20

I have a dump of a hard disk. A hard disk recovery company made it for me. I don't know what software they used to make the dump, all I have is a file disk.img.

My only idea to get started was using file:

$ file disk.img 
12693A.img: x86 boot sector; GRand Unified Bootloader, stage1 version 0x3, stage2 address 0x2000, stage2 segment 0x200; partition 1: ID=0xc, starthead 1, startsector 63, 312576642 sectors, code offset 0x48

I guess, if this is a dump of a hard disk, it contains, in the following order a) boot sector b) partition table c) partitions. So I guess the file tool just reads the first part of (any) file, and in this case the first part is a boot sector, though the file contains so much more.

How do I:

1) See the partition table. Not the hex codes, but something human readable about which partitions are on there.

2) How do I see the content of each of the partitions? I guess this is called 'mounting' even though it is not a physical disk and even though I am not interested in changing any files, just seeing the content.

Improve this question
3
  • madduck.net/blog/… <-- this could help
    – Bonsi Scott
    Commented Dec 29, 2013 at 9:24
  • superuser.com/questions/562154/… <- this as well
    – Bonsi Scott
    Commented Dec 29, 2013 at 9:24
  • Another way to look at it, complementary to those discussed here, is to put it into a VM. If you boot from it, you can see whether everything works (GRUB, dual boot, the like. You can also easily update the systems on the disk.img file). If you do not boot from it, you can easily use gparted on it, resie partitions, inspect MBR, ...
    – MariusMatutiae
    Commented Dec 29, 2013 at 10:00

2 Answers 2

Reset to default
26

Since it is a file containing a copy of the entire disk, you can simply treat it like any other block device and run fdisk on it. Given that the disk image is called disk.img, the following command will suffice:

fdisk -l disk.img

This will give output similar to the following:

Disk /home/yjwong/disk.img: 250.1 GB, 250058268160 bytes
255 heads, 63 sectors/track, 30401 cylinders, total 488395055 sectors
Units = sectors of 1 * 512 = 512 bytes

   Device              Boot      Start         End      Blocks   Id  System
/home/yjwong/disk.img1            2048     3905535     1951744   82  Linux swap / Solaris
/home/yjwong/disk.img2   *     3905536   488394751   242244608   83  Linux

To mount the partitions, the Linux kernel allows you to specify an offset (in bytes) to the disk image in the mount command. You need to loop-mount the partitions within the disk image. However, since fdisk specifies the start offset in sectors, you will need to multiply the given offset by the sector size (typically 512).

To mount the second partition the example above, the offset is 3905536 * 512 = 1999634432.

The following command will do the trick, assuming the partition type is ext4, and /mnt is the intended mount point:

sudo mount -t ext4 /home/yjwong/disk.img /mnt -o loop,offset=1999634432

If you want to view the content in a read-only manner, you can add ro to the mount options:

sudo mount -t ext4 /home/yjwong/disk.img /mnt -o loop,offset=1999634432,ro
Improve this answer
2
-3

.img is a filetype that is known in mime.

mimeopen <file>.img

will present you with sensible choices. In a case of an image to be flashed onto an sdcard to boot ubuntu from, and it was mounted on

/media/$USER

Apparently he started application/x-raw-disk-image
It is likely a system will adapt the commands, so I expect this technique too age well.

Improve this answer
1
  • 1
    Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center.
    – Community Bot
    Commented Apr 7, 2023 at 11:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .