new blog post

_posts/2021-04-13-mounting-partitions-from-disk-images.md

@@ -0,0 +1,68 @@
+---
+layout: post
+title: Mounting partitions from disk images
+date: 2021-04-13 19:37:00
+tags: untagged
+author: neko
+---
+
+# Preface
+
+Sometimes you run across some situation, knowing you have solved this problem before, although ages ago, and just can't remember how to do it. This is one of these cases. It's not often that you need to mount specifically a particular partition from a disk image, but this can provide useful for data recovery purposes or even if just to look around in the image.
+
+Assuming you got a full disk image, created i.e. via `dd`, you can specify an offset to the mount command to tell mount at which point to find the partition you want to mount.
+
+Mind: the method using `losetup` below can also be used to attach the whole disk image as block device.
+
+## Mounting via `mount`
+
+First, determine if your image has a valid partition table at all by using `fdisk -l <image>`. If this is broken already, you might need to fix that first with tools like `testdisk`, unless you happen to remember the exact sector your partition starts at.
+
+```
+root@nas:~# fdisk -l image.bin
+Disk image.bin: 111.8 GiB, 120034123776 bytes, 234441648 sectors
+Units: sectors of 1 * 512 = 512 bytes
+Sector size (logical/physical): 512 bytes / 512 bytes
+I/O size (minimum/optimal): 512 bytes / 512 bytes
+Disklabel type: dos
+Disk identifier: 0xc688913a
+
+Device     Boot     Start       End   Sectors  Size Id Type
+image.bin1  *         2048 215881727 215879680  103G 83 Linux
+image.bin2       217980926 234440703  16459778  7.9G  5 Extended
+image.bin3       215881728 217978879   2097152    1G 83 Linux
+image.bin5       217980928 234440703  16459776  7.9G 82 Linux swap / Solaris
+
+Partition table entries are not in disk order.
+```
+
+From the output we can determine that this drive is using a 512-byte sector size[^1], this is important for calculating the needed offset for `mount`: Multiply the start sector of the partition by the sector size, and you will find what byte the partition starts at.
+
+```
+Partition /dev/sdd1 starts at sector: 2048 (from fdisk output)
+Sector size: 512 byte
+
+Resulting bytecount, start-sector times sector size: 1048576
+```
+
+Finally, mount the partition:
+
+```
+mount image.bin -o offset=$1048576
+```
+
+Should the mount command return `invalid argument`, proceed with `losetup` method.
+
+[^1]: Look for the line containing `Units: sectors of 1 * 512 = 512 bytes`
+
+## Mounting via `losetup`
+
+In case your image is broken beyond recognition as a disk image, you may still be able to scrape off data by mounting the image as a block device. This can be achieved with `losetup`:[^2]
+
+```
+losetup -o $OFFSET /dev/loop0 image.bin
+```
+
+This will allow you to use the image as if it is an attached disk, although via the loop device `/dev/loop0`
+
+[^2]: For this, calculate the offset as mentioned above.