8

I've recovered a complete NTFS disk with ddrescue in Linux. The catch is I didn't just rescue the partition (sdX#) but complete disk (sdX) with partition table.

It's really easy to mount disk partitions as loopback devices, but is there a way to mount a partition of a complete disk image in the same way? I can write the image to another disk but I feel it shouldn't be necessary.

Improve this question

2 Answers 2

Reset to default
9

If you imaged the whole drive you can use offset option with mount command. mmls (from The Sleuth Kit) can show partitions within an image

$ mmls image -b
DOS Partition Table
Offset Sector: 0
Units are in 512-byte sectors

     Slot    Start        End          Length       Size    Description
00:  -----   0000000000   0000000000   0000000001   0512B   Primary Table (#0)
01:  -----   0000000001   0000000031   0000000031   0015K   Unallocated
02:  00:01   0000000032   0001646591   0001646560   0803M   DOS FAT16 (0x06)
03:  00:00   0001646592   0002013183   0000366592   0179M   DOS FAT16 (0x06)

Mount the DOS partition starting at block 32:

sudo mount -o loop,offset=16384 image mnt

(32 multiplied by 512 byte blocks = 16384)

For mounting a typical NTFS partition created by Windows use:

sudo mount -t ntfs -o r,force,loop,offset=32256 image mnt

(63 multiplied by 512 byte blocks = 32256)

Improve this answer
3
  • 4
    Should that really be -o r,... and not, say, -o ro,...?
    – user
    Mar 7, 2013 at 9:55
  • In 2022 that first call to mmls fails because option -b requires a block size. To show the table, just use mmls image-file.
    – Gerhardh
    May 3, 2022 at 6:33
  • if you are mounting multiple partitions from the same disk image file, you should also specify ,sizelimit=X so you don't get overlapping loop device exists errors.
    – andresp
    Apr 5 at 16:18
3

Another solution is to use losetup to map the image to a block device, then kpartx to scan the loopback device and create block devices for each partition, and then mount those. Something like (untested)

losetup /device/loop0 /path/to/file.img
kpartx /dev/loop0
mount /device/mapper/loop0p1 /mntpath
Improve this answer
1
  • For anyone trying to use this method at 2022, kpartx should be used as kpartx -a /dev/loop0.
    – FooBar
    Apr 8, 2022 at 12:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .