Re: [sleuthkit-users] XFS image file analysis
Brought to you by:
carrier
From: Sagar B. <sag...@gm...> - 2012-12-07 09:12:19
|
It seems partx failed, that's the reason I don't see any partition like /dev/loop0p1 or /dev/loop0p2: # mount -t xfs -o ro /dev/loop<tab> loop0 loop1 loop2 loop3 loop4 loop5 loop6 loop7 Thanks, Sagar Belure On Fri, Dec 7, 2012 at 1:20 PM, Ketil Froyn <ke...@fr...> wrote: > You're trying to mount /dev/loop0, but you should be trying to mount a > partition, like /dev/loop0p1 or /dev/loop0p2. These are created by the > partx command. > > But did partx fail or is that just a warning? An alternative is to use > kpartx, but then you'll find the partition devices are named like > /dev/mapper/loop0p1 instead. > > -Ketil > On Dec 7, 2012 6:07 AM, "Sagar Belure" <sag...@gm...> wrote: > >> Hi Ketil, >> >> I'm not really sure, what I'm doing wrong. >> # losetup /dev/loop0 /home/forensic/forensic-images/xfs-1tb.img >> # partx -a /dev/loop0 >> HDIO_GETGEO: Inappropriate ioctl for device >> # mount -t xfs -o ro /dev/loop0 /mnt/temp >> mount: wrong fs type, bad option, bad superblock on /dev/loop0, >> missing codepage or helper program, or other error >> In some cases useful info is found in syslog - try >> dmesg | tail or so >> >> >> Thanks, >> Sagar Belure >> >> >> >> On Wed, Dec 5, 2012 at 8:19 PM, Ketil Froyn <ke...@fr...> wrote: >> >>> $ mmls /tmp/bleck.img >>> >>> $ sudo mount -t xfs -o ro,loop,offset=$((16065*512)) /tmp/bleck.img /mnt >>>> >>> or >>> >>>> $ sudo /sbin/losetup -o $((16065*512)) /dev/loop0 /tmp/bleck.img >>>> >>> $ sudo mount /dev/loop0 /mnt >>> >>> >>> I find partx (or even kpartx) is a handy tool. It sets up the partition >>> devices if you have an image of an entire disk, so you can mount them >>> directly. >>> >>> # losetup /dev/loop0 /tmp/bleck.img >>> # partx -a /dev/loop0 >>> # mount -t xfs -o ro /dev/loop0p1 /mnt >>> >>> Cheers, Ketil >>> >> >> |