Re: [sleuthkit-users] XFS image file analysis

[Sagar B. <sag...@gm...>]

Hi Ketil,

I'm not really sure, what I'm doing wrong.
# losetup /dev/loop0 /home/forensic/forensic-images/xfs-1tb.img
# partx -a /dev/loop0
HDIO_GETGEO: Inappropriate ioctl for device
# mount -t xfs -o ro /dev/loop0 /mnt/temp
mount: wrong fs type, bad option, bad superblock on /dev/loop0,
       missing codepage or helper program, or other error
       In some cases useful info is found in syslog - try
       dmesg | tail  or so


Thanks,
Sagar Belure



On Wed, Dec 5, 2012 at 8:19 PM, Ketil Froyn <ke...@fr...> wrote:

> $ mmls /tmp/bleck.img
>
>  $ sudo mount -t xfs -o ro,loop,offset=$((16065*512)) /tmp/bleck.img /mnt
>>
> or
>
>> $ sudo /sbin/losetup -o $((16065*512)) /dev/loop0 /tmp/bleck.img
>>
> $ sudo mount /dev/loop0 /mnt
>
>
> I find partx (or even kpartx) is a handy tool. It sets up the partition
> devices if you have an image of an entire disk, so you can mount them
> directly.
>
> # losetup /dev/loop0 /tmp/bleck.img
> # partx -a /dev/loop0
> # mount -t xfs -o ro /dev/loop0p1 /mnt
>
> Cheers, Ketil
>