9

Input: RAW/DD Image of an HDD. fdisk -l shows partitions

fdisk -l image.dd 
Disk image.dd: 15 GiB, 16106127360 bytes, 31457280 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x00093f57

Device            Boot  Start      End  Sectors  Size Id Type
image-1.dd1 *      2048   499711   497664  243M 83 Linux
image-1.dd2      501758 31455231 30953474 14.8G  5 Extended
image-1.dd5      501760 31455231 30953472 14.8G 8e Linux LVM

Trying to mount it using start-sector*sector size (as described here; common for mounting partitions) brings error

(„mount: /mnt/vmdisk: unknown filesystem type 'LVM2_member'.“

The most sufficent solutions can be found here using lvm2 tools like vgscan, vgchange, lvs; but these tools does not have an option to scan in a raw file for these volumes.

So how would it be possible to access the content of the Linux LVM using mount or something similar?

2
  • @KamilMaciorowski Thanks!! That was the final step which was missing - Included your step in the overall answer below :)
    – gies0r
    Nov 19, 2018 at 13:25
  • This is the second post I've seen doing this - there is no need to use sudo for running fdisk against a disk image file (assuming your user has read access to the file). Running sudo when you don't have to can be dangerous... Apr 21, 2021 at 11:26

1 Answer 1

16

Install kpartx

sudo apt-get install kpartx

Integrate the volumes in dev/mapper using

sudo kpartx -a -v image.dd

Check dev/mapper to see your partitions

administrator@cdc-ansible:~$ ls -l /dev/mapper/
total 0
lrwxrwxrwx 1 root root       7 Nov 19 12:50 123--yourname--ewu--vg-root -> ../dm-3
lrwxrwxrwx 1 root root       7 Nov 19 12:50 123--yourname--ewu--vg-swap_1 -> ../dm-4
crw------- 1 root root 10, 236 Nov 19 07:59 control
lrwxrwxrwx 1 root root       7 Nov 19 12:50 loop2p1 -> ../dm-0
lrwxrwxrwx 1 root root       7 Nov 19 12:50 loop2p2 -> ../dm-1
lrwxrwxrwx 1 root root       7 Nov 19 12:50 loop2p5 -> ../dm-2

Afterwards sudo lvscanto find the name of the lv's:

sudo lvscan
  ACTIVE            '/dev/123--yourname--ewu--vg/root' [12.71 GiB] inherit
  ACTIVE            '/dev/123--yourname--ewu--vg/swap_1' [<2.00 GiB] inherit

Try to mount it again:

sudo mount /dev/123--yourname--ewu--vg/root /mnt/rootfs 

The mounted file system (tada!):

ll /mnt/rootfs/
total 116
drwxr-xr-x  22 root root  4096 Oct 30 09:37 ./
drwxr-xr-x   5 root root  4096 Nov 19 12:59 ../
drwxr-xr-x   2 root root  4096 Oct 30 09:35 bin/
drwxr-xr-x   2 root root  4096 Sep 28  2015 boot/
drwxr-xr-x   4 root root  4096 Sep 28  2015 dev/
drwxr-xr-x 102 root root 12288 Oct 30 09:37 etc/
drwxr-xr-x   4 root root  4096 Nov 11  2016 home/
drwxr-xr-x  22 root root  4096 Nov 24  2017 lib/
drwxr-xr-x   2 root root  4096 Feb  2  2018 lib64/
drwx------   2 root root 16384 Sep 28  2015 lost+found/
drwxr-xr-x   4 root root  4096 Sep 28  2015 media/
drwxr-xr-x   2 root root  4096 Nov 24  2017 mnt/
drwxr-xr-x   3 root root  4096 Aug 26  2016 opt/
drwxr-xr-x   2 root root  4096 Apr 10  2014 proc/
drwx------   7 root root  4096 Oct  9 10:08 root/
drwxr-xr-x   2 root root  4096 Sep 28  2015 run/
drwxr-xr-x   2 root root 12288 Oct 30 09:35 sbin/
drwxr-xr-x   2 root root  4096 Jul 22  2014 srv/
drwxr-xr-x   2 root root  4096 Mar 13  2014 sys/
drwxrwxrwt   8 root root  4096 Oct 30 09:43 tmp/
drwxr-xr-x  10 root root  4096 Sep 28  2015 usr/
drwxr-xr-x  12 root root  4096 Sep 28  2015 var/
lrwxrwxrwx   1 root root    30 Oct 30 09:36 vmlinuz -> boot/vmlinuz-4.4.0-137-generic

Thanks to these sources 1 2 3

And by the way, if you are coming from another image type (such as VMDK,VDI,...) use this link to convert it to DD.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .