How can I mount dd image of a partition?

Question

I created a dd image of a partition (containing an HFS+ FS) of one of my disks (and not the entire disk) a few days ago using the following command -

dd conv=sync,noerror bs=8k if=/dev/sdc2 of=/path/to/img

How can I mount it? I tried the following but it doesn't work -

mount -o loop,ro -t hfsplus /path/to/img /path/to/mntDir

It gives me

mount: wrong fs type, bad option, bad superblock on /dev/loop1,
       missing codepage or helper program, or other error
       In some cases useful info is found in syslog - try
       dmesg | tail or so

and dmesg | tail gives me -

[5248455.568479] hfs: invalid secondary volume header
[5248455.568494] hfs: unable to find HFS+ superblock
[5248462.674836] hfs: invalid secondary volume header
[5248462.674843] hfs: unable to find HFS+ superblock
[5248550.672105] hfs: invalid secondary volume header
[5248550.672115] hfs: unable to find HFS+ superblock
[5248993.612026] hfs: unable to find HFS+ superblock
[5248998.103385] hfs: unable to find HFS+ superblock
[5249031.441359] hfs: unable to find HFS+ superblock
[5249036.274864] hfs: unable to find HFS+ superblock

Is there something wrong that I am doing?

I tried searching on how to do this but all the results I get only talk about mounting a partition from within a full disk image, using the offset option with mount - none talk about the case where the image itself is that of a partition.

Thanks.

PS: I'm running 64bit Arch Linux, and the partition from the original disk /dev/sdc2 mounts fine.

Solution 1

You might first have to use losetup to create a device from your file, and then mount that device. Here's what I do to mount a backup file with partition image inside:

losetup /dev/loop1 /home/backup-file
mount /dev/loop1 /mnt/backup 

My partition then appears under /mnt/backup, and the original file is /home/backup-file. Maybe you can do this all with "mount -o loop" but I haven't been successful with that, so I'm using losetup separately.

After I'm finished, I umount the partition and then delete the loop with "losetup -d /dev/loop1", just in case.

Also, you can use losetup to find out what loop device is currently free in your system, with losetup -f

Let me know if this works.

Solution 2

running mount -o loop should accomplish what you want it to do but, clearly, it's not.

this leads me to believe that the filesystem driver you're trying to use isn't working properly.

this might be a stretch and I don't know how HFS+ works .. but is it possible that HFS+ stores partitions within partitions? maybe similar to LVM?

another thing that comes to mind is encryption. it seems as though HFS+ partitions can be encrypted. does this ring any bells for you?

Comments

[Admin]

Is your original harddisk still available? Have you read this article already? viaforensics.com/computer-forensics/…

[Admin]

I just did. That again uses a full-disk image and an offset value passed to the mount command to choose a partition within. In my case the image is 1 partition alone.

[Admin]

I notice you are using noerror in your dd line. How many unreadable sectors did the source disk have—one may have hit something critical. Especially with the 8k block size (the disk is probably 512b or at most 4k). Does the source disk mount?

[Admin]

interesting. I'm not sure if the source disk has any unreadable sectors. It mounts without issues and I am able to access the files on it.

[Dario Russo]

mount -o loop internally automatically allocates a loopback device so manually assigning the image to a loopback device is extra, unneeded work.

[0cd]

thanks for the information. but spyroboy is right - mount does internally allocate a loopback device.

[0cd]

not sure about internals of HFS+, but the partition is definitely not encrypted. Infact I still have the original disk and the partition from that mounts fine.

[Piotr Kempa]

Yes, I suspected as much, although I had a similar problem to yours and I solved it with doing it by hand, i.e. assigning the loop device with losetup. In any case, maybe it will help you to pinpoint the problem.