9
4
I created a dd image of a partition (containing an HFS+ FS) of one of my disks (and not the entire disk) a few days ago using the following command -
dd conv=sync,noerror bs=8k if=/dev/sdc2 of=/path/to/img
How can I mount it? I tried the following but it doesn't work -
mount -o loop,ro -t hfsplus /path/to/img /path/to/mntDir
It gives me
mount: wrong fs type, bad option, bad superblock on /dev/loop1,
missing codepage or helper program, or other error
In some cases useful info is found in syslog - try
dmesg | tail or so
and dmesg | tail
gives me -
[5248455.568479] hfs: invalid secondary volume header
[5248455.568494] hfs: unable to find HFS+ superblock
[5248462.674836] hfs: invalid secondary volume header
[5248462.674843] hfs: unable to find HFS+ superblock
[5248550.672105] hfs: invalid secondary volume header
[5248550.672115] hfs: unable to find HFS+ superblock
[5248993.612026] hfs: unable to find HFS+ superblock
[5248998.103385] hfs: unable to find HFS+ superblock
[5249031.441359] hfs: unable to find HFS+ superblock
[5249036.274864] hfs: unable to find HFS+ superblock
Is there something wrong that I am doing?
I tried searching on how to do this but all the results I get only talk about mounting a partition from within a full disk image, using the offset option with mount - none talk about the case where the image itself is that of a partition.
Thanks.
PS: I'm running 64bit Arch Linux, and the partition from the original disk /dev/sdc2
mounts fine.
Is your original harddisk still available? Have you read this article already? https://viaforensics.com/computer-forensics/howto-mount-hfs-image-partition-linux.html
– JohannesM – 2012-10-17T10:06:32.620I just did. That again uses a full-disk image and an offset value passed to the mount command to choose a partition within. In my case the image is 1 partition alone. – 0cd – 2012-10-17T10:45:13.630
I notice you are using
noerror
in your dd line. How many unreadable sectors did the source disk have—one may have hit something critical. Especially with the 8k block size (the disk is probably 512b or at most 4k). Does the source disk mount? – derobert – 2012-10-17T20:01:52.940interesting. I'm not sure if the source disk has any unreadable sectors. It mounts without issues and I am able to access the files on it. – 0cd – 2012-10-17T21:40:05.543