Extract Contents of .img with unknown filesystem

Question

I have an image file: kali-linux-1.0.9a-armhf.img. It's an image of Kali Linux ARMH build.

I am trying to extract the contents of the image, but to no avail. I have tried to mount the image, but I keep getting an error that the filesystem type is wrong.

I've tried with:

sudo mount -o loop -t iso9660 kali-linux-1.0.9a-armhf.img /mnt/kali
sudo mount -o loop -t ext3 kali-linux-1.0.9a-armhf.img /mnt/kali
sudo mount -o loop -t ext4 kali-linux-1.0.9a-armhf.img /mnt/kali

The error I get is:

mount: wrong fs type, bad option, bad superblock on /dev/loop0

Is this because I am trying to mount an image created for a different architecture?

The only command that gets close to working is when mounting as iso9660. That command outputs:

mount: block device /mnt/hgfs/Downloads/kali-linux-1.0.9a-armhf/kali-linux-1.0.9a-armhf.img is write protected, mounting read only
mount: wrong fs type, bad option, bad superblock on /dev/loop0

So it appears to mount, but it doesn't and I then get an error. When using a filesystem other than iso9660 I only get the warning.

What are my options for extracting the contents of this image?

Solution

Is this because I am trying to mount an image created for a different architecture?

No, it's because you're trying to mount an image that doesn't look like any mountable filesystem in the first place. It's a whole disk image – it starts with a MBR partition table, and only then has some number partitions containing filesystems, each of which would be mounted individually. (This particular image only has a single partition though.)

To access its contents, you'll need to set up a loop device for each partition, not just for the entire file.

If you have a relatively recent kernel & util-linux, use losetup --partscan:

# losetup -f -P kali-linux-1.0.9a-armhf.img

# losetup
NAME       SIZELIMIT OFFSET AUTOCLEAR RO BACK-FILE
/dev/loop0         0      0         0  0 /tmp/kali-linux-1.0.9a-armhf.img

# lsblk -f
NAME        FSTYPE      LABEL       UUID                                 MOUNTPOINT
loop0
└─loop0p1   ext4        DEBIAN_LIVE 5ac96015-c0e0-45dc-8642-a53d9e9826c8

# mount /dev/loop0p1 /mnt

If your system is too out-of-date, similar functionality is provided by the kpartx tool.

Comments

[James Jeffery]

Is the -P a typo? The manpage for losetup only shows a -p option for --pass-fd <num>.

[user1686]

@LOLKAT: It's not a typo. The short alias of --partscan is upper-case -P. If you don't see it, your distro is too old to have it. (Might be the case on Debian, which only recently pushed a util-linux update to jessie after many years of maintainership problems.)

[James Jeffery]

Works, thank you. I had to use kpartx, which is no big deal.