LinuxQuestions.org
Visit the LQ Articles and Editorials section
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - General
User Name
Password
Linux - General This Linux forum is for general Linux questions and discussion.
If it is Linux Related and doesn't seem to fit in any other forum then this is the place.

Notices

Reply
 
LinkBack Search this Thread
Old 02-05-2008, 06:55 PM   #1
MaaSTaaR
Member
 
Registered: Aug 2005
Location: Kuwait
Distribution: OpenSuSE
Posts: 40

Rep: Reputation: 15
Restore files from "dd" image


Hello.

My old laptop's hard disk damaged, and I tried to get copy from files stored on the hard disk, so I used dd command "dd if=/dev/hda of=/media/usbdisk/files.img conv=noerror" (Thanks for this page http://www.cgsecurity.org/wiki/Damaged_Hard_Disk).

As you saw, I get image from whole hard disk, not only one partition, That's mean the image contain all partitions and boot sector, now I want get files which store in the image file.

I tried qemu to boot to image, GRUB show for me Error 2, so I can't boot.
I tried mount by use this command

Code:
maastaar@maastaar-laptop:~$ sudo mount /media/disk/files.img /mnt/ -o loop
the output

Code:
[sudo] password for maastaar:
mount: you must specify the filesystem type
again but with -t flag and ext3

Code:
maastaar@maastaar-laptop:~$ sudo mount /media/disk/files.img /mnt/ -o loop -t ext3
the output

Code:
mount: wrong fs type, bad option, bad superblock on /dev/loop0,
       missing codepage or helper program, or other error
       In some cases useful info is found in syslog - try
       dmesg | tail  or so
the output of dmesg | tail

Code:
maastaar@maastaar-laptop:~$ dmesg | tail
[   28.028000] NET: Registered protocol family 17
[   29.588000] NET: Registered protocol family 10
[   29.588000] lo: Disabled Privacy Extensions
[   40.440000] eth0: no IPv6 routers present
[   45.340000] kjournald starting.  Commit interval 5 seconds
[   45.340000] EXT3-fs warning: maximal mount count reached, running e2fsck is recommended
[   45.380000] EXT3 FS on sdb1, internal journal
[   45.380000] EXT3-fs: mounted filesystem with ordered data mode.
[  763.900000] loop: module loaded
[  830.584000] VFS: Can't find ext3 filesystem on dev loop0.
the output of file files.img

Code:
maastaar@maastaar-laptop:/media/disk$ file files.img 
files.img: x86 boot sector, LInux i386 boot LOader; partition 2: ID=0xf, starthead 254, startsector 39070080, 39070080 sectors, code offset 0x48
any help please?
 
Old 02-05-2008, 07:04 PM   #2
theNbomr
LQ 5k Club
 
Registered: Aug 2005
Distribution: OpenSuse, Fedora, Redhat, Debian
Posts: 5,390
Blog Entries: 2

Rep: Reputation: 900Reputation: 900Reputation: 900Reputation: 900Reputation: 900Reputation: 900Reputation: 900Reputation: 900
I don't think this will actually work for an image of an entire drive, but the image file will look like file type iso9660.
The only way that I can think of to recover your files is to 'dd' the image onto a working drive. That should provide a set of mountable partitions. Unless the drive parameters are identical to the original drive, you will waste a lot of space on the new drive. Naturally, anything previously on the new drive will be lost. If you can acquire a drive as a temporary space to do the recovery, you should be in business.
Maybe someone else has a better idea.
--- rod.

Last edited by theNbomr; 02-06-2008 at 08:48 AM. Reason: fix typo
 
Old 02-05-2008, 09:06 PM   #3
cygnus-x1
Member
 
Registered: Jul 2006
Location: Crisfield
Distribution: Slackware, CentOS, RedHat
Posts: 159

Rep: Reputation: 15
I was in a similar situation and i was told the exact same thing.
 
Old 02-05-2008, 09:54 PM   #4
sundialsvcs
Guru
 
Registered: Feb 2004
Location: SE Tennessee, USA
Distribution: Gentoo, LFS
Posts: 5,054

Rep: Reputation: 954Reputation: 954Reputation: 954Reputation: 954Reputation: 954Reputation: 954Reputation: 954Reputation: 954
I idly-wonder if you could mount the thing with -o loop ?
 
Old 02-05-2008, 10:39 PM   #5
syg00
LQ Veteran
 
Registered: Aug 2003
Location: Australia
Distribution: Lots ...
Posts: 11,809

Rep: Reputation: 923Reputation: 923Reputation: 923Reputation: 923Reputation: 923Reputation: 923Reputation: 923Reputation: 923
... with -t iso9660 ....
 
Old 02-06-2008, 08:48 AM   #6
theNbomr
LQ 5k Club
 
Registered: Aug 2005
Distribution: OpenSuse, Fedora, Redhat, Debian
Posts: 5,390
Blog Entries: 2

Rep: Reputation: 900Reputation: 900Reputation: 900Reputation: 900Reputation: 900Reputation: 900Reputation: 900Reputation: 900
Quote:
Originally Posted by syg00 View Post
... with -t iso9660 ....
Will this work for an image of a full drive, rather than a single partition?
--- rod.
 
Old 02-06-2008, 09:14 AM   #7
b0uncer
Guru
 
Registered: Aug 2003
Distribution: CentOS, OS X
Posts: 5,131

Rep: Reputation: Disabled
No, I don't think it could mount it - you could easily have several partitions there, with possibly different filesystems, so mount could not possibly know what to mount and how. You could maybe mount it if it were an image of a partition, containing one filesystem. But several partitions, including boot sector, is not going to mount. Not sure if you can or how easily you could "chop" the big image into pieces that contained the partitions, and then try to mount them, but I'd say the easiest way you have is to obtain a new drive that has exactly or at least as much space as was on the original one (like said, if the new drive is bigger, you waste the "extra" space as long as you play with that dd image), and dd the image onto that drive. Then you would mount the partitions from that drive (or create new images, whatever), and hope for the best - and when the job was done, repartition/format the drive, to get the whole space in use.
 
Old 02-06-2008, 09:58 AM   #8
unSpawn
Moderator
 
Registered: May 2001
Posts: 26,534
Blog Entries: 51

Rep: Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604
As root issue 'fdisk -l /media/disk/files.img'. Note the device name, start and where it says "512 = n bytes". If an ext3 partition is /media/disk/files.img2 starting at 660 with n = 8225280 you could 'losetup -o$[660*8225280] /dev/loop0 /media/disk/files.img' and then 'mount /dev/loop0 -t ext3 /mnt/somemountpoint'.
 
Old 02-06-2008, 12:23 PM   #9
PTrenholme
Senior Member
 
Registered: Dec 2004
Location: Olympia, WA, USA
Distribution: Fedora, (K)Ubuntu
Posts: 4,141

Rep: Reputation: 329Reputation: 329Reputation: 329Reputation: 329
If fdisk can parse the image file, perhaps all that needs to be done is a chmod so the image is a block device,and then just mount it.

On the other hand, the dd to a new disk should work. When I replaced the 80Gb HD in my laptop with a 120Gb one, I dd the old drive to a file on a USB drive, pulled it, installed the new drive, booted from the USB drive (which had a bootable Fedora on it), and used dd to copy the image to the new drive. The only tricky part was that I needed to "tweak" the partition table so I could use the whole new drive. (I found the gparted could do it, but kparted and qtparted couldn't.)

You might be interested to know that the image was of a dual-boot (XP, Fedora) system, and that both worked after the transfer. Although I did have to fix C:\BOOT.INI on the XP partition because the "old" partition table entered the partitions in a non-standard order, and the "fixed" partition table corrected the ordering.)

Last edited by PTrenholme; 02-06-2008 at 12:26 PM. Reason: Typos
 
Old 02-06-2008, 04:56 PM   #10
unSpawn
Moderator
 
Registered: May 2001
Posts: 26,534
Blog Entries: 51

Rep: Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604
Quote:
Originally Posted by PTrenholme View Post
perhaps all that needs to be done is a chmod so the image is a block device
So how do you chmod a file so it magically becomes a block device?
 
Old 02-06-2008, 05:57 PM   #11
PTrenholme
Senior Member
 
Registered: Dec 2004
Location: Olympia, WA, USA
Distribution: Fedora, (K)Ubuntu
Posts: 4,141

Rep: Reputation: 329Reputation: 329Reputation: 329Reputation: 329
Quote:
Originally Posted by unSpawn View Post
So how do you chmod a file so it magically becomes a block device?
No idea (that's why I said "perhaps"), although the existence of the -o loop= option to the mount command seems to suggest that it should be possible to access he image as a device.

Perhaps a fuse program might be written. (Note, please, the "perhaps.")

Last edited by PTrenholme; 02-06-2008 at 06:02 PM.
 
Old 02-06-2008, 06:20 PM   #12
unSpawn
Moderator
 
Registered: May 2001
Posts: 26,534
Blog Entries: 51

Rep: Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604
Quote:
Originally Posted by PTrenholme View Post
Perhaps a fuse program might be written.
If one already exists that's cool, but there's no need. In post #8 I explained how to use fdisk, losetup and mount to access a partition residing in a full "dd" style disk image.
 
Old 02-06-2008, 06:47 PM   #13
Halgeir
LQ Newbie
 
Registered: Feb 2008
Posts: 3

Rep: Reputation: 0
Can this help you? And a question.

>mount: wrong fs type, bad option, bad superblock on /dev/loop0,
> missing codepage or helper program, or other error
> In some cases useful info is found in syslog - try
> dmesg | tail or so
>[/code]

Hi! I did experiment with the "dd" command today. Experienced the same situation when I tried mount the image. Found a lot of information on this page which solved the whole issue: http://edseek.com/~jasonb/articles/linux_loopback.html.

Later I did a dd of the usb partition (/dev/sdb1) not the device (/dev/sdb). Then I could mount the image directly without specifying a offset value.

Hmm... Do anyone know of a GUI program for linux which it's possible to browse and copy from a RAW DD image (both from a single partition and a whole disk).

-|algeir
 
Old 07-18-2009, 09:01 AM   #14
muchristian
LQ Newbie
 
Registered: Nov 2004
Location: Charlotte NC
Distribution: Debian (unstable)
Posts: 15

Rep: Reputation: 0
Quote:
Originally Posted by unSpawn View Post
As root issue 'fdisk -l /media/disk/files.img'. Note the device name, start and where it says "512 = n bytes". If an ext3 partition is /media/disk/files.img2 starting at 660 with n = 8225280 you could 'losetup -o$[660*8225280] /dev/loop0 /media/disk/files.img' and then 'mount /dev/loop0 -t ext3 /mnt/somemountpoint'.
I think this will sort of work for me. Actually this gets me part of the way for some other projects I am working on. I do have a question though. I use DD and DCFLDD a lot in my line of work and the one thing that I have to do is split the image files up into chunks of 640MB to 2048MB in order for these images to sit on some of the file systems used by people on my team. That being said is there a way for me to mount this dd images using unSpawn's idea but somehow using 'cat'(or whatever) to create a logical single image file? the files will be like this, DD_sda.OOO DD_sda.001 DD_sda.002 etc. until I manage to get the whole drive imaged. I know how to cat the images back together to get one actual file, but not many file systems like 80gb to 200gb single files.

I think I can do fdisk -l /media/storage/DD_sda.000 on the first file to get the information I need for mounting since that first image file contains the partition table. It seams to me that I would have to create some sort of virtual device or file that represents all of the image files as one device/file, then mount the partition using losetup and loop.
 
Old 07-18-2009, 09:34 AM   #15
unSpawn
Moderator
 
Registered: May 2001
Posts: 26,534
Blog Entries: 51

Rep: Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604
// Please avoid necroposting, e.g, the practice of responding to a thread that died out long ago.

Maybe have a look at TSK / PyFLAG / PTK (as in TSK). TSK has some image management tools (mmls) that might come in handy (see the docs or read sleuthkit.org/informer/ articles) wrt partitions, PyFLAG (advanced IO) can handle chunked EWF (.E01, .E02, et cetera) you can write with either 'linen' or convert with the EWF tools (IIRC) (or FTK Imager) but I don't know TSK/PyFLAG handles mounting split DD images. If you dig that then that kinda answers me thinking about what your
Quote:
Originally Posted by muchristian View Post
line of work
could be...
 
  


Reply

Tags
dd, loop, loopback, recover


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are Off
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Explanation of the "loop" option when mounting CD image files uncle-c Linux - Newbie 5 12-15-2007 11:16 AM
Shell and batch operations on hidden files but not on ".." & "." danielsbrewer Linux - Software 5 09-12-2007 08:06 AM
add "Artist" and "Album Title" to mp3 files powah Linux - Software 2 04-05-2005 03:04 AM
why iam getting problems like "...too many files opened" or "segmentation fault" naren_0101bits Linux - Newbie 2 07-19-2004 12:20 PM
"X-MS" cant open because "x-Multimedia System" cant access files at "smb&qu ponchy5 Linux - Networking 0 03-29-2004 11:18 PM


All times are GMT -5. The time now is 10:45 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration