[gentoo-user] "loopback mount" hard-drive image created with dd?

[gentoo-user] "loopback mount" hard-drive image created with dd?

[Stroller]

Hi there,

Before installing on a new laptop which came with Vista pre-installed  
I took an image of the hard-drive using dd. (ie: `dd if=/dev/sda of=/ 
mnt/sdb1/disk.img`, where /mnt/sdb1 was a portable USB hard-drive).

Obviously the intention was that if I b0rked things up I could just  
`dd` the image back onto the laptop and all would work as the  
manufacturer shipped it, but I'd now find it useful to be able to  
take a look inside the image and examine a few files. Is there any  
way to do this, please?

I'm fairly confident that there were originally a couple of  
partitions on the drive, and the one I want to look at will be NTFS,  
of course. I know that a CD iso I can mount using `mount file.iso / 
mnt/cdrom -t iso9660 -o loop`, but is there an equivalent for whole  
partition tables?

Thanks in advance for any suggestions or advices,

Stroller.

-- 
gentoo-user@lists.gentoo.org mailing list

Re: [gentoo-user] "loopback mount" hard-drive image created with dd?

[आशीष शुक्ल Ashish Shukla]

[-- Attachment #1: Type: text/plain, Size: 755 bytes --]

,--[ On Fri, Jan 18, 2008 at 03:19:49AM +0000, Stroller wrote:

[...]

> I'm fairly confident that there were originally a couple of partitions on 
> the drive, and the one I want to look at will be NTFS, of course. I know 
> that a CD iso I can mount using `mount file.iso /mnt/cdrom -t iso9660 -o 
> loop`, but is there an equivalent for whole partition tables?

How about using your disk image as HD in a VM, and then inspect it from
VM, hmm... Or look out for some tools which allow you to play with hard
disk images, e.g. mtools .

HTH
-- 
Ashish Shukla आशीष शुक्ल                      http://wahjava.wordpress.com/
·-- ·- ···· ·--- ·- ···- ·- ·--·-· --· -- ·- ·· ·-·· ·-·-·- -·-· --- --

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-user] "loopback mount" hard-drive image created with dd?

[Stroller]

On 18 Jan 2008, at 09:04, आशीष शुक्ल Ashish Shukla  
wrote:
> ,--[ On Fri, Jan 18, 2008 at 03:19:49AM +0000, Stroller wrote:
> [...]
>
>> I'm fairly confident that there were originally a couple of  
>> partitions on
>> the drive, and the one I want to look at will be NTFS, of course.  
>> I know
>> that a CD iso I can mount using `mount file.iso /mnt/cdrom -t  
>> iso9660 -o
>> loop`, but is there an equivalent for whole partition tables?
>
> How about using your disk image as HD in a VM, and then inspect it  
> from
> VM, hmm...

Would that work? I've never used VMs - are their drive images exactly  
"blocky" as my `dd` command would produce?
(`dd if=/dev/sda of=/mnt/sdb1/disk.img`, where /mnt/sdb1 was a  
portable USB hard-drive).

> Or look out for some tools which allow you to play with hard
> disk images, e.g. mtools .

It looks like mtools is geared towards floppies but will handle a  
hard-drive fine. However the manual <http://mtools.linux.lu/ 
mtools.html> suggests no support for NTFS. (??)

Stroller.--
gentoo-user@lists.gentoo.org mailing list

Re: [gentoo-user] "loopback mount" hard-drive image created with dd?

[Ashish Shukla आशीष शुक्ल]

[-- Attachment #1: Type: text/plain, Size: 1260 bytes --]

>>>>> "Stroller" == Stroller  <stroller@stellar.eclipse.co.uk> writes:

    Stroller> Would that work? I've never used VMs - are their drive images exactly
    Stroller> "blocky" as my `dd` command would produce?
    Stroller> (`dd if=/dev/sda of=/mnt/sdb1/disk.img`, where /mnt/sdb1 was a
    Stroller> portable USB hard-drive).

I installed FreeBSD on my box, this way, when I didn't have CD-ROM
drive on my box :) . I've used QEmu (AMD64), and it worked flawlessly :) .

    Stroller> It looks like mtools is geared towards floppies but will handle a
    Stroller> hard-drive fine. However the manual <http://mtools.linux.lu/
    mtools.html> suggests no support for NTFS. (??)

Another hack you can try is use to use '--offset' option of
'losetup'. First figure out from which byte, NTFS partition starts in
disk image, and then you create a loopback back device for that image
and the starting offset using 'losetup' and finally 'mount' the
loopback as NTFS partition :) .

Please do post your results, if you're successful :)

HTH
-- 
Ashish Shukla आशीष शुक्ल                      http://wahjava.wordpress.com/
·-- ·- ···· ·--- ·- ···- ·- ·--·-· --· -- ·- ·· ·-·· ·-·-·- -·-· --- --

[-- Attachment #2: Type: application/pgp-signature, Size: 188 bytes --]

[gentoo-user] "loopback mount" hard-drive image created with dd?

[Jerry McBride]

Stroller wrote:

> Hi there,
> 
> Before installing on a new laptop which came with Vista pre-installed
> I took an image of the hard-drive using dd. (ie: `dd if=/dev/sda of=/
> mnt/sdb1/disk.img`, where /mnt/sdb1 was a portable USB hard-drive).
> 
> Obviously the intention was that if I b0rked things up I could just
> `dd` the image back onto the laptop and all would work as the
> manufacturer shipped it, but I'd now find it useful to be able to
> take a look inside the image and examine a few files. Is there any
> way to do this, please?
> 
> I'm fairly confident that there were originally a couple of
> partitions on the drive, and the one I want to look at will be NTFS,
> of course. I know that a CD iso I can mount using `mount file.iso /
> mnt/cdrom -t iso9660 -o loop`, but is there an equivalent for whole
> partition tables?
> 
> Thanks in advance for any suggestions or advices,
> 
> Stroller.
> 

Try this...

modprobe loop
modprobe ntfs

mkdir /mnt/iso

mount -t ntfs /path/to/your/iso /mnt/iso -o loop,ro

Assuming the iso is ntfs and you have loop and ntfs as modules...

Cheers.











Jerry McBride (jmcbride@mail-on.us)
-- 


From the Desk of: Jerome D. McBride
--
gentoo-user@lists.gentoo.org mailing list

Re: [gentoo-user] "loopback mount" hard-drive image created with dd?

[Alan McKinnon]

On Friday 18 January 2008, Jerry McBride wrote:
> Stroller wrote:
> > Hi there,
> >
> > Before installing on a new laptop which came with Vista
> > pre-installed I took an image of the hard-drive using dd. (ie: `dd
> > if=/dev/sda of=/ mnt/sdb1/disk.img`, where /mnt/sdb1 was a portable
> > USB hard-drive).
> >
> > Obviously the intention was that if I b0rked things up I could just
> > `dd` the image back onto the laptop and all would work as the
> > manufacturer shipped it, but I'd now find it useful to be able to
> > take a look inside the image and examine a few files. Is there any
> > way to do this, please?
> >
> > I'm fairly confident that there were originally a couple of
> > partitions on the drive, and the one I want to look at will be
> > NTFS, of course. I know that a CD iso I can mount using `mount
> > file.iso / mnt/cdrom -t iso9660 -o loop`, but is there an
> > equivalent for whole partition tables?
> >
> > Thanks in advance for any suggestions or advices,
> >
> > Stroller.
>
> Try this...
>
> modprobe loop
> modprobe ntfs
>
> mkdir /mnt/iso
>
> mount -t ntfs /path/to/your/iso /mnt/iso -o loop,ro
>
> Assuming the iso is ntfs and you have loop and ntfs as modules...
>
> Cheers.

Won't work. He already said the .iso is a *disk* image, not a *file 
system* image.

The ntfs driver (or any sane file system driver) will not know what to 
do with a block image complete with partition tables and boot records.

alan


-- 
Alan McKinnon
alan dot mckinnon at gmail dot com
-- 
gentoo-user@lists.gentoo.org mailing list

Re: [gentoo-user] "loopback mount" hard-drive image created with dd?

[Jerry McBride]

On Friday 18 January 2008 01:01:18 pm Alan McKinnon wrote:
> On Friday 18 January 2008, Jerry McBride wrote:
> > Stroller wrote:
> > > Hi there,
> > >
> > > Before installing on a new laptop which came with Vista
> > > pre-installed I took an image of the hard-drive using dd. (ie: `dd
> > > if=/dev/sda of=/ mnt/sdb1/disk.img`, where /mnt/sdb1 was a portable
> > > USB hard-drive).
> > >
> > > Obviously the intention was that if I b0rked things up I could just
> > > `dd` the image back onto the laptop and all would work as the
> > > manufacturer shipped it, but I'd now find it useful to be able to
> > > take a look inside the image and examine a few files. Is there any
> > > way to do this, please?
> > >
> > > I'm fairly confident that there were originally a couple of
> > > partitions on the drive, and the one I want to look at will be
> > > NTFS, of course. I know that a CD iso I can mount using `mount
> > > file.iso / mnt/cdrom -t iso9660 -o loop`, but is there an
> > > equivalent for whole partition tables?
> > >
> > > Thanks in advance for any suggestions or advices,
> > >
> > > Stroller.
> >
> > Try this...
> >
> > modprobe loop
> > modprobe ntfs
> >
> > mkdir /mnt/iso
> >
> > mount -t ntfs /path/to/your/iso /mnt/iso -o loop,ro
> >
> > Assuming the iso is ntfs and you have loop and ntfs as modules...
> >
> > Cheers.
>
> Won't work. He already said the .iso is a *disk* image, not a *file
> system* image.
>
> The ntfs driver (or any sane file system driver) will not know what to
> do with a block image complete with partition tables and boot records.
>
> alan
>

I don't doubt what you wrote, but I've done exactly that many times and never 
had a problem. Is this some kind of ntfs support issue? 

Just this morning, I ran dd to make an image of a usbstick I dearly love... I 
just now mounted the image as vfat as stated above and I have complete access 
to the data on it... Is the ntfs module that different? Just curious.

Cheers.



-- 


From the Desk of: Jerome D. McBride
--
gentoo-user@lists.gentoo.org mailing list

Re: [gentoo-user] "loopback mount" hard-drive image created with dd?

[Yahya Mohammad]

> Another hack you can try is use to use '--offset' option of
> 'losetup'. First figure out from which byte, NTFS partition starts in
> disk image, and then you create a loopback back device for that image
> and the starting offset using 'losetup' and finally 'mount' the
> loopback as NTFS partition :) .

Here's more detail on how to do that

# losetup /dev/loop0 /path/to/diskimage
# fdisk -l /dev/loop0
(example)
Disk /dev/sdb: 160.0 GB, 160041885696 bytes
255 heads, 63 sectors/track, 19457 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

   Device Boot      Start         End      Blocks   Id  System
/dev/sdb1   *           1        1044     8385898+   c  W95 FAT32 (LBA)
/dev/sdb2            1045       19457   147902422+  83  Linux

suppose you want to mount the partition on sdb2, the offset for that
would be 8225280 * 1045 = 8595417600.

detach the disk image
# losetup -d /dev/loop0
and setup the loop for the partiion
# losetup -o8595417600 /dev/loop0 /path/to/diskimage
and mount it
# mount -t fstype /dev/loop0 /path/to/mountdir


> Please do post your results, if you're successful :)

I second that, I'm curious to know if it works

oh, and make a backup just in case :)
-- 
gentoo-user@lists.gentoo.org mailing list

Re: [gentoo-user] "loopback mount" hard-drive image created with dd?

[Alan McKinnon]

On Friday 18 January 2008, Jerry McBride wrote:
> On Friday 18 January 2008 01:01:18 pm Alan McKinnon wrote:

> > Won't work. He already said the .iso is a *disk* image, not a *file
> > system* image.
> >
> > The ntfs driver (or any sane file system driver) will not know what
> > to do with a block image complete with partition tables and boot
> > records.
> >
> > alan
>
> I don't doubt what you wrote, but I've done exactly that many times
> and never had a problem. Is this some kind of ntfs support issue?
>
> Just this morning, I ran dd to make an image of a usbstick I dearly
> love... I just now mounted the image as vfat as stated above and I
> have complete access to the data on it... Is the ntfs module that
> different? Just curious.

Do you have partitions on that memory stick?

-- 
Alan McKinnon
alan dot mckinnon at gmail dot com
-- 
gentoo-user@lists.gentoo.org mailing list

Re: [gentoo-user] "loopback mount" hard-drive image created with dd?

[Jerry McBride]

On Friday 18 January 2008 01:54:58 pm Alan McKinnon wrote:
> On Friday 18 January 2008, Jerry McBride wrote:
> > On Friday 18 January 2008 01:01:18 pm Alan McKinnon wrote:
> > > Won't work. He already said the .iso is a *disk* image, not a *file
> > > system* image.
> > >
> > > The ntfs driver (or any sane file system driver) will not know what
> > > to do with a block image complete with partition tables and boot
> > > records.
> > >
> > > alan
> >
> > I don't doubt what you wrote, but I've done exactly that many times
> > and never had a problem. Is this some kind of ntfs support issue?
> >
> > Just this morning, I ran dd to make an image of a usbstick I dearly
> > love... I just now mounted the image as vfat as stated above and I
> > have complete access to the data on it... Is the ntfs module that
> > different? Just curious.
>
> Do you have partitions on that memory stick?
>

Yes.


-- 


From the Desk of: Jerome D. McBride
--
gentoo-user@lists.gentoo.org mailing list

Re: [gentoo-user] "loopback mount" hard-drive image created with dd?

[Jerry McBride]

On Friday 18 January 2008 02:19:21 pm Jerry McBride wrote:
> On Friday 18 January 2008 01:54:58 pm Alan McKinnon wrote:
> > On Friday 18 January 2008, Jerry McBride wrote:
> > > On Friday 18 January 2008 01:01:18 pm Alan McKinnon wrote:
> > > > Won't work. He already said the .iso is a *disk* image, not a *file
> > > > system* image.
> > > >
> > > > The ntfs driver (or any sane file system driver) will not know what
> > > > to do with a block image complete with partition tables and boot
> > > > records.
> > > >
> > > > alan
> > >
> > > I don't doubt what you wrote, but I've done exactly that many times
> > > and never had a problem. Is this some kind of ntfs support issue?
> > >
> > > Just this morning, I ran dd to make an image of a usbstick I dearly
> > > love... I just now mounted the image as vfat as stated above and I
> > > have complete access to the data on it... Is the ntfs module that
> > > different? Just curious.
> >
> > Do you have partitions on that memory stick?
>
> Yes.
>


OK... It just got through my dense head! He has "multiple partitions" in his 
disk image, not one....

What I proposed will fail in that case, but will work with "just one" 
partition in the image...

It's a shame too.

Cheers.


-- 


From the Desk of: Jerome D. McBride
--
gentoo-user@lists.gentoo.org mailing list

Re: [gentoo-user] "loopback mount" hard-drive image created with dd?

[Mick]

[-- Attachment #1: Type: text/plain, Size: 1784 bytes --]

On Friday 18 January 2008, Jerry McBride wrote:
> On Friday 18 January 2008 02:19:21 pm Jerry McBride wrote:
> > On Friday 18 January 2008 01:54:58 pm Alan McKinnon wrote:
> > > On Friday 18 January 2008, Jerry McBride wrote:
> > > > On Friday 18 January 2008 01:01:18 pm Alan McKinnon wrote:
> > > > > Won't work. He already said the .iso is a *disk* image, not a *file
> > > > > system* image.
> > > > >
> > > > > The ntfs driver (or any sane file system driver) will not know what
> > > > > to do with a block image complete with partition tables and boot
> > > > > records.
> > > > >
> > > > > alan
> > > >
> > > > I don't doubt what you wrote, but I've done exactly that many times
> > > > and never had a problem. Is this some kind of ntfs support issue?
> > > >
> > > > Just this morning, I ran dd to make an image of a usbstick I dearly
> > > > love... I just now mounted the image as vfat as stated above and I
> > > > have complete access to the data on it... Is the ntfs module that
> > > > different? Just curious.
> > >
> > > Do you have partitions on that memory stick?
> >
> > Yes.
>
> OK... It just got through my dense head! He has "multiple partitions" in
> his disk image, not one....
>
> What I proposed will fail in that case, but will work with "just one"
> partition in the image...
>
> It's a shame too.
>
> Cheers.

I have mounted through loopback USB stick images that I dd onto my hard drive, 
but had no partition table (like a floppy sort of thing).  I am thinking 
aloud here, could the OP chainload the NTFS image using Grub - 
notwithstanding that Vista is using a slightly different booting scheme than 
the WinXP NTLDR.exe?

http://en.wikipedia.org/wiki/Windows_Vista_Startup_Process

-- 
Regards,
Mick

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

[gentoo-user] Re: "loopback mount" hard-drive image created with dd?

[Remy Blank]

[-- Attachment #1: Type: text/plain, Size: 1724 bytes --]

Yahya Mohammad wrote:
> # losetup /dev/loop0 /path/to/diskimage
> # fdisk -l /dev/loop0
> (example)
> Disk /dev/sdb: 160.0 GB, 160041885696 bytes
> 255 heads, 63 sectors/track, 19457 cylinders
> Units = cylinders of 16065 * 512 = 8225280 bytes
> 
>    Device Boot      Start         End      Blocks   Id  System
> /dev/sdb1   *           1        1044     8385898+   c  W95 FAT32 (LBA)
> /dev/sdb2            1045       19457   147902422+  83  Linux

Thanks for the tip! I didn't know you could mount a whole disk image as 
loopback, and see the partition table with fdisk. I always printed the 
partition table before making the disk image.

> I second that, I'm curious to know if it works

It does, I have done it before, but there's a special case for the first 
partition of the disk. According to your output of fdisk, it is supposed 
to start at cylinder 1. However, if you run fdisk with the -u option 
(giving the positions and sizes in sectors), you get the following:

(example)
# fdisk -lu /dev/loop0

Disk /dev/loop0: 10.0 GB, 10056130560 bytes
240 heads, 63 sectors/track, 1299 cylinders, total 19640880 sectors
Units = sectors of 1 * 512 = 512 bytes
Disk identifier: 0xc1afc1af

       Device Boot      Start         End      Blocks   Id  System
/dev/loop0p1   *          63     4097519     2048728+   b  W95 FAT32
/dev/loop0p2         4097520     8195039     2048760    5  Extended
/dev/loop0p5         4097583     8195039     2048728+   b  W95 FAT32

That is, the first partition starts at sector 63, i.e. at an offset 
value of 63 * 512 = 32256.

> oh, and make a backup just in case :)

And mount the filesystem read-only with the "ro" mount option.

-- Remy


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 187 bytes --]

Re: [gentoo-user] Re: "loopback mount" hard-drive image created with dd?

[Tom]

Remy Blank wrote:
> Yahya Mohammad wrote:
>> # losetup /dev/loop0 /path/to/diskimage
>> # fdisk -l /dev/loop0
>> (example)
>> Disk /dev/sdb: 160.0 GB, 160041885696 bytes
>> 255 heads, 63 sectors/track, 19457 cylinders
>> Units = cylinders of 16065 * 512 = 8225280 bytes
>>
>>    Device Boot      Start         End      Blocks   Id  System
>> /dev/sdb1   *           1        1044     8385898+   c  W95 FAT32 (LBA)
>> /dev/sdb2            1045       19457   147902422+  83  Linux
> 
> Thanks for the tip! I didn't know you could mount a whole disk image as 
> loopback, and see the partition table with fdisk. I always printed the 
> partition table before making the disk image.
> 
>> I second that, I'm curious to know if it works
> 
> It does, I have done it before, but there's a special case for the first 
> partition of the disk. According to your output of fdisk, it is supposed 
> to start at cylinder 1. However, if you run fdisk with the -u option 
> (giving the positions and sizes in sectors), you get the following:
> 
> (example)
> # fdisk -lu /dev/loop0
> 
> Disk /dev/loop0: 10.0 GB, 10056130560 bytes
> 240 heads, 63 sectors/track, 1299 cylinders, total 19640880 sectors
> Units = sectors of 1 * 512 = 512 bytes
> Disk identifier: 0xc1afc1af
> 
>       Device Boot      Start         End      Blocks   Id  System
> /dev/loop0p1   *          63     4097519     2048728+   b  W95 FAT32
> /dev/loop0p2         4097520     8195039     2048760    5  Extended
> /dev/loop0p5         4097583     8195039     2048728+   b  W95 FAT32
> 
> That is, the first partition starts at sector 63, i.e. at an offset 
> value of 63 * 512 = 32256.
> 
>> oh, and make a backup just in case :)
> 
> And mount the filesystem read-only with the "ro" mount option.
> 
> -- Remy
> 

Some time ago, I wrote a little script to automate that process, maybe 
it will help you also. (And yes, I know that the code isn't that pretty)

Direct copy & paste:

#!/bin/bash
INFILE="$1"
PARTITION="$2"
MOUNTPOINT="$3"
OPT="$4"

if [ "$INFILE" = "" ] ; then echo "Usage: $0 infile partition mountpoint 
<options>" ; exit ; fi
if [ "$PARTITION" = "" ] ; then echo "Usage: $0 infile partition 
mountpoint <options>" ; exit ; fi
if [ "$MOUNTPOINT" = "" ] ; then echo "Usage: $0 infile partition 
mountpoint <options>" ; exit ; fi

if [ "$OPT" != "" ] ; then OPT2=",${OPT}" ; fi

PSTARTB=`sfdisk -d "$INFILE" | grep "start=" | head -n"$PARTITION" | 
tail -n1 | sed 's/.*start=[ ]*//' | sed 's/,.*//'`
PSTART=$[ $PSTARTB * 512 ]
#PSIZEB=`sfdisk -d "$INFILE" | grep "size=" | head -n4 | tail -n1 | sed 
's/.*size=[ ]*//' | sed 's/,.*//'`
#PSIZE=`echo "$PSIZEB * 512" | bc`
mount "$INFILE" "$MOUNTPOINT" -o loop,offset="$PSTART""$OPT2"
#,sizelimit="$PSIZE""$OPT2"

- Tom
-- 
gentoo-user@lists.gentoo.org mailing list