Re: [sleuthkit-users] XFS image file analysis

[Ketil F. <ke...@fr...>]

>
> $ mmls /tmp/bleck.img

$ sudo mount -t xfs -o ro,loop,offset=$((16065*512)) /tmp/bleck.img /mnt
>
or

> $ sudo /sbin/losetup -o $((16065*512)) /dev/loop0 /tmp/bleck.img
>
$ sudo mount /dev/loop0 /mnt


I find partx (or even kpartx) is a handy tool. It sets up the partition
devices if you have an image of an entire disk, so you can mount them
directly.

# losetup /dev/loop0 /tmp/bleck.img
# partx -a /dev/loop0
# mount -t xfs -o ro /dev/loop0p1 /mnt

Cheers, Ketil