[gentoo-user] OT: Recovering partitions from an imaged drive

[gentoo-user] OT: Recovering partitions from an imaged drive

[Tom Eastman]

Hey guys, this is a non-gentoo question but I figure someone on here will
have the answer I seek :-)

My father's laptop (running Windows XP) managed to detonate itself a few
days back and I'm trying to recover information from it.  Before we wiped
the hard drive I loaded a LiveCD and imaged the entire hard drive using
'dd':

        dd if=/dev/hda of=/some/location/on/nfs

So I have a 4.3GB file on my desktop which is the complete hard drive of his
laptop.

So here's my question, if I had just gone 'dd if=/dev/hda1' it would have
been easy to mount the file as a loopback filesystem and get the files off
of it, but since I dd'ed the *entire* disk I have all the extra crud as
well like boot sectors and partition tables and such.  

How can I take this image of ('hda') and mount the filesystem ('hda1')
that's inside it?

Thanks!

        Tom


-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] OT: Recovering partitions from an imaged drive

[Etaoin Shrdlu]

Tom Eastman wrote:

> How can I take this image of ('hda') and mount the filesystem
> ('hda1') that's inside it?

I'm not sure, but mounting the whole hda as loopback could work (seem 
to remember a thread about this some time ago on the list, search the 
archives).
In case it does not, try this. Since the real partitions usually start 
at the second sector (the first being the MBR that holds the 
bootloader and the partition table), I guess (iff the hard disk had 
only one partition taking all the space) you can extract only the 
hda1 partition by dd'ing the file onto another one but this time 
skipping the first sector, ie something like

dd if=hda.img of=hda1.img bs=512 skip=1

or so.

Hope this works.
-- 
gentoo-user@gentoo.org mailing list

[gentoo-user] Re: OT: Recovering partitions from an imaged drive

[Tom Eastman]

Etaoin Shrdlu wrote:

> Tom Eastman wrote:
> I'm not sure, but mounting the whole hda as loopback could work (seem
> to remember a thread about this some time ago on the list, search the
> archives).
> In case it does not, try this. Since the real partitions usually start
> at the second sector (the first being the MBR that holds the
> bootloader and the partition table), I guess (iff the hard disk had
> only one partition taking all the space) you can extract only the
> hda1 partition by dd'ing the file onto another one but this time
> skipping the first sector, ie something like
> 
> dd if=hda.img of=hda1.img bs=512 skip=1
> 
> or so.
> 
> Hope this works.

Thanks, I managed to solve it a different way in the end :-)  I loaded up my
own physical NTFS partition in a hex viewer, and looked at what byte
sequence was right at the start of the partition, then I opened the disk
image and searched for that same byte sequence in the file :-)

Having found it (at the 32,256th byte) I was able to use 'losetup -o 32256'
to offset the loopback device, and the partition loaded up without a hitch!

Thanks for your help!

        Tom


-- 
gentoo-user@gentoo.org mailing list

RE: [gentoo-user] Re: OT: Recovering partitions from an imaged drive

[Michael Kintzios]

> -----Original Message-----
> From: news [mailto:news@sea.gmane.org] On Behalf Of Tom Eastman
> Sent: 18 August 2005 05:19
> To: gentoo-user@lists.gentoo.org
> Subject: [gentoo-user] Re: OT: Recovering partitions from an 
> imaged drive
> 
> 
> Etaoin Shrdlu wrote:
> 
> > Tom Eastman wrote:
> > I'm not sure, but mounting the whole hda as loopback could 
> work (seem
> > to remember a thread about this some time ago on the list, 
> search the
> > archives).
> > In case it does not, try this. Since the real partitions 
> usually start
> > at the second sector (the first being the MBR that holds the
> > bootloader and the partition table), I guess (iff the hard disk had
> > only one partition taking all the space) you can extract only the
> > hda1 partition by dd'ing the file onto another one but this time
> > skipping the first sector, ie something like
> > 
> > dd if=hda.img of=hda1.img bs=512 skip=1
> > 
> > or so.
> > 
> > Hope this works.
> 
> Thanks, I managed to solve it a different way in the end :-)  
> I loaded up my
> own physical NTFS partition in a hex viewer, and looked at what byte
> sequence was right at the start of the partition, then I 
> opened the disk
> image and searched for that same byte sequence in the file :-)
> 
> Having found it (at the 32,256th byte) I was able to use 
> 'losetup -o 32256'
> to offset the loopback device, and the partition loaded up 
> without a hitch!

Probably I need more coffee, but since I haven't ever used loopback and
just in case I am being dense, would you mind detailing your steps above
when you get a minute?
-- 
Regards,
Mick

-- 
gentoo-user@gentoo.org mailing list