7

I've recovered a complete NTFS disk with ddrescue in Linux. The catch is I didn't just rescue the partition (sdX#) but complete disk (sdX) with partition table.

It's really easy to mount disk partitions as loopback devices, but is there a way to mount a partition of a complete disk image in the same way? I can write the image to another disk but I feel it shouldn't be necessary.

8

If you imaged the whole drive you can use offset option with mount command. mmls (from The Sleuth Kit) can show partitions within an image

$ mmls image -b
DOS Partition Table
Offset Sector: 0
Units are in 512-byte sectors

     Slot    Start        End          Length       Size    Description
00:  -----   0000000000   0000000000   0000000001   0512B   Primary Table (#0)
01:  -----   0000000001   0000000031   0000000031   0015K   Unallocated
02:  00:01   0000000032   0001646591   0001646560   0803M   DOS FAT16 (0x06)
03:  00:00   0001646592   0002013183   0000366592   0179M   DOS FAT16 (0x06)

Mount the DOS partition starting at block 32:

sudo mount -o loop,offset=16384 image mnt

(32 multiplied by 512 byte blocks = 16384)

For mounting a typical NTFS partition created by Windows use:

sudo mount -t ntfs -o r,force,loop,offset=32256 image mnt

(63 multiplied by 512 byte blocks = 32256)

  • 4
    Should that really be -o r,... and not, say, -o ro,...? – a CVn Mar 7 '13 at 9:55
2

Another solution is to use losetup to map the image to a block device, then kpartx to scan the loopback device and create block devices for each partition, and then mount those. Something like (untested)

losetup /device/loop0 /path/to/file.img
kpartx /dev/loop0
mount /device/mapper/loop0p1 /mntpath

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.