Restore files from "dd" image
 

Hello.

My old laptop's hard disk damaged, and I tried to get copy from files stored on the hard disk, so I used dd command "dd if=/dev/hda of=/media/usbdisk/files.img conv=noerror" (Thanks for this page http://www.cgsecurity.org/wiki/Damaged_Hard_Disk).

As you saw, I get image from whole hard disk, not only one partition, That's mean the image contain all partitions and boot sector, now I want get files which store in the image file.

I tried qemu to boot to image, GRUB show for me Error 2, so I can't boot.
I tried mount by use this command

the output

again but with -t flag and ext3

the output

the output of dmesg | tail

the output of file files.img

any help please?

I don't think this will actually work for an image of an entire drive, but the image file will look like file type iso9660.
The only way that I can think of to recover your files is to 'dd' the image onto a working drive. That should provide a set of mountable partitions. Unless the drive parameters are identical to the original drive, you will waste a lot of space on the new drive. Naturally, anything previously on the new drive will be lost. If you can acquire a drive as a temporary space to do the recovery, you should be in business.
Maybe someone else has a better idea.
--- rod.

I was in a similar situation and i was told the exact same thing.

I idly-wonder if you could mount the thing with -o loop ?

... with -t iso9660 ....

Will this work for an image of a full drive, rather than a single partition?
--- rod.

No, I don't think it could mount it - you could easily have several partitions there, with possibly different filesystems, so mount could not possibly know what to mount and how. You could maybe mount it if it were an image of a partition, containing one filesystem. But several partitions, including boot sector, is not going to mount. Not sure if you can or how easily you could "chop" the big image into pieces that contained the partitions, and then try to mount them, but I'd say the easiest way you have is to obtain a new drive that has exactly or at least as much space as was on the original one (like said, if the new drive is bigger, you waste the "extra" space as long as you play with that dd image), and dd the image onto that drive. Then you would mount the partitions from that drive (or create new images, whatever), and hope for the best - and when the job was done, repartition/format the drive, to get the whole space in use.

As root issue 'fdisk -l /media/disk/files.img'. Note the device name, start and where it says "512 = n bytes". If an ext3 partition is /media/disk/files.img2 starting at 660 with n = 8225280 you could 'losetup -o$[660*8225280] /dev/loop0 /media/disk/files.img' and then 'mount /dev/loop0 -t ext3 /mnt/somemountpoint'.

If fdisk can parse the image file, perhaps all that needs to be done is a chmod so the image is a block device,and then just mount it.

On the other hand, the dd to a new disk should work. When I replaced the 80Gb HD in my laptop with a 120Gb one, I dd the old drive to a file on a USB drive, pulled it, installed the new drive, booted from the USB drive (which had a bootable Fedora on it), and used dd to copy the image to the new drive. The only tricky part was that I needed to "tweak" the partition table so I could use the whole new drive. (I found the gparted could do it, but kparted and qtparted couldn't.)

You might be interested to know that the image was of a dual-boot (XP, Fedora) system, and that both worked after the transfer. Although I did have to fix C:\BOOT.INI on the XP partition because the "old" partition table entered the partitions in a non-standard order, and the "fixed" partition table corrected the ordering.)

So how do you chmod a file so it magically becomes a block device?

No idea (that's why I said "perhaps"), although the existence of the -o loop= option to the mount command seems to suggest that it should be possible to access he image as a device.

Perhaps a fuse program might be written. (Note, please, the "perhaps.")

If one already exists that's cool, but there's no need. In post #8 I explained how to use fdisk, losetup and mount to access a partition residing in a full "dd" style disk image.

Can this help you? And a question.
 

>mount: wrong fs type, bad option, bad superblock on /dev/loop0,
> missing codepage or helper program, or other error
> In some cases useful info is found in syslog - try
> dmesg | tail or so
>[/code]

Hi! I did experiment with the "dd" command today. Experienced the same situation when I tried mount the image. Found a lot of information on this page which solved the whole issue: http://edseek.com/~jasonb/articles/linux_loopback.html.

Later I did a dd of the usb partition (/dev/sdb1) not the device (/dev/sdb). Then I could mount the image directly without specifying a offset value.

Hmm... Do anyone know of a GUI program for linux which it's possible to browse and copy from a RAW DD image (both from a single partition and a whole disk).

:)-|algeir

I think this will sort of work for me. Actually this gets me part of the way for some other projects I am working on. I do have a question though. I use DD and DCFLDD a lot in my line of work and the one thing that I have to do is split the image files up into chunks of 640MB to 2048MB in order for these images to sit on some of the file systems used by people on my team. That being said is there a way for me to mount this dd images using unSpawn's idea but somehow using 'cat'(or whatever) to create a logical single image file? the files will be like this, DD_sda.OOO DD_sda.001 DD_sda.002 etc. until I manage to get the whole drive imaged. I know how to cat the images back together to get one actual file, but not many file systems like 80gb to 200gb single files.

I think I can do fdisk -l /media/storage/DD_sda.000 on the first file to get the information I need for mounting since that first image file contains the partition table. It seams to me that I would have to create some sort of virtual device or file that represents all of the image files as one device/file, then mount the partition using losetup and loop.

// Please avoid necroposting, e.g, the practice of responding to a thread that died out long ago.

Maybe have a look at TSK / PyFLAG / PTK (as in TSK). TSK has some image management tools (mmls) that might come in handy (see the docs or read sleuthkit.org/informer/ articles) wrt partitions, PyFLAG (advanced IO) can handle chunked EWF (.E01, .E02, et cetera) you can write with either 'linen' or convert with the EWF tools (IIRC) (or FTK Imager) but I don't know TSK/PyFLAG handles mounting split DD images. If you dig that then that kinda answers me thinking about what your could be...

Offset
 

Sorry to reply on this zombie, but I cannot resist. To mount this image you have to use the "offset" extension. Check the man page. If you run fdisk -ul [imagef.ile] on the image you can grab the partitioning information and use the start block = to the offse.

Almost forgot, you have to take the block size x the number of blocks, so if it is 512 like default, just take the start block x 512.

example:

fdisk -lu sda.img
mount -o loop,offset=1048576 -t ext4 /backup/sda.img /old

Did you read the whole thread before posting? Does your post add anything to unSpawn's post #8, above, in this thread? :scratch:

Hi
I not so Familliar with taht extension but I had a crash disk and i use dataresue to save my data . since that a got a dd extension and i dont know how to get those datas back,on google i read those posts. can someone explain me what to do step by step if possible

It turns out there is another solution to this problem, which I have used; kpartx. There once was a very nice blog article with a perfect recipe for using it in this application. I cannot seem to find it at the moment, and the rest of what I can find isn't very illuminating. It is exactly the right tool, though, and I've used it a few times on a disk image dd'd from a multi-partition SD flash card.
--- rod.

I wrote about kpartx here and here aprox half a month after I made my previous post in this thread and there isn't really much more to using the command than that.