Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a dump of a hard disk. A hard disk recovery company made it for me. I don't know what software they used to make the dump, all I have is a file disk.img.

My only idea to get started was using file:

$ file disk.img 
12693A.img: x86 boot sector; GRand Unified Bootloader, stage1 version 0x3, stage2 address 0x2000, stage2 segment 0x200; partition 1: ID=0xc, starthead 1, startsector 63, 312576642 sectors, code offset 0x48

I guess, if this is a dump of a hard disk, it contains, in the following order a) boot sector b) partition table c) partitions. So I guess the file tool just reads the first part of (any) file, and in this case the first part is a boot sector, though the file contains so much more.

How do I:

1) See the partition table. Not the hex codes, but smth human readable about which partitions are on there.

2) How do I see the content of each of the partitions? I guess this is called 'mounting' even though it is not a physical disk and even though I am not interested in changing any files, just seeing the content.

share|improve this question
    
madduck.net/blog/… <-- this could help –  Bonsi Scott Dec 29 '13 at 9:24
    
superuser.com/questions/562154/… <- this as well –  Bonsi Scott Dec 29 '13 at 9:24
    
Another way to look at it, complementary to those discussed here, is to put it into a VM. If you boot from it, you can see whether everything works (GRUB, dual boot, the like. You can also easily update the systems on the disk.img file). If you do not boot from it, you can easily use gparted on it, resie partitions, inspect MBR, ... –  MariusMatutiae Dec 29 '13 at 10:00
add comment

1 Answer

up vote 7 down vote accepted

Since it is a file containing a copy of the entire disk, you can simply treat it like any other block device and run fdisk on it. Given that the disk image is called disk.img, the following command will suffice:

fdisk -l disk.img

This will give output similar to the following:

Disk /home/yjwong/disk.img: 250.1 GB, 250058268160 bytes
255 heads, 63 sectors/track, 30401 cylinders, total 488395055 sectors
Units = sectors of 1 * 512 = 512 bytes

   Device              Boot      Start         End      Blocks   Id  System
/home/yjwong/disk.img1            2048     3905535     1951744   82  Linux swap / Solaris
/home/yjwong/disk.img2   *     3905536   488394751   242244608   83  Linux

To mount the partitions, the Linux kernel allows you to specify an offset (in bytes) to the disk image in the mount command. You need to loop-mount the partitions within the disk image. However, since fdisk specifies the start offset in sectors, you will need to multiply the given offset by the sector size (typically 512).

To mount the second partition the example above, the offset is 3905536 * 512 = 1999634432.

The following command will do the trick, assuming the partition type is ext4, and /mnt is the intended mount point:

sudo mount -t ext4 /home/yjwong/disk.img /mnt -o loop,offset=1999634432

If you want to view the content in a read-only manner, you can add ro to the mount options:

sudo mount -t ext4 /home/yjwong/disk.img /mnt -o loop,offset=1999634432,ro
share|improve this answer
1  
Isn't that the offset necessary to mount the swap partition? I would try 3905536*512 instead. –  MariusMatutiae Dec 29 '13 at 9:51
    
Oops, made a mistake. Corrected it. Thanks! –  yjwong Dec 29 '13 at 9:57
    
Worked smoothly, thanks :) –  Mads Skjern Dec 29 '13 at 10:18
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.