HOME

  0. Internet
  1. Text
  2. Graphics
  3. System
  4. File
  5. Misc
  6. Palm
  7. OS X

BLOG

DOCS

FAQ

RSS (?)

created: 2010.08.29 updated: 2011.01.02

Mounting partitions from full disk images

Examples assume 512-byte sectors. Tested in Ubuntu Linux 9.04.

1. Mounting without a specified offset

1.1 kpartx (part of Christophe Varoqui's multipath-tools)

$ sudo apt-get install kpartx

$ kpartx

usage : kpartx [-a|-d|-l] [-v] wholedisk
	-a add partition devmappings
	-d del partition devmappings
	-l list partitions devmappings that would be added by -a
	-p set device name-partition number delimiter
	-g force GUID partition table (GPT)
	-v verbose

Sometimes things will be clear:

$ sudo kpartx -l winxp.img
loop0p1 : 0 3326337 /dev/loop0 63

and other times, a little less so:

$ sudo kpartx -l os9.img 
loop0p1 : 0 63 /dev/loop0 1
loop0p2 : 0 54 /dev/loop0 64
loop0p3 : 0 74 /dev/loop0 118
loop0p4 : 0 54 /dev/loop0 192
loop0p5 : 0 74 /dev/loop0 246
loop0p6 : 0 200 /dev/loop0 320
loop0p7 : 0 512 /dev/loop0 520
loop0p8 : 0 512 /dev/loop0 1032
loop0p9 : 0 3330884 /dev/loop0 1544
loop0p10 : 0 10 /dev/loop0 3332428

For additional partition information, use testdisk, parted, mmls, sfdisk, or fdisk (more on these below).

$ sudo kpartx -a -v os9.img 
add map loop0p1 (252:0): 0 63 linear /dev/loop0 1
add map loop0p2 (252:1): 0 54 linear /dev/loop0 64
add map loop0p3 (252:2): 0 74 linear /dev/loop0 118
add map loop0p4 (252:3): 0 54 linear /dev/loop0 192
add map loop0p5 (252:4): 0 74 linear /dev/loop0 246
add map loop0p6 (252:5): 0 200 linear /dev/loop0 320
add map loop0p7 (252:6): 0 512 linear /dev/loop0 520
add map loop0p8 (252:7): 0 512 linear /dev/loop0 1032
add map loop0p9 (252:8): 0 3330884 linear /dev/loop0 1544
add map loop0p10 (252:9): 0 10 linear /dev/loop0 3332428

$ sudo mount /dev/mapper/loop0p9 /mnt -o ro

$ ls /mnt
Applications (Mac OS 9)  Documents                Trash
Desktop DB               Late Breaking News       VM Storage
Desktop DF               System Folder
Desktop Folder           TheVolumeSettingsFolder

$ sudo umount /mnt

$ sudo kpartx -d os9.img 
loop deleted : /dev/loop0

1.2 Linux Enhanced Loopback Driver

Available from Sourceforge or NASA's FTP server. Older and more complex to setup than kpartx. The following documentation is an amalgam of Jason Luttgens's USE.txt, readme.txt, and INSTALL.txt:

The enhanced loopback driver modifies the native loopback driver of the Linux kernel and adds functionality that can make the driver emulate a disk drive in some ways. Most important to us is providing automatic interpretation and mapping of partitions contained within an image file of a hard drive.

For most people, here's what you need to do:

1) Download binary/vmlinuz-2.4.xx-xfs-enhanced_loop.x.tar.gz
2) Download binary/loop-utils-0.0.1-1.i386.rpm
3) Download createdev
./createdev start
rpm --force -ivh /path/to/loop-utils-0.0.1-1.i386.rpm
cd /
tar xvfz /path/to/vmlinuz-2.4.xx-xfs-enhanced_loop.x.tar.gz
Then go and edit your lilo.conf or grub.conf (or whatever boot utility you use) and add in another option to boot the new kernel. The name of this kernel is /boot/vmlinuz-2.4.xx-xfs-enhanced_loop. Make sure if you are booting off of a SCSI drive that you re-create and use an initrd file (unless you know the SCSI driver is built into the kernel).

The createdev script makes the new loop device names (/dev/loopa, /dev/loopb).

Install the new boot configuration and reboot! (select the new kernel)

To use the enhanced loopback driver, here's a basic example:

You have an image file, hdb.dd. It is a dd image of an entire IDE hard drive. Here's a sample session of using the enhanced loopback:
losetup -r /dev/loopa hdb.dd (-r means read-only)

sfdisk -l /dev/loopa
Disk /dev/loopa: cannot get geometry

Disk /dev/loopa: 0 cylinders, 0 heads, 0 sectors/track
Warning: The first partition looks like it was made
  for C/H/S=*/255/63 (instead of 0/0/0).
For this listing I'll assume that geometry.
Units = cylinders of 8225280 bytes, blocks of 1024 bytes, counting from 0

   Device Boot Start     End   #cyls   #blocks   Id  System
/dev/loopa1   *      0+   3824-   3825- 30720280+  83  Linux
/dev/loopa2       3824+   7476-   3652- 29331288    b  Win95 FAT32
/dev/loopa3          0       -       0         0    0  Empty
/dev/loopa4          0       -       0         0    0  Empty

mount -o ro /dev/loopa2 /mnt/evid -t vfat
At this point, /mnt/evid is mounted and can be accessed just like you normally mount and access a partition on a hard drive.

When you are finished, unmount it and remove the losetup association:
umount /mnt/evid/
losetup -d /dev/loopa
That's it!

1.3 Use a partition image

1.3.1 Create partition image from disk

If you still have the original device, you could create a partition image instead of a full disk image, since partition images do not require specifying an offset when mounting. That is:

$ sudo dd if=/dev/sdb1 of=/images/partition.img

instead of:

$ sudo dd if=/dev/sdb of=/images/full_disk.img

Mount the partition with:

$ sudo mount -ro loop /images/partition.img /mnt

or for NTFS:

$ sudo ntfs-3g -o ro -o loop /images/partition.img /mnt

To unmount:

$ sudo umount /mnt

1.3.2 Extract a partition image from a disk image

If creating a partition image is not an option, you can extract the partition from a full disk image using dd:

$ sfdisk -l -uS winxp.img

   Device Boot    Start       End   #sectors  Id  System
winxp.img1   *        63   3326399    3326337   7  HPFS/NTFS
winxp.img2             0         -          0   0  Empty
winxp.img3             0         -          0   0  Empty
winxp.img4             0         -          0   0  Empty

$ sudo dd if=winxp.img of=extracted.img skip=63 count=3326337

$ sudo ntfs-3g -o ro -o loop extracted.img /mnt

$ ls /mnt
boot.ini                ntldr          RECYCLER
Documents and Settings  pagefile.sys   System Volume Information
NTDETECT.COM            Program Files  WINDOWS

$ sudo umount /mnt

Note that if you use fdisk instead of sfdisk:

$ fdisk -lu winxp.img

    Device Boot      Start         End      Blocks   Id  System
winxp.img1   *          63     3326399     1663168+   7  HPFS/NTFS

you'll need to subtract the ending sector (3326399) from the starting sector (63) and add 1 to get the partition size in sectors (3326337).

You could also use Brian Carrier's mmls (part of The Sleuth Kit) or Christophe Grenier's testdisk to easily find the size in sectors, but you'll need to specify the partition type as well:

$ mmls winxp.img 
Cannot determine partition type (Mac or DOS at 0)

$ mmls -t dos winxp.img 
DOS Partition Table
Offset Sector: 0
Units are in 512-byte sectors

     Slot    Start        End          Length       Description
00:  -----   0000000000   0000000000   0000000001   Primary Table (#0)
01:  -----   0000000001   0000000062   0000000062   Unallocated
02:  00:00   0000000063   0003326399   0003326337   NTFS (0x07)
03:  -----   0003326400   0003332447   0000006048   Unallocated

$ testdisk winxp.img

Proceed > Intel > Advanced

Disk winxp.img - 1706 MB / 1627 MiB - CHS 827 64 63

     Partition                  Start        End    Size in sectors
 1 * HPFS - NTFS              0   1  1   824  63 63    3326337

2. Mounting with a specified offset

2.1 Finding the offset

To find the partition's offset, we simply multiply the starting offset by bytes per sector. Both can easily be found with the tools mentioned in section 1.3.2 above. Let's use mmls for this example:

$ mmls -t dos winxp.img 
DOS Partition Table
Offset Sector: 0
Units are in 512-byte sectors

     Slot    Start        End          Length       Description
00:  -----   0000000000   0000000000   0000000001   Primary Table (#0)
01:  -----   0000000001   0000000062   0000000062   Unallocated
02:  00:00   0000000063   0003326399   0003326337   NTFS (0x07)
03:  -----   0003326400   0003332447   0000006048   Unallocated

63 * 512 = 32256

We can avoid even the need to multiply by using parted to find the offset:

$ parted winxp.img 
(parted) unit                                                             
Unit?  [compact]? B                                                       
(parted) print                                                            
Model:  (file)
Disk winxp.img: 1706213376B
Sector size (logical/physical): 512B/512B
Partition Table: msdos

Number  Start   End          Size         Type     File system  Flags
 1      32256B  1703116799B  1703084544B  primary  ntfs         boot 

(parted) quit

2.2 Mounting the partition

$ sudo mount -ro loop,offset=32256 -t ntfs winxp.img /mnt
$ ls /mnt
boot.ini                ntldr          RECYCLER
Documents and Settings  pagefile.sys   System Volume Information
NTDETECT.COM            Program Files  WINDOWS
$ sudo umount /mnt

Or, if you prefer:

$ sudo losetup -o 32256 /dev/loop1 winxp.img
$ sudo mount -r -t ntfs /dev/loop1 /mnt
$ ls /mnt
boot.ini                ntldr          RECYCLER
Documents and Settings  pagefile.sys   System Volume Information
NTDETECT.COM            Program Files  WINDOWS
$ sudo umount /mnt
$ sudo losetup -d /dev/loop1

3. Sources

Andre Miller's Mounting a hard disk image including partitions using Linux
Brian Carrier's Splitting The Disk and Splitting The Disk With mmls
Forensics Wiki's Mounting Disk Images
Gavin Burris's Mount Disk Image Partition with Loop Device
Jason Boxman's Mounting disk images on Linux loopback device
Marc Haisenko's Creating and using disk images mini-howto
Martin Krafft's Loop-mounting partitions from a disk image
Mirko Caserta's How to extract a filesystem from a disk image
Robert Penz's Kpartx: a tool for mounting partitions within an image file

4. Notes

4.1 wrong fs type, bad option, bad superblock on /dev/foo

If you receive a "wrong fs type" when attempting to mount an ext3 partition, it may be due to an unclean journal:

$ sudo mount -o loop,ro -t ext3 linux.img /mnt
mount: wrong fs type, bad option, bad superblock on  /dev/loop0
...

Check with file:

$ file linux.img
linux.img: Linux rev 1.0 ext3 filesystem data (needs journal recovery)

If the image need not be kept forensically sound, you may want to repair the filesystem: fsck.ext3 linux.img

Otherwise, see Hal Pomeranz's Mounting Images Using Alternate Superblocks and Mounting Images Using Alternate Superblocks (Follow-Up) for a workaround that uses alternate superblocks to circumvent the journal recovery requirement.

4.2 HFS vs HFS+

Mounting a Mac OS 9 partition I thought to be HFS:

$ sudo mount -t hfs -o ro,loop,offset=790528 os9.img /mnt

produced an unexpected result:

$ ls /mnt
Desktop DB  Desktop DF  Finder  System  Where_have_all_my_files_gone?

The Where_have_all_my_files_gone? text file is actually quite helpful. It begins:

Why can't you see your files? This hard disk is formatted with the Mac OS Extended format. Your files and information are still on the hard disk, but you cannot access them with the version of system software you are using ...

Nice to see the filesystem degrade so gracefully. Just need to mount as HFS+:

$ sudo mount -t hfsplus -o ro,loop,offset=790528 os9.img /mnt

$ ls /mnt
Applications (Mac OS 9)  Documents                Trash
Desktop DB               Late Breaking News       VM Storage
Desktop DF               System Folder
Desktop Folder           TheVolumeSettingsFolder