9

I created an image of a failing drive with:

dd if=/dev/sde of=/mnt/image001.dd

The drive had only two partitions:

   Device Boot      Start         End      Blocks   Id  System
/dev/sde1   *           1          13      102400    7  HPFS/NTFS
/dev/sde2              13       60802   488282112    7  HPFS/NTFS

How can I split the image (image001.dd) into two or three files (1: MBR; 2: Partition 1; 3: Partition 2) so that I can mount the filesystems in it?

A solution I've found that wouldn't work for me is to use split to create many 512K files, then cat them back together into three files (1: 512K, 2: 105M, 3: the rest), but I don't have the disk space for that.

History:
I have already copied the entire image to a new drive, and it boots and mostly works. It seems that the FS was corrupted on the old failing drive, and dd copied the corrupted parts (as it should), and I wrote them to the new drive. My solution is to mount the FS that I copied and the copy just the files (using rsync or something) so that hopefully I won't copy the bad bits.

UPDATE 1: I've tried dd if=/mnt/image001.dd of=/mnt/image001.part1.dd bs=512 count=204800 skip=1 but mount complains that NTFS signature is missing, so I think I didn't do it right.

Joe A
  • 190
  • 1
  • 9

2 Answers2

17

You don't need to split this at all.

Use parted to get details about the partition table: 

parted image001.dd

In parted, switch to byte units with the command u, then B. After that, issue the command print.

You will get an output that looks like this (output is from an actual system, not an image):

Model: Virtio Block Device (virtblk)
Disk /dev/vda: 25165824000B
Sector size (logical/physical): 512B/512B
Partition Table: msdos

Number  Start         End           Size          Type     File system     Flags
 2      1048576B      400556031B    399507456B    primary  ext4            boot
 3      400556032B    21165506559B  20764950528B  primary  ext4
 1      21165506560B  25164775423B  3999268864B   primary  linux-swap(v1)

You can use the Start number as an offset for a loopback mount: 

mount -o loop,ro,offset=400556032 image001.dd /mnt/rescue

would mount the third partition at /mnt/rescue.

Sven
  • 97,248
  • 13
  • 177
  • 225
  • Both this and `kpartx` solve my problem. I chose this answer because I'd imagine that `parted` is more common than `kpartx`, however `kpartx` is a bit easier. – Joe A Feb 26 '12 at 06:32
  • Thx for the answer, it works for me except from the mount command itself. My raspi did not boot anymore and threw a kernel panic. I tried to mount it but got a strange error message (something like read-only, but does not let me mount it either). With your suggestion I got the same strange error message. – JAR May 12 '21 at 07:27
17

It's much better to simply use kpartx tool.

usage : kpartx [-a|-d|-l] [-v] wholedisk
    -a add partition devmappings
    -d del partition devmappings
    -l list partitions devmappings that would be added by -a
    ...

Example:

# kpartx -l whole_disk # only listing
loop0p1 : 0 518144 /dev/loop0 2048
loop0p2 : 0 3674112 /dev/loop0 520192
# kpartx -a whole_disk 
# file -sL /dev/mapper/loop0p*
/dev/mapper/loop0p1: Linux/i386 swap file (new style), version 1 (4K pages), size 64767 pages, no label, UUID=e4990860-c87d-4850-9e8d-ecb0a0506516
/dev/mapper/loop0p2: SGI XFS filesystem data (blksz 4096, inosz 256, v2 dirs)

At this point I can mount /dev/mapper/loop0p2.

After unmounting call kpartx -d whole_disk to clean up.

Sven
  • 97,248
  • 13
  • 177
  • 225
kupson
  • 3,388
  • 18
  • 18
  • 1
    +1 This is nice, never heard of that tool. – Sven Feb 25 '12 at 20:03
  • Both this an SvenW's answer below work very well! Both let me mount a partition within the drive image. – Joe A Feb 26 '12 at 06:31
  • I chose this answer not only because it did the job perfectly (in contrast to the other answer). It is exactly the bit of information I've ever needed when handling dd image files with all my raspis. Especially the command `kpartx -a whole_disk` is awesome! Thx! – JAR May 12 '21 at 06:19