Wednesday, 6 September 2017

linux - Mounting a complete disk image rescued by ddrescue


I've recovered a complete NTFS disk with ddrescue in Linux. The catch is I didn't just rescue the partition (sdX#) but complete disk (sdX) with partition table.


It's really easy to mount disk partitions as loopback devices, but is there a way to mount a partition of a complete disk image in the same way? I can write the image to another disk but I feel it shouldn't be necessary.



Answer



If you imaged the whole drive you can use offset option with mount command. mmls (from The Sleuth Kit) can show partitions within an image


$ mmls image -b
DOS Partition Table
Offset Sector: 0
Units are in 512-byte sectors

Slot Start End Length Size Description
00: ----- 0000000000 0000000000 0000000001 0512B Primary Table (#0)
01: ----- 0000000001 0000000031 0000000031 0015K Unallocated
02: 00:01 0000000032 0001646591 0001646560 0803M DOS FAT16 (0x06)
03: 00:00 0001646592 0002013183 0000366592 0179M DOS FAT16 (0x06)

Mount the DOS partition starting at block 32:


sudo mount -o loop,offset=16384 image mnt

(32 multiplied by 512 byte blocks = 16384)


For mounting a typical NTFS partition created by Windows use:


sudo mount -t ntfs -o r,force,loop,offset=32256 image mnt

(63 multiplied by 512 byte blocks = 32256)


No comments:

Post a Comment

Where does Skype save my contact's avatars in Linux?

I'm using Skype on Linux. Where can I find images cached by skype of my contact's avatars? Answer I wanted to get those Skype avat...