If it is an image of an entire drive, you can also just use parted to view the size and offset of the partitions within.
parted BackupImg.dd It will complain about it being read only, of course, but it will still show the required information. You can then either mount as Tim mentioned or use dd with the offset and count to extract the partitions to separate files. Then, they can be directly mounted using the loop option, if that would be better for your purpose. I did some of this in a Digital Forensics class last quarter and probably still have the lab/notes from it if you would like a more explicit walk through. Jason On Sun, Feb 6, 2011 at 11:11 AM, Tim <[email protected]> wrote: > Hi Rich, > > > I have a 1.2G data file as a disk image (*.img). What tools are > available > > for converting this to the underlying file(s)? I tried mounting it (as > root > > to /mnt/dvd) but without success. > > What kind of disk image is it? You mentioned /mnt/dvd ... is it a DVD > image/iso? If it is a hard drive image, then most likely the easiest > way would be to mount the partition(s) within the disk. > > Once you figure out what byte offset your partitions start at, you can > mount them by doing (as root): > > # losetup -o ${OFFSET} /dev/loop0 /path/to/disk.img > # mount /dev/loop0 /partition/mount/point > > To figure out the offset, there are several ways. You can use > 'fdisk -l ...', but I find it cumbersome. If you install the > sleuthkit, it will provide a nice utility called 'mmls' which lists > partition tables. The offset output is always in 512 byte blocks. > Often the first partition on PCs is at block offset 63, so you might > find yourself running: > > # losetup -o $((63*512)) /dev/loop0 /path/to/disk.img > > > > An alternative approach to this is to instead load the kernel's > "loop" module with a non-zero max_part parameter. Then you can create > the loopback device without any offset parameter: > > # losetup /dev/loop0 /path/to/disk.img > > And from there, the kernel should automatically detect the partitions > and create extra devices named: /dev/loop0pN where 'N' is the > partition number (much like /dev/sda provides partitions /dev/sdaN). > Then you can just mount the /dev/loop0pN devices as you see fit. > > > HTH, > tim > _______________________________________________ > PLUG mailing list > [email protected] > http://lists.pdxlinux.org/mailman/listinfo/plug > _______________________________________________ PLUG mailing list [email protected] http://lists.pdxlinux.org/mailman/listinfo/plug
