There have been a number of times in Linux where I’ve had to create a bit-copy image of a hard disk using dd or dd_rescue, then needed to mount that image to the local filesystem to peruse its’ contents.
When you use dd or dd_rescue against the block device, you end up with the MBR, Partition Table, and all the partitions on the disk too. This can trip you up when you are used to mounting individual partitions using the loopback driver.
Let’s use a real-world example to illustrate how to deal with a whole disk image:
# file harddisk.img harddisk.img: x86 boot sector, Microsoft Windows XP MBR, Serial 0x72377237; partition 1: ID=0x7, starthead 1, startsector 63, 312560577 sectors, code offset 0xc0
What happens when we try to mount the disk image?
# mount ./harddisk.img /mnt/ mount: /dev/loop0 is write-protected, mounting read-only mount: wrong fs type, bad option, bad superblock on /dev/loop0, missing codepage or helper program, or other error In some cases useful info is found in syslog - try dmesg | tail or so.
So, the automagic mounting is failing, but we expected that because we have the MBR, partition table, and partitions in there, not just a single partition.
Looking at the result of the
file command, above, we see that it says that the startsector for partition 1 is 63. Luckily we can pass this information to the linux mount command. The sector size for older hard disks was 512 bytes, which is what this image was create from, so we multiply 63 by 512 which gives us 32,256 bytes offset in to the file for the first partition. We can pass this information to the mount command:
# mount -o ro,loop,offset=32256 ./harddisk.img /mnt # df -h | grep /mnt /dev/loop0 150G 77G 74G 52% /mnt
There you go – One nicely mounted partition from a disk image that could potentially have contained numerous different partitions.