Mount individual partitions from a disk image

May 17, 2014 2 min read Linux

Say you’ve made an image of a partition. You might know that you can use mount -o loop to mount the image. But what do you do if you’ve made an image of an entire disk? Many people will “carve out” the partition using dd with the skip and count options. You can save time and disk space by using the offset option with mount.

Using pretty much any partition manager (parted, fdisk, sfdisk, etc.), find out the byte boundaries of your desired partition. For example:

Using /mnt/external/vol2.work/vol2-1.big_image
Welcome to GNU Parted! Type 'help' to view a list of commands.
(parted) unit                                                             
Unit?  [compact]? B                                                       
(parted) print                                                            
Model:  (file)
Disk /mnt/external/vol2.work/vol2-1.big_image: 40020664320B
Sector size (logical/physical): 512B/512B
Partition Table: msdos

Number  Start         End           Size          Type     File system     Flags
 1      32256B        32901119B     32868864B     primary  ext3            boot
 2      32901120B     567544319B    534643200B    primary  linux-swap(v1)
 3      567544320B    38461409279B  37893864960B  primary  linux-swap(v1)
 4      38461409280B  40015987199B  1554577920B   primary  ntfs

Two swap partitions? That larger one might need some work, but the NTFS partition looks like it might be okay.

sudo mount -o ro,loop,offset=38461409280 -t auto vol2-1.big_image /mnt/test2

And it works! The (apparently quite old) NTFS filesystem is mounted.

$ ls /mnt/test2
arcldr.exe    CONFIG.SYS              NTDETECT.COM  Program Files
arcsetup.exe  Documents and Settings  ntldr         System Volume Information
AUTOEXEC.BAT  IO.SYS                  pagefile.sys  WINNT
boot.ini      MSDOS.SYS               Paragon HDM

Linux forensics data recovery

Mount individual partitions from a disk image

Jesse Alter

Senior Lead Software Engineer