Mounting Disk Image in Raw format
While trying to mount a disk image in Raw(dd) format using the following command
mount nps-2010-emails.dd /media/manu/
I get the following error message
mount: you must specify the filesystem type
I know that using -t we can specify the file system but what is the terminology for
a RAW (dd) file, which can be passed as an argument to the mount command. If my method to mount this file system is wrong please help me out in doing the same.
$ file -s nps-2010-emails.dd
nps-2010-emails.dd: x86 boot sector;
partition 1: ID=0xb, starthead 254, startsector 1, 20479 sectors, extended partition table (last)\011, code offset 0x0
$ fdisk -l nps-2010-emails.dd
Disk nps-2010-emails.dd: 10 MB, 10485760 bytes
255 heads, 63 sectors/track, 1 cylinders, total 20480 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x00000000
Device Boot Start End Blocks Id System
nps-2010-emails.dd1 1 20479 10239+ b W95 FAT32
Solution 1:
From http://major.io/2010/12/14/mounting-a-raw-partition-file-made-with-dd-or-dd_rescue-in-linux/, there's a suggestion to use an offset. First obtain the offset via fdisk(8) and then specify it with the offset option to mount. Use fdisk to determine the starting sector of the partition and the sector size. Then calculate offset in bytes using the starting sector number and sector size in bytes. See Mount single partition from image of entire disk (device) for an example.
Finally:
mount -o offset=<offset in bytes> nps-2010-emails.dd /media/manu/
In a typical hard disk, the cells holding the data are grouped. The groupings are called sectors. The way we usually partition things, the first few sectors are kept aside for giving information about the partitions, leaving a gap. So if we have an image of an entire disk, these sectors also get included. Now, the mount command cannot directly start at the first byte, as the partition doesn't start at the first byte. So, we will have to tell mount how many bytes to skip (so that it can avoid the extra information)and get to the actual partition. This is called the offset. Now each sector can store a certain amount of information in bytes, which is called the size of a sector. We take the total size of information that can be stored in this gap by multiplying the size of a sector, with the size of the gap in number of sectors.
From the output of fdisk there, you can see the sector size is 512 bytes and it starts at sector 1. So the offset is 1*512=512. Try the following command:
mount -t vfat -o offset=512 ps-2010-emails.dd /media/manu/
I added the filesystem type since fdisk gave it as FAT32. To mount it for writing as well, use -o offset=512,rw instead.
Solution 2:
You can also have the computer automatically scan all the partitions in a dump and automatically prepare all loop devices, as described here.
So, lets say you dumped your entire /dev/sda into something called sda.img. You can access its partitions as follows:
losetup -f -P sda.img
On my system, it then shows up as follows:
In non-GUI environments, you can list the created device with losetup -l, which will tell you the name of the loop device, example:
# losetup -l
NAME SIZELIMIT OFFSET AUTOCLEAR RO BACK-FILE
/dev/loop0 0 0 0 0 /path/mmcblk0
You can then mount say, the first partition, with:
mount /dev/loop0p1 /mnt/mypartition
Hope that helps.
Solution 3:
Can't add a comment because of lack of reputation, but want to tell to those of you who have GPT disk when testing it with fdisk, use gdsik instead to get start sector and count proper offset. It helped me.
fdisk -l gave me:
Device Boot Start End Blocks Id System
vm2080737.bak1 * 1 3901 31457279+ ee GPT
and it couldn't be mounted with 512 offset with an error 'mount: you must specify the filesystem type'
gdisk -l gave me good result:
Number Start (sector) End (sector) Size Code Name
1 34 545 256.0 KiB A501 gpboot
2 546 993825 485.0 MiB A502 swap
3 993826 62914526 29.5 GiB A503 rootfs