Wednesday, November 12, 2008

Mounting a NTFS image in Linux using loop

I had a binary image, created by dd (its important to grab the whole disk, not just one partition):
dd bs=1M if=/dev/sdd of=tag1.bin
of a disk drive from a Windows box that i wanted to explore in Linux. Looking at the file gives:
$ file tag1.bin
tag1.bin: x86 boot sector, Microsoft Windows XP MBR, Serial 0xe475e475
With some help from http://jonmccune.wordpress.com/virtualization-stuff/ i did:
/sbin/fdisk tag1.bin
You must set cylinders.
You can do this from the extra functions menu.

Command (m for help): x

Expert command (m for help): p

Disk tag1.bin: 255 heads, 63 sectors, 0 cylinders

Nr AF  Hd Sec  Cyl  Hd Sec  Cyl     Start      Size ID
1 80   1   1    0 254  63 1019         63   16386237 07
2 00   0   0    0   0   0    0          0          0 00
3 00   0   0    0   0   0    0          0          0 00
4 00   0   0    0   0   0    0          0          0 00

The interesting bit is the "Start" column, which is where the first partition starts. One multiples by the sector size (512) to arrive at:
mount -o loop,offset=32256 tag1.bin /tmp/mount/

No comments: