"loopback mount" hard-drive image created with dd?

[Stroller]

Hi there,

Before installing on a new laptop which came with Vista pre-installed  
I took an image of the hard-drive using dd. (ie: `dd if=/dev/sda of=/
mnt/sdb1/disk.img`, where /mnt/sdb1 was a portable USB hard-drive).

Obviously the intention was that if I b0rked things up I could just  
`dd` the image back onto the laptop and all would work as the  
manufacturer shipped it, but I'd now find it useful to be able to  
take a look inside the image and examine a few files. Is there any  
way to do this, please?

I'm fairly confident that there were originally a couple of  
partitions on the drive, and the one I want to look at will be NTFS,  
of course. I know that a CD iso I can mount using `mount file.iso /
mnt/cdrom -t iso9660 -o loop`, but is there an equivalent for whole  
partition tables?

Thanks in advance for any suggestions or advices,

Stroller.

--
gentoo-user@... mailing list

[Ashish Shukla आशीष शुक्ल]

,--[ On Fri, Jan 18, 2008 at 03:19:49AM +0000, Stroller wrote:

[...]

> I'm fairly confident that there were originally a couple of partitions on
> the drive, and the one I want to look at will be NTFS, of course. I know
> that a CD iso I can mount using `mount file.iso /mnt/cdrom -t iso9660 -o
> loop`, but is there an equivalent for whole partition tables?

How about using your disk image as HD in a VM, and then inspect it from
VM, hmm... Or look out for some tools which allow you to play with hard
disk images, e.g. mtools .

HTH
--
Ashish Shukla आशीष शुक्ल                      http://wahjava.wordpress.com/
·-- ·- ···· ·--- ·- ···- ·- ·--·-· --· -- ·- ·· ·-·· ·-·-·- -·-· --- --

[Stroller]

On 18 Jan 2008, at 09:04, आशीष शुक्ल Ashish Shukla  
wrote:

> ,--[ On Fri, Jan 18, 2008 at 03:19:49AM +0000, Stroller wrote:
> [...]
>
>> I'm fairly confident that there were originally a couple of  
>> partitions on
>> the drive, and the one I want to look at will be NTFS, of course.  
>> I know
>> that a CD iso I can mount using `mount file.iso /mnt/cdrom -t  
>> iso9660 -o
>> loop`, but is there an equivalent for whole partition tables?
>
> How about using your disk image as HD in a VM, and then inspect it  
> from
> VM, hmm...

Would that work? I've never used VMs - are their drive images exactly  
"blocky" as my `dd` command would produce?
(`dd if=/dev/sda of=/mnt/sdb1/disk.img`, where /mnt/sdb1 was a  
portable USB hard-drive).

> Or look out for some tools which allow you to play with hard
> disk images, e.g. mtools .

It looks like mtools is geared towards floppies but will handle a  
hard-drive fine. However the manual <http://mtools.linux.lu/ 
mtools.html> suggests no support for NTFS. (??)

Stroller.--
gentoo-user@... mailing list

[Ashish Shukla आशीष शुक्ल]

>>>>> "Stroller" == Stroller  <stroller@...> writes:

    Stroller> Would that work? I've never used VMs - are their drive images exactly
    Stroller> "blocky" as my `dd` command would produce?
    Stroller> (`dd if=/dev/sda of=/mnt/sdb1/disk.img`, where /mnt/sdb1 was a
    Stroller> portable USB hard-drive).

I installed FreeBSD on my box, this way, when I didn't have CD-ROM
drive on my box :) . I've used QEmu (AMD64), and it worked flawlessly :) .

    Stroller> It looks like mtools is geared towards floppies but will handle a
    Stroller> hard-drive fine. However the manual <http://mtools.linux.lu/
    mtools.html> suggests no support for NTFS. (??)

Another hack you can try is use to use '--offset' option of
'losetup'. First figure out from which byte, NTFS partition starts in
disk image, and then you create a loopback back device for that image
and the starting offset using 'losetup' and finally 'mount' the
loopback as NTFS partition :) .

Please do post your results, if you're successful :)

HTH
--
Ashish Shukla आशीष शुक्ल                      http://wahjava.wordpress.com/
·-- ·- ···· ·--- ·- ···- ·- ·--·-· --· -- ·- ·· ·-·· ·-·-·- -·-· --- --

[Yahya Mohammad-2]

> Another hack you can try is use to use '--offset' option of
> 'losetup'. First figure out from which byte, NTFS partition starts in
> disk image, and then you create a loopback back device for that image
> and the starting offset using 'losetup' and finally 'mount' the
> loopback as NTFS partition :) .

Here's more detail on how to do that

# losetup /dev/loop0 /path/to/diskimage
# fdisk -l /dev/loop0
(example)
Disk /dev/sdb: 160.0 GB, 160041885696 bytes
255 heads, 63 sectors/track, 19457 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

   Device Boot      Start         End      Blocks   Id  System
/dev/sdb1   *           1        1044     8385898+   c  W95 FAT32 (LBA)
/dev/sdb2            1045       19457   147902422+  83  Linux

suppose you want to mount the partition on sdb2, the offset for that
would be 8225280 * 1045 = 8595417600.

detach the disk image
# losetup -d /dev/loop0
and setup the loop for the partiion
# losetup -o8595417600 /dev/loop0 /path/to/diskimage
and mount it
# mount -t fstype /dev/loop0 /path/to/mountdir


> Please do post your results, if you're successful :)

I second that, I'm curious to know if it works

oh, and make a backup just in case :)
--
gentoo-user@... mailing list

[Remy Blank-2]

Yahya Mohammad wrote:

> # losetup /dev/loop0 /path/to/diskimage
> # fdisk -l /dev/loop0
> (example)
> Disk /dev/sdb: 160.0 GB, 160041885696 bytes
> 255 heads, 63 sectors/track, 19457 cylinders
> Units = cylinders of 16065 * 512 = 8225280 bytes
>
>    Device Boot      Start         End      Blocks   Id  System
> /dev/sdb1   *           1        1044     8385898+   c  W95 FAT32 (LBA)
> /dev/sdb2            1045       19457   147902422+  83  Linux

Thanks for the tip! I didn't know you could mount a whole disk image as
loopback, and see the partition table with fdisk. I always printed the
partition table before making the disk image.

> I second that, I'm curious to know if it works

It does, I have done it before, but there's a special case for the first
partition of the disk. According to your output of fdisk, it is supposed
to start at cylinder 1. However, if you run fdisk with the -u option
(giving the positions and sizes in sectors), you get the following:

(example)
# fdisk -lu /dev/loop0

Disk /dev/loop0: 10.0 GB, 10056130560 bytes
240 heads, 63 sectors/track, 1299 cylinders, total 19640880 sectors
Units = sectors of 1 * 512 = 512 bytes
Disk identifier: 0xc1afc1af

       Device Boot      Start         End      Blocks   Id  System
/dev/loop0p1   *          63     4097519     2048728+   b  W95 FAT32
/dev/loop0p2         4097520     8195039     2048760    5  Extended
/dev/loop0p5         4097583     8195039     2048728+   b  W95 FAT32

That is, the first partition starts at sector 63, i.e. at an offset
value of 63 * 512 = 32256.

> oh, and make a backup just in case :)

And mount the filesystem read-only with the "ro" mount option.

-- Remy

[Tom Förster]

Remy Blank wrote:

> Yahya Mohammad wrote:
>> # losetup /dev/loop0 /path/to/diskimage
>> # fdisk -l /dev/loop0
>> (example)
>> Disk /dev/sdb: 160.0 GB, 160041885696 bytes
>> 255 heads, 63 sectors/track, 19457 cylinders
>> Units = cylinders of 16065 * 512 = 8225280 bytes
>>
>>    Device Boot      Start         End      Blocks   Id  System
>> /dev/sdb1   *           1        1044     8385898+   c  W95 FAT32 (LBA)
>> /dev/sdb2            1045       19457   147902422+  83  Linux
>
> Thanks for the tip! I didn't know you could mount a whole disk image as
> loopback, and see the partition table with fdisk. I always printed the
> partition table before making the disk image.
>
>> I second that, I'm curious to know if it works
>
> It does, I have done it before, but there's a special case for the first
> partition of the disk. According to your output of fdisk, it is supposed
> to start at cylinder 1. However, if you run fdisk with the -u option
> (giving the positions and sizes in sectors), you get the following:
>
> (example)
> # fdisk -lu /dev/loop0
>
> Disk /dev/loop0: 10.0 GB, 10056130560 bytes
> 240 heads, 63 sectors/track, 1299 cylinders, total 19640880 sectors
> Units = sectors of 1 * 512 = 512 bytes
> Disk identifier: 0xc1afc1af
>
>       Device Boot      Start         End      Blocks   Id  System
> /dev/loop0p1   *          63     4097519     2048728+   b  W95 FAT32
> /dev/loop0p2         4097520     8195039     2048760    5  Extended
> /dev/loop0p5         4097583     8195039     2048728+   b  W95 FAT32
>
> That is, the first partition starts at sector 63, i.e. at an offset
> value of 63 * 512 = 32256.
>
>> oh, and make a backup just in case :)
>
> And mount the filesystem read-only with the "ro" mount option.
>
> -- Remy
>

Some time ago, I wrote a little script to automate that process, maybe
it will help you also. (And yes, I know that the code isn't that pretty)

Direct copy & paste:

#!/bin/bash
INFILE="$1"
PARTITION="$2"
MOUNTPOINT="$3"
OPT="$4"

if [ "$INFILE" = "" ] ; then echo "Usage: $0 infile partition mountpoint
<options>" ; exit ; fi
if [ "$PARTITION" = "" ] ; then echo "Usage: $0 infile partition
mountpoint <options>" ; exit ; fi
if [ "$MOUNTPOINT" = "" ] ; then echo "Usage: $0 infile partition
mountpoint <options>" ; exit ; fi

if [ "$OPT" != "" ] ; then OPT2=",${OPT}" ; fi

PSTARTB=`sfdisk -d "$INFILE" | grep "start=" | head -n"$PARTITION" |
tail -n1 | sed 's/.*start=[ ]*//' | sed 's/,.*//'`
PSTART=$[ $PSTARTB * 512 ]
#PSIZEB=`sfdisk -d "$INFILE" | grep "size=" | head -n4 | tail -n1 | sed
's/.*size=[ ]*//' | sed 's/,.*//'`
#PSIZE=`echo "$PSIZEB * 512" | bc`
mount "$INFILE" "$MOUNTPOINT" -o loop,offset="$PSTART""$OPT2"
#,sizelimit="$PSIZE""$OPT2"

- Tom
--
gentoo-user@... mailing list