Mounting partitions from disk images written by neko

Preface

Sometimes you run across some situation, knowing you have solved this problem before, although ages ago, and just can’t remember how to do it. This is one of these cases. It’s not often that you need to mount specifically a particular partition from a disk image, but this can provide useful for data recovery purposes or even if just to look around in the image.

Assuming you got a full disk image, created i.e. via dd, you can specify an offset to the mount command to tell mount at which point to find the partition you want to mount.

Mind: the method using losetup below can also be used to attach the whole disk image as block device.

Mounting via mount

First, determine if your image has a valid partition table at all by using fdisk -l <image>. If this is broken already, you might need to fix that first with tools like testdisk, unless you happen to remember the exact sector your partition starts at.

root@nas:~# fdisk -l image.bin
Disk image.bin: 111.8 GiB, 120034123776 bytes, 234441648 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0xc688913a

Device     Boot     Start       End   Sectors  Size Id Type
image.bin1  *         2048 215881727 215879680  103G 83 Linux
image.bin2       217980926 234440703  16459778  7.9G  5 Extended
image.bin3       215881728 217978879   2097152    1G 83 Linux
image.bin5       217980928 234440703  16459776  7.9G 82 Linux swap / Solaris

Partition table entries are not in disk order.

From the output we can determine that this drive is using a 512-byte sector size¹, this is important for calculating the needed offset for mount: Multiply the start sector of the partition by the sector size, and you will find what byte the partition starts at.

Partition /dev/sdd1 starts at sector: 2048 (from fdisk output)
Sector size: 512 byte

Resulting bytecount, start-sector times sector size: 1048576

Finally, mount the partition:

mount image.bin -o offset=$1048576

Should the mount command return invalid argument, proceed with losetup method.

Mounting via losetup

In case your image is broken beyond recognition as a disk image, you may still be able to scrape off data by mounting the image as a block device. This can be achieved with losetup:²

losetup -o $OFFSET /dev/loop0 image.bin

This will allow you to use the image as if it is an attached disk, although via the loop device /dev/loop0