Re: [sleuthkit-users] XFS image file analysis
Brought to you by:
carrier
From: Ketil F. <ke...@fr...> - 2012-12-07 07:58:35
|
You're trying to mount /dev/loop0, but you should be trying to mount a partition, like /dev/loop0p1 or /dev/loop0p2. These are created by the partx command. But did partx fail or is that just a warning? An alternative is to use kpartx, but then you'll find the partition devices are named like /dev/mapper/loop0p1 instead. -Ketil On Dec 7, 2012 6:07 AM, "Sagar Belure" <sag...@gm...> wrote: > Hi Ketil, > > I'm not really sure, what I'm doing wrong. > # losetup /dev/loop0 /home/forensic/forensic-images/xfs-1tb.img > # partx -a /dev/loop0 > HDIO_GETGEO: Inappropriate ioctl for device > # mount -t xfs -o ro /dev/loop0 /mnt/temp > mount: wrong fs type, bad option, bad superblock on /dev/loop0, > missing codepage or helper program, or other error > In some cases useful info is found in syslog - try > dmesg | tail or so > > > Thanks, > Sagar Belure > > > > On Wed, Dec 5, 2012 at 8:19 PM, Ketil Froyn <ke...@fr...> wrote: > >> $ mmls /tmp/bleck.img >> >> $ sudo mount -t xfs -o ro,loop,offset=$((16065*512)) /tmp/bleck.img /mnt >>> >> or >> >>> $ sudo /sbin/losetup -o $((16065*512)) /dev/loop0 /tmp/bleck.img >>> >> $ sudo mount /dev/loop0 /mnt >> >> >> I find partx (or even kpartx) is a handy tool. It sets up the partition >> devices if you have an image of an entire disk, so you can mount them >> directly. >> >> # losetup /dev/loop0 /tmp/bleck.img >> # partx -a /dev/loop0 >> # mount -t xfs -o ro /dev/loop0p1 /mnt >> >> Cheers, Ketil >> > > |