hello all,
i was wondering if there is a way to mount a "raw" filesystem? the device is a portable hdd, and my friend didnt format the hdd. so when i was examining it to the extent that windows lets me, it said that it was a raw filesystem. windows tells me to format the hdd, and linux tells me it doesnt reconize the filesystem. is there anyway i can mount it and get the data off so i can reformat the drive?

Thanks ya'll.

Wow - how did your friend get the data on? Perhaps he streamed it with 'tar' like: tar blah > /dev/hda? You can examine blocks using 'dd' (be extremely careful) to look for signs of what was used - copy a block here and there and use a hex editor (or any tool you wish) to view it. Other tools which I can think of that could have done it include cpio (in which case, like tar, you can recover the contents fairly easily) or even 'dd' (in which case everything is one giant lump with no suitable end-of-file markers).

the guy i got this from doesnt know a lick of computing, so i doubt he knew how to stream data. i used a tool called testdisk and it says that its a NTFS filesystem, but theres also HFS+ and HFSX *things*, im nto sure what they're called. but im makign an image fo the drive so i can attempt to recover his data and he can reformat it or whatever he wants to do with the drive. any other hints or tools i could use?

You can try typical disk or file recovery tools like "magicrescue".

Look at the device with "sudo file -s /dev/sdb" or the image file with "sudo file <imagefile>". If Windows says a filesystem is raw, it means it doesn't recognise the filesystem. I could just mean a Linux filesystem.

For the image file look at "fdisk -ul <imagefile>". Do you see a partition table? Did you image the entire drive or a partition?

If you imaged the entire drive, then you will need to use losetup to create a loop device for mounting the partition. For this you need the correct offset in the offset command. I suggested the -u option for fdisk to avoid rounding errors. The offset needs to be exact. I've usually seen the first partition start at block 63 on XP computers. I have a vista laptop and the first partition for this one starts at 2048. I don't know if that is typical for Vista or just the installation on a Toshiba laptop.

For an image that looks like this, you could use
sudo /sbin/losetup -fs imagefile -o $((63*512))

Then examine the filesystem on the partition.
sudo file -s /dev/loop0

If the file command here or the fdisk -lu earlier indicated an ntfs filesystem, you can try to mount it.
sudo mkdir /mnt/test
sudo mount -t ntfs filename /mnt/test -o ro,loop,uid=<username>,fmask=111,dmask=000

If the image has a partition and you are unable to mount it, try to use photorec or another recovery program on the loop device.
If the mount command doesn't work, run photorec or another recovery program using the loop device.

Problem solved, i used testdisk. thank you for all your help though guys and gals.