| View previous topic :: View next topic |
| Author |
Message |
Kobboi
l33t
Joined: 29 Jul 2005
Posts: 673
Location: Belgium
|
 Posted: Thu Apr 24, 2008 7:40 pm Post subject: Operations on a disk image? |
 |
|
| I once made a bitwise copy of a disk and I now want to mess around with it a bit. Is there an easy way to cut out specific partitions? Or to mount the partitions that are in the file? |
|
| Back to top |
|
 |
NeddySeagoon
Administrator
Joined: 05 Jul 2003
Posts: 54821
Location: 56N 3W
|
| Posted: Thu Apr 24, 2008 8:08 pm Post subject: |
|
|
Kobboi,
You can mount the partitions inside the file, almost as if they were real partitions.
Your kernel needs loop support and support for all the file systems inside the image.
Now you can mount the partitions in the file like this:-
| Code: | | mount -o loop,offset=<bytes>,ro -t <fstype> /path/to/file /some/mountpoint |
The trick is to determine <bytes> for the offset command. For that, you need to read the partition table and translate it into bytes. On PCs, the first partition always starts at sector 63, which is offset 32256.
| Code: | | fdisk -l -u /path/to/file |
will show you the partition table in units of blocks.
blocks are 512 bytes, so its a case of multiplying the start block by 512 to get offset
_________________
Regards,
NeddySeagoon
Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail. |
|
| Back to top |
|
|
Kobboi
l33t
Joined: 29 Jul 2005
Posts: 673
Location: Belgium
|
| Posted: Thu Apr 24, 2008 8:32 pm Post subject: |
|
|
It works, half 
fdisk correctly recognizes the partition as NTFS:
| Code: | Disk /home/john/tc1000disk.bin: 0 MB, 0 bytes
255 heads, 63 sectors/track, 0 cylinders, total 0 sectors
Units = sectors of 1 * 512 = 512 bytes
Disk identifier: 0x37e537e5
Device Boot Start End Blocks Id System
/home/john/tc1000disk.bin1 * 63 58589054 29294496 7 HPFS/NTFS
Partition 1 has different physical/logical endings:
phys=(1023, 254, 63) logical=(3646, 254, 63)
|
But the mounting goes wrong:
| Code: | saive john # mount -o loop,offset=32256,ro /home/john/tc1000disk.bin /mnt/tc1000/
saive john # dmesg
NTFS volume version 3.1.
attempt to access beyond end of device
loop1: rw=0, want=28333841, limit=18649249
NTFS-fs error (device loop1): ntfs_end_buffer_async_read(): Buffer I/O error, logical block 0x1b05710.
attempt to access beyond end of device
loop1: rw=0, want=28333842, limit=18649249
NTFS-fs error (device loop1): ntfs_end_buffer_async_read(): Buffer I/O error, logical block 0x1b05711.
attempt to access beyond end of device
loop1: rw=0, want=28333843, limit=18649249
NTFS-fs error (device loop1): ntfs_end_buffer_async_read(): Buffer I/O error, logical block 0x1b05712.
attempt to access beyond end of device
loop1: rw=0, want=28333844, limit=18649249
NTFS-fs error (device loop1): ntfs_end_buffer_async_read(): Buffer I/O error, logical block 0x1b05713.
attempt to access beyond end of device
loop1: rw=0, want=28333845, limit=18649249
NTFS-fs error (device loop1): ntfs_end_buffer_async_read(): Buffer I/O error, logical block 0x1b05714.
attempt to access beyond end of device
loop1: rw=0, want=28333846, limit=18649249
NTFS-fs error (device loop1): ntfs_end_buffer_async_read(): Buffer I/O error, logical block 0x1b05715.
attempt to access beyond end of device
loop1: rw=0, want=28333847, limit=18649249
NTFS-fs error (device loop1): ntfs_end_buffer_async_read(): Buffer I/O error, logical block 0x1b05716.
attempt to access beyond end of device
loop1: rw=0, want=28333848, limit=18649249
NTFS-fs error (device loop1): ntfs_end_buffer_async_read(): Buffer I/O error, logical block 0x1b05717.
attempt to access beyond end of device
loop1: rw=0, want=28333841, limit=18649249
NTFS-fs error (device loop1): ntfs_end_buffer_async_read(): Buffer I/O error, logical block 0x1b05710.
attempt to access beyond end of device
loop1: rw=0, want=28333842, limit=18649249
NTFS-fs error (device loop1): ntfs_end_buffer_async_read(): Buffer I/O error, logical block 0x1b05711.
attempt to access beyond end of device
loop1: rw=0, want=28333843, limit=18649249
NTFS-fs error (device loop1): ntfs_end_buffer_async_read(): Buffer I/O error, logical block 0x1b05712.
attempt to access beyond end of device
loop1: rw=0, want=28333844, limit=18649249
NTFS-fs error (device loop1): ntfs_end_buffer_async_read(): Buffer I/O error, logical block 0x1b05713.
attempt to access beyond end of device
loop1: rw=0, want=28333845, limit=18649249
NTFS-fs error (device loop1): ntfs_end_buffer_async_read(): Buffer I/O error, logical block 0x1b05714.
attempt to access beyond end of device
loop1: rw=0, want=28333846, limit=18649249
NTFS-fs error (device loop1): ntfs_end_buffer_async_read(): Buffer I/O error, logical block 0x1b05715.
attempt to access beyond end of device
loop1: rw=0, want=28333847, limit=18649249
NTFS-fs error (device loop1): ntfs_end_buffer_async_read(): Buffer I/O error, logical block 0x1b05716.
attempt to access beyond end of device
loop1: rw=0, want=28333848, limit=18649249
NTFS-fs error (device loop1): ntfs_end_buffer_async_read(): Buffer I/O error, logical block 0x1b05717.
NTFS-fs error (device loop1): ntfs_lookup_inode_by_name(): Failed to map directory index page, error 5.
NTFS-fs error (device loop1): check_windows_hibernation_status(): Failed to find inode number for hiberfil.sys.
NTFS-fs warning (device loop1): load_system_files(): Failed to determine if Windows is hibernated. Will not be able to remount read-write. Run chkdsk.
|
|
|
| Back to top |
|
|
NeddySeagoon
Administrator
Joined: 05 Jul 2003
Posts: 54821
Location: 56N 3W
|
| Posted: Thu Apr 24, 2008 10:01 pm Post subject: |
|
|
Kobboi,
It looks like you only have part of the drive imaged.
What does | Code: | | ls -l /home/john/tc1000disk.bin |
show ?
The file size must be at least 29,997,595,648 or 30G.
_________________
Regards,
NeddySeagoon
Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail. |
|
| Back to top |
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
Kernel & Hardware
