Re: [sleuthkit-users] XFS image file analysis
Brought to you by:
carrier
From: Sagar B. <sag...@gm...> - 2012-12-07 05:07:38
|
Hi Ketil, I'm not really sure, what I'm doing wrong. # losetup /dev/loop0 /home/forensic/forensic-images/xfs-1tb.img # partx -a /dev/loop0 HDIO_GETGEO: Inappropriate ioctl for device # mount -t xfs -o ro /dev/loop0 /mnt/temp mount: wrong fs type, bad option, bad superblock on /dev/loop0, missing codepage or helper program, or other error In some cases useful info is found in syslog - try dmesg | tail or so Thanks, Sagar Belure On Wed, Dec 5, 2012 at 8:19 PM, Ketil Froyn <ke...@fr...> wrote: > $ mmls /tmp/bleck.img > > $ sudo mount -t xfs -o ro,loop,offset=$((16065*512)) /tmp/bleck.img /mnt >> > or > >> $ sudo /sbin/losetup -o $((16065*512)) /dev/loop0 /tmp/bleck.img >> > $ sudo mount /dev/loop0 /mnt > > > I find partx (or even kpartx) is a handy tool. It sets up the partition > devices if you have an image of an entire disk, so you can mount them > directly. > > # losetup /dev/loop0 /tmp/bleck.img > # partx -a /dev/loop0 > # mount -t xfs -o ro /dev/loop0p1 /mnt > > Cheers, Ketil > |