LinuxQuestions.org
Help answer threads with 0 replies.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Hardware
User Name
Password
Linux - Hardware This forum is for Hardware issues.
Having trouble installing a piece of hardware? Want to know if that peripheral is compatible with Linux?

Notices



Reply
 
Search this Thread
Old 09-05-2008, 07:40 AM   #1
Predatorian
Member
 
Registered: Mar 2008
Location: currently, where ever the army takes me
Distribution: Debian Lenny/Ubuntu or Arch Linux
Posts: 143

Rep: Reputation: 26
Mounting a "raw" filesystem that has information on it


hello all,
i was wondering if there is a way to mount a "raw" filesystem? the device is a portable hdd, and my friend didnt format the hdd. so when i was examining it to the extent that windows lets me, it said that it was a raw filesystem. windows tells me to format the hdd, and linux tells me it doesnt reconize the filesystem. is there anyway i can mount it and get the data off so i can reformat the drive?

Thanks ya'll.
 
Old 09-05-2008, 08:23 AM   #2
pinniped
Senior Member
 
Registered: May 2008
Location: planet earth
Distribution: Debian
Posts: 1,732

Rep: Reputation: 50
Wow - how did your friend get the data on? Perhaps he streamed it with 'tar' like: tar blah > /dev/hda? You can examine blocks using 'dd' (be extremely careful) to look for signs of what was used - copy a block here and there and use a hex editor (or any tool you wish) to view it. Other tools which I can think of that could have done it include cpio (in which case, like tar, you can recover the contents fairly easily) or even 'dd' (in which case everything is one giant lump with no suitable end-of-file markers).
 
Old 09-06-2008, 12:07 AM   #3
Predatorian
Member
 
Registered: Mar 2008
Location: currently, where ever the army takes me
Distribution: Debian Lenny/Ubuntu or Arch Linux
Posts: 143

Original Poster
Rep: Reputation: 26
the guy i got this from doesnt know a lick of computing, so i doubt he knew how to stream data. i used a tool called testdisk and it says that its a NTFS filesystem, but theres also HFS+ and HFSX *things*, im nto sure what they're called. but im makign an image fo the drive so i can attempt to recover his data and he can reformat it or whatever he wants to do with the drive. any other hints or tools i could use?
 
Old 09-06-2008, 03:00 AM   #4
pinniped
Senior Member
 
Registered: May 2008
Location: planet earth
Distribution: Debian
Posts: 1,732

Rep: Reputation: 50
You can try typical disk or file recovery tools like "magicrescue".
 
Old 09-06-2008, 03:30 AM   #5
jschiwal
Guru
 
Registered: Aug 2001
Location: Fargo, ND
Distribution: SuSE AMD64
Posts: 15,733

Rep: Reputation: 655Reputation: 655Reputation: 655Reputation: 655Reputation: 655Reputation: 655
Look at the device with "sudo file -s /dev/sdb" or the image file with "sudo file <imagefile>". If Windows says a filesystem is raw, it means it doesn't recognise the filesystem. I could just mean a Linux filesystem.

For the image file look at "fdisk -ul <imagefile>". Do you see a partition table? Did you image the entire drive or a partition?

If you imaged the entire drive, then you will need to use losetup to create a loop device for mounting the partition. For this you need the correct offset in the offset command. I suggested the -u option for fdisk to avoid rounding errors. The offset needs to be exact. I've usually seen the first partition start at block 63 on XP computers. I have a vista laptop and the first partition for this one starts at 2048. I don't know if that is typical for Vista or just the installation on a Toshiba laptop.

Code:
jschiwal@hpmedia:~> sudo /sbin/fdisk -lu /dev/sdb

Disk /dev/sdb: 250.0 GB, 250059350016 bytes
255 heads, 63 sectors/track, 30401 cylinders, total 488397168 sectors
Units = sectors of 1 * 512 = 512 bytes
Disk identifier: 0xcab10bee

   Device Boot      Start         End      Blocks   Id  System
/dev/sdb1   *          63   174160664    87080301    7  HPFS/NTFS
/dev/sdb2       174160665   469917314   147878325    f  W95 Ext'd (LBA)
/dev/sdb3       469929600   488391119     9230760    c  W95 FAT32 (LBA)
Partition 3 does not end on cylinder boundary.
/dev/sdb5       174160728   469917314   147878293+  83  Linux
For an image that looks like this, you could use
sudo /sbin/losetup -fs imagefile -o $((63*512))

Then examine the filesystem on the partition.
sudo file -s /dev/loop0

If the file command here or the fdisk -lu earlier indicated an ntfs filesystem, you can try to mount it.
sudo mkdir /mnt/test
sudo mount -t ntfs filename /mnt/test -o ro,loop,uid=<username>,fmask=111,dmask=000

If the image has a partition and you are unable to mount it, try to use photorec or another recovery program on the loop device.
If the mount command doesn't work, run photorec or another recovery program using the loop device.

Last edited by jschiwal; 09-06-2008 at 03:42 AM.
 
Old 09-10-2008, 06:20 AM   #6
Predatorian
Member
 
Registered: Mar 2008
Location: currently, where ever the army takes me
Distribution: Debian Lenny/Ubuntu or Arch Linux
Posts: 143

Original Poster
Rep: Reputation: 26
Problem solved, i used testdisk. thank you for all your help though guys and gals.
 
  


Reply

Tags
file, filesystem, mounting, raw, system


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
[ Empty or malformed message. Use "H" to see raw text. ] - Pine Problem indian Linux - Networking 0 03-28-2007 03:47 AM
"mounting smb filesystem" freezes at startup process on Mandrake 10.0 checho4 Linux - Networking 1 02-19-2007 05:52 PM
How to boot "raw iso cd image?" jerrybasham Linux - General 9 08-24-2006 05:20 PM
"RAW" tape dump/read in Mandrake 9.2? Bob Ross Mandriva 2 01-21-2004 08:15 PM
"permission denied" when I try to send raw data to the sound device. Travis86 Linux - Hardware 2 10-29-2003 10:08 AM


All times are GMT -5. The time now is 10:06 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration