# losetup --partscan --find --show disk.img /dev/loop0 # lsblk --fs NAME FSTYPE LABEL ... loop0 ├─loop0p1 hfsplus MacData └─loop0p2 exfat SharedData # mkdir /mnt/MacData # mount /dev/loop0p1 /mnt/MacData # ls /mnt/MacData file1 file2 file3 etc... # umount /mnt/MacData # losetup --detach-all
$ sudo apt-get install kpartx $ kpartx usage : kpartx [-a|-d|-l] [-v] wholedisk -a add partition devmappings -d del partition devmappings -l list partitions devmappings that would be added by -a -p set device name-partition number delimiter -g force GUID partition table (GPT) -v verboseSometimes things will be clear:
$ sudo kpartx -l winxp.img loop0p1 : 0 3326337 /dev/loop0 63and other times, a little less so:
$ sudo kpartx -l os9.img loop0p1 : 0 63 /dev/loop0 1 loop0p2 : 0 54 /dev/loop0 64 loop0p3 : 0 74 /dev/loop0 118 loop0p4 : 0 54 /dev/loop0 192 loop0p5 : 0 74 /dev/loop0 246 loop0p6 : 0 200 /dev/loop0 320 loop0p7 : 0 512 /dev/loop0 520 loop0p8 : 0 512 /dev/loop0 1032 loop0p9 : 0 3330884 /dev/loop0 1544 loop0p10 : 0 10 /dev/loop0 3332428For additional partition information, use testdisk, parted, mmls, gdisk, sfdisk, or fdisk (more on these below).
$ sudo kpartx -a -v os9.img add map loop0p1 (252:0): 0 63 linear /dev/loop0 1 add map loop0p2 (252:1): 0 54 linear /dev/loop0 64 add map loop0p3 (252:2): 0 74 linear /dev/loop0 118 add map loop0p4 (252:3): 0 54 linear /dev/loop0 192 add map loop0p5 (252:4): 0 74 linear /dev/loop0 246 add map loop0p6 (252:5): 0 200 linear /dev/loop0 320 add map loop0p7 (252:6): 0 512 linear /dev/loop0 520 add map loop0p8 (252:7): 0 512 linear /dev/loop0 1032 add map loop0p9 (252:8): 0 3330884 linear /dev/loop0 1544 add map loop0p10 (252:9): 0 10 linear /dev/loop0 3332428 $ sudo mount /dev/mapper/loop0p9 /mnt -o ro $ ls /mnt Applications (Mac OS 9) Documents Trash Desktop DB Late Breaking News VM Storage Desktop DF System Folder Desktop Folder TheVolumeSettingsFolder $ sudo umount /mnt $ sudo kpartx -d os9.img loop deleted : /dev/loop0
"libguestfs can access almost any disk image imaginable. It can do it securely — without needing root and with multiple layers of defence against rogue disk images. It can access disk images on remote machines or on CDs/USB sticks. It can access proprietary systems like VMware and Hyper-V."
$ sudo apt install libguestfs-tools $ guestfish -ro -a disk.img ><fs> run ... ><fs> list-filesystems /dev/sda1: exfat ><fs> mount /dev/sda1 / ><fs> ls / foo bar baz etc ><fs> copy-out / . ><fs> q
For exFAT support at the moment (Oct 2016), create zz-exfat like so:
# echo exfat-fuse > /usr/lib/x86_64-linux-gnu/guestfs/supermin.d/zz-exfat # echo exfat-utils >> /usr/lib/x86_64-linux-gnu/guestfs/supermin.d/zz-exfat
or patch and compile from source. Many thanks to Richard W.M. Jones for both fixes.
libguestfs also includes guestmount, which can mount disk images directly into the local filesystem.
The enhanced loopback driver modifies the native loopback driver of the Linux kernel and adds functionality that can make the driver emulate a disk drive in some ways. Most important to us is providing automatic interpretation and mapping of partitions contained within an image file of a hard drive.
For most people, here's what you need to do:
1) Download binary/vmlinuz-2.4.xx-xfs-enhanced_loop.x.tar.gz
2) Download binary/loop-utils-0.0.1-1.i386.rpm
3) Download createdev./createdev start rpm --force -ivh /path/to/loop-utils-0.0.1-1.i386.rpm cd / tar xvfz /path/to/vmlinuz-2.4.xx-xfs-enhanced_loop.x.tar.gzThen go and edit your lilo.conf or grub.conf (or whatever boot utility you use) and add in another option to boot the new kernel. The name of this kernel is /boot/vmlinuz-2.4.xx-xfs-enhanced_loop. Make sure if you are booting off of a SCSI drive that you re-create and use an initrd file (unless you know the SCSI driver is built into the kernel).
The createdev script makes the new loop device names (/dev/loopa, /dev/loopb).
Install the new boot configuration and reboot! (select the new kernel)
To use the enhanced loopback driver, here's a basic example:
You have an image file, hdb.dd. It is a dd image of an entire IDE hard drive. Here's a sample session of using the enhanced loopback:losetup -r /dev/loopa hdb.dd (-r means read-only) sfdisk -l /dev/loopa Disk /dev/loopa: cannot get geometry Disk /dev/loopa: 0 cylinders, 0 heads, 0 sectors/track Warning: The first partition looks like it was made for C/H/S=*/255/63 (instead of 0/0/0). For this listing I'll assume that geometry. Units = cylinders of 8225280 bytes, blocks of 1024 bytes, counting from 0 Device Boot Start End #cyls #blocks Id System /dev/loopa1 * 0+ 3824- 3825- 30720280+ 83 Linux /dev/loopa2 3824+ 7476- 3652- 29331288 b Win95 FAT32 /dev/loopa3 0 - 0 0 0 Empty /dev/loopa4 0 - 0 0 0 Empty mount -o ro /dev/loopa2 /mnt/evid -t vfatAt this point, /mnt/evid is mounted and can be accessed just like you normally mount and access a partition on a hard drive.
When you are finished, unmount it and remove the losetup association:umount /mnt/evid/ losetup -d /dev/loopaThat's it!
$ sudo dd if=/dev/sdb1 of=/images/partition.imginstead of:
$ sudo dd if=/dev/sdb of=/images/full_disk.imgMount the partition with:
$ sudo mount -ro loop /images/partition.img /mntor for NTFS:
$ sudo ntfs-3g -o ro -o loop /images/partition.img /mntTo unmount:
$ sudo umount /mnt
$ sfdisk -l -uS winxp.img Device Boot Start End #sectors Id System winxp.img1 * 63 3326399 3326337 7 HPFS/NTFS winxp.img2 0 - 0 0 Empty winxp.img3 0 - 0 0 Empty winxp.img4 0 - 0 0 Empty $ sudo dd if=winxp.img of=extracted.img skip=63 count=3326337 $ sudo ntfs-3g -o ro -o loop extracted.img /mnt $ ls /mnt boot.ini ntldr RECYCLER Documents and Settings pagefile.sys System Volume Information NTDETECT.COM Program Files WINDOWS $ sudo umount /mntNote that if you use fdisk instead of sfdisk:
$ fdisk -lu winxp.img
Device Boot Start End Blocks Id System
winxp.img1 * 63 3326399 1663168+ 7 HPFS/NTFS
you'll need to subtract the ending sector (3326399) from the starting sector (63) and add 1 to get the partition size in sectors (3326337).
$ mmls winxp.img
Cannot determine partition type (Mac or DOS at 0)
$ mmls -t dos winxp.img
DOS Partition Table
Offset Sector: 0
Units are in 512-byte sectors
Slot Start End Length Description
00: ----- 0000000000 0000000000 0000000001 Primary Table (#0)
01: ----- 0000000001 0000000062 0000000062 Unallocated
02: 00:00 0000000063 0003326399 0003326337 NTFS (0x07)
03: ----- 0003326400 0003332447 0000006048 Unallocated
$ testdisk winxp.img
Proceed > Intel > Advanced
Disk winxp.img - 1706 MB / 1627 MiB - CHS 827 64 63
Partition Start End Size in sectors
1 * HPFS - NTFS 0 1 1 824 63 63 3326337
$ mmls -t dos winxp.img DOS Partition Table Offset Sector: 0 Units are in 512-byte sectors Slot Start End Length Description 00: ----- 0000000000 0000000000 0000000001 Primary Table (#0) 01: ----- 0000000001 0000000062 0000000062 Unallocated 02: 00:00 0000000063 0003326399 0003326337 NTFS (0x07) 03: ----- 0003326400 0003332447 0000006048 Unallocated63 * 512 = 32256
$ parted winxp.img
(parted) unit
Unit? [compact]? B
(parted) print
Model: (file)
Disk winxp.img: 1706213376B
Sector size (logical/physical): 512B/512B
Partition Table: msdos
Number Start End Size Type File system Flags
1 32256B 1703116799B 1703084544B primary ntfs boot
(parted) quit
$ sudo mount -ro loop,offset=32256 -t ntfs winxp.img /mnt
$ ls /mnt
boot.ini ntldr RECYCLER
Documents and Settings pagefile.sys System Volume Information
NTDETECT.COM Program Files WINDOWS
$ sudo umount /mnt
Or, if you prefer:
$ sudo losetup -o 32256 /dev/loop1 winxp.img
$ sudo mount -r -t ntfs /dev/loop1 /mnt
$ ls /mnt
boot.ini ntldr RECYCLER
Documents and Settings pagefile.sys System Volume Information
NTDETECT.COM Program Files WINDOWS
$ sudo umount /mnt
$ sudo losetup -d /dev/loop1
$ sudo mount -o loop,ro -t ext3 linux.img /mnt mount: wrong fs type, bad option, bad superblock on /dev/loop0 ...Check with file:
$ file linux.img linux.img: Linux rev 1.0 ext3 filesystem data (needs journal recovery)
If the image need not be kept forensically sound, you may want to repair the filesystem: fsck.ext3 linux.img
Otherwise, Hal Pomeranz has outlined several workarounds:
3.2.1 Determine size of logical sectors (generally 512 or 4096 bytes):
$ sudo fdisk -l disk.img
...
Sector size (logical/physical): 512 bytes / 512 bytes
Disklabel type: gpt
...
Device Start End Sectors Size Type
disk.img1 40 409639 409600 200M EFI System
disk.img2 409640 975503591 975093952 465G Apple Core storage
disk.img3 975503592 976773127 1269536 619.9M Apple boot
3.2.2 Determine offset and size in sectors:
$ sudo testdisk disk.img
Select Proceed > EFI GPT > Analyse > Quick Search, which will output something like this:
Partition Start End Size in sectors P EFI System 40 409639 409600 [EFI] P Mac HFS 409640 974778407 974368768 P Mac HFS 975503592 976773127 1269536
Press Q four times to quit testdisk
3.2.3 Mount and check contents:
$ sudo mount disk.img -t hfsplus -o ro,loop,offset=$((409640*512)),sizelimit=$((974368768*512)) /mnt $ ls /mnt Applications cores etc installer.failurerequests net private System User Information usr Volumes bin dev home Library Network sbin tmp Users var $ sudo umount /mnt
3.2.4 Notes on Core Storage mounting
$ sudo mount -t hfs -o ro,loop,offset=790528 os9.img /mntproduced an unexpected result:
$ ls /mnt Desktop DB Desktop DF Finder System Where_have_all_my_files_gone?The Where_have_all_my_files_gone? text file is actually quite helpful. It begins:
$ sudo mount -t hfsplus -o ro,loop,offset=790528 os9.img /mnt $ ls /mnt Applications (Mac OS 9) Documents Trash Desktop DB Late Breaking News VM Storage Desktop DF System Folder Desktop Folder TheVolumeSettingsFolder
last update: 2017.03.06