Tuesday, September 7, 2010

Mount entire driver image

if you dump your entire Hard driver using DD. you can view the content of the Image using the following comment.

assume you have create a hd image in /home/backup/hd.dump

1). fdisk /home/backup/hd.dump
You must set cylinders.
You can do this from the extra functions menu.

Disk /mnt/storage/disk_image: 0 MB, 0 bytes
255 heads, 63 sectors/track, 0 cylinders, total 0 sectors
Units = sectors of 1 * 512 = 512 bytes
Disk identifier: 0x41172ba5

Device Boot Start End Blocks Id System
/home/backup/hd.dump1 63 64259 32098+ de Dell Utility
/home/backup/hd.dump2 * 64260 78108029 39021885 7 HPFS/NTFS
Partition 2 has different physical/logical endings:
phys=(1023, 254, 63) logical=(4861, 254, 63)

2). then take the start of the partition that you want to edit 64260 in this case and multiply it by 512 ie 512*64260=32901120

then mount like this:

3). mount -o loop,offset=32901120 -t auto /home/backup/hd.dump /mnt/images ( assume the /mnt/images exists).