$ dd if=/dev/sdb of=sdb.img
to mount the image, you need losetup
$ losetup /dev/loop1 sdb.img
remember /dev/loop1 is the entire disk, not a partition, so you cannot mount it directly to your file system. now find out where its partition is
$ parted /dev/loop1 unit B print
Model: Unknown (unknown)
Disk /dev/loop1: 4005527551B
Sector size (logical/physical): 512B/512B
Partition Table: msdos
Number Start End Size Type File system Flags
1 32256B 4004904959B 4004872704B primary ext3
Information: Don't forget to update /etc/fstab, if necessary.
This tells us that the first partition starts at offset 32256
$ losetup -o 32256 /dev/loop2 /dev/loop1
mount the partition that we just setup as /dev/loop2
$ mount /dev/looop2 /mnt/tmp
You should see your file system, and you can modify it. Please remember to umount and sync so that the image can be copied back to a hard disk, which in my case is really a usb stick. This technique is quite useful for data recovery, virtualization, and so on.
No comments:
Post a Comment