ro" mount option.
>
> -- Remy
>

Some time ago, I wrote a little script to automate that process, maybe
it will help you also. (And yes, I know that the code isn't that pretty)

Direct copy & paste:

#!/bin/bash
INFILE="$1"
PARTITION="$2"
MOUNTPOINT="$3"
OPT="$4"

if [ "$INFILE" = "" ] ; then echo "Usage: $0 infile partition mountpoint
" ; exit ; fi
if [ "$PARTITION" = "" ] ; then echo "Usage: $0 infile partition
mountpoint " ; exit ; fi
if [ "$MOUNTPOINT" = "" ] ; then echo "Usage: $0 infile partition
mountpoint " ; exit ; fi

if [ "$OPT" != "" ] ; then OPT2=",${OPT}" ; fi

PSTARTB=`sfdisk -d "$INFILE" | grep "start=" | head -n"$PARTITION" |
tail -n1 | sed 's/.*start=[ ]*//' | sed 's/,.*//'`
PSTART=$[ $PSTARTB * 512 ]
#PSIZEB=`sfdisk -d "$INFILE" | grep "size=" | head -n4 | tail -n1 | sed
's/.*size=[ ]*//' | sed 's/,.*//'`
#PSIZE=`echo "$PSIZEB * 512" | bc`
mount "$INFILE" "$MOUNTPOINT" -o loop,offset="$PSTART""$OPT2"
#,sizelimit="$PSIZE""$OPT2"

- Tom
--

Reproduced from "old nabble" a gentoo user group support page