Re: [sleuthkit-users] XFS image file analysis

[Sagar B. <sag...@gm...>]

It seems partx failed, that's the reason I don't see any partition like
/dev/loop0p1 or /dev/loop0p2:
# mount -t xfs -o ro /dev/loop<tab>
loop0  loop1  loop2  loop3  loop4  loop5  loop6  loop7

Thanks,
Sagar Belure



On Fri, Dec 7, 2012 at 1:20 PM, Ketil Froyn <ke...@fr...> wrote:

> You're trying to mount /dev/loop0, but you should be trying to mount a
> partition, like /dev/loop0p1 or /dev/loop0p2. These are created by the
> partx command.
>
> But did partx fail or is that just a warning? An alternative is to use
> kpartx, but then you'll find the partition devices are named like
> /dev/mapper/loop0p1 instead.
>
> -Ketil
> On Dec 7, 2012 6:07 AM, "Sagar Belure" <sag...@gm...> wrote:
>
>> Hi Ketil,
>>
>> I'm not really sure, what I'm doing wrong.
>> # losetup /dev/loop0 /home/forensic/forensic-images/xfs-1tb.img
>> # partx -a /dev/loop0
>> HDIO_GETGEO: Inappropriate ioctl for device
>> # mount -t xfs -o ro /dev/loop0 /mnt/temp
>> mount: wrong fs type, bad option, bad superblock on /dev/loop0,
>>        missing codepage or helper program, or other error
>>        In some cases useful info is found in syslog - try
>>        dmesg | tail  or so
>>
>>
>> Thanks,
>> Sagar Belure
>>
>>
>>
>> On Wed, Dec 5, 2012 at 8:19 PM, Ketil Froyn <ke...@fr...> wrote:
>>
>>> $ mmls /tmp/bleck.img
>>>
>>>  $ sudo mount -t xfs -o ro,loop,offset=$((16065*512)) /tmp/bleck.img /mnt
>>>>
>>> or
>>>
>>>> $ sudo /sbin/losetup -o $((16065*512)) /dev/loop0 /tmp/bleck.img
>>>>
>>> $ sudo mount /dev/loop0 /mnt
>>>
>>>
>>> I find partx (or even kpartx) is a handy tool. It sets up the partition
>>> devices if you have an image of an entire disk, so you can mount them
>>> directly.
>>>
>>> # losetup /dev/loop0 /tmp/bleck.img
>>> # partx -a /dev/loop0
>>> # mount -t xfs -o ro /dev/loop0p1 /mnt
>>>
>>> Cheers, Ketil
>>>
>>
>>