I created a dd image of a partition (containing an HFS+ FS) of one of my disks (and not the entire disk) a few days ago using the following command -

dd conv=sync,noerror bs=8k if=/dev/sdc2 of=/path/to/img

How can I mount it? I tried the following but it doesn't work -

mount -o loop,ro -t hfsplus /path/to/img /path/to/mntDir

It gives me

mount: wrong fs type, bad option, bad superblock on /dev/loop1,
       missing codepage or helper program, or other error
       In some cases useful info is found in syslog - try
       dmesg | tail or so

and dmesg | tail gives me -

[5248455.568479] hfs: invalid secondary volume header
[5248455.568494] hfs: unable to find HFS+ superblock
[5248462.674836] hfs: invalid secondary volume header
[5248462.674843] hfs: unable to find HFS+ superblock
[5248550.672105] hfs: invalid secondary volume header
[5248550.672115] hfs: unable to find HFS+ superblock
[5248993.612026] hfs: unable to find HFS+ superblock
[5248998.103385] hfs: unable to find HFS+ superblock
[5249031.441359] hfs: unable to find HFS+ superblock
[5249036.274864] hfs: unable to find HFS+ superblock

Is there something wrong that I am doing?

I tried searching on how to do this but all the results I get only talk about mounting a partition from within a full disk image, using the offset option with mount - none talk about the case where the image itself is that of a partition.


PS: I'm running 64bit Arch Linux, and the partition from the original disk /dev/sdc2 mounts fine.

  • Is your original harddisk still available? Have you read this article already? viaforensics.com/computer-forensics/… – JohannesM Oct 17 '12 at 10:06
  • I just did. That again uses a full-disk image and an offset value passed to the mount command to choose a partition within. In my case the image is 1 partition alone. – 0cd Oct 17 '12 at 10:45
  • I notice you are using noerror in your dd line. How many unreadable sectors did the source disk have—one may have hit something critical. Especially with the 8k block size (the disk is probably 512b or at most 4k). Does the source disk mount? – derobert Oct 17 '12 at 20:01
  • interesting. I'm not sure if the source disk has any unreadable sectors. It mounts without issues and I am able to access the files on it. – 0cd Oct 17 '12 at 21:40

You might first have to use losetup to create a device from your file, and then mount that device. Here's what I do to mount a backup file with partition image inside:

losetup /dev/loop1 /home/backup-file
mount /dev/loop1 /mnt/backup 

My partition then appears under /mnt/backup, and the original file is /home/backup-file. Maybe you can do this all with "mount -o loop" but I haven't been successful with that, so I'm using losetup separately.

After I'm finished, I umount the partition and then delete the loop with "losetup -d /dev/loop1", just in case.

Also, you can use losetup to find out what loop device is currently free in your system, with losetup -f

Let me know if this works.

| improve this answer | |
  • 2
    mount -o loop internally automatically allocates a loopback device so manually assigning the image to a loopback device is extra, unneeded work. – Dario Russo Oct 17 '12 at 16:50
  • thanks for the information. but spyroboy is right - mount does internally allocate a loopback device. – 0cd Oct 17 '12 at 21:41
  • Yes, I suspected as much, although I had a similar problem to yours and I solved it with doing it by hand, i.e. assigning the loop device with losetup. In any case, maybe it will help you to pinpoint the problem. – Piotr Kempa Oct 19 '12 at 10:11

running mount -o loop should accomplish what you want it to do but, clearly, it's not.

this leads me to believe that the filesystem driver you're trying to use isn't working properly.

this might be a stretch and I don't know how HFS+ works .. but is it possible that HFS+ stores partitions within partitions? maybe similar to LVM?

another thing that comes to mind is encryption. it seems as though HFS+ partitions can be encrypted. does this ring any bells for you?

| improve this answer | |
  • not sure about internals of HFS+, but the partition is definitely not encrypted. Infact I still have the original disk and the partition from that mounts fine. – 0cd Oct 17 '12 at 21:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.