Re: [opensuse] Trouble Mounting NTFS Drive Image - Loop Offset not working?

On Thu, Mar 5, 2009 at 9:53 AM, Pete Eby <peby@xxxxxxxxxxx> wrote:
Greg Freemyer wrote:

The mount command looks right.  And like you I can't remember if the
offset should be 63 * 512 or 64 * 512.

The easy way to check is do a "od -cv /dev/loop4 | head".  (Obviously
use your loop device.)

A ntfs partition has the word NTFS in the first sector.  ie. the
sector your offset should point to.

Can you mount / unmount anything?  I'm guessing not.

Also, do you really have /etc/mtab~.   I don't.  It may be as simple
as deleting that.

Greg

Hi Greg,

Thanks for your suggestions. The od one was a good idea for sure - good
to know NTFS is plainly in the first sector.

I did actually delete any mtab files with rm /etc/mtab*

I can mount other things okay, that is part of the strangeness of it.
First, here is an example of mounting an ext3 virtual file system -
which works fine. Then there is an example of the NTFS attempt (and
output of the od you recommended.) Still no joy though:

I have an idea - could mount be failing due to inconsistencies in the
NTFS file system? I reimaged this back onto a drive and after chkdsk ran
on it, the Windows system booted up and is running fine. (I'd still like
to be able to get at files in this image though). Perhaps mount is
failing due to this?


***************************************
Ext3 Virtual File System - Mounts Okay:
***************************************

Callandor:/virtual # dd if=/dev/zero of=ext3fs.img bs=1024 count=10000

10000+0 records in

10000+0 records out

10240000 bytes (10 MB) copied, 0.265593 s, 38.6 MB/s

Callandor:/virtual # mkfs.ext3 ext3fs.img

mke2fs 1.41.1 (01-Sep-2008)

ext3fs.img is not a block special device.

Proceed anyway? (y,n) y
...

Callandor:/virtual # mount -o loop ext3fs.img /mnt/

Callandor:/virtual # ls /mnt/

lost+found

Callandor:/virtual # touch /mnt/test

Callandor:/virtual # ls /mnt
lost+found  test


Callandor:/virtual # df -h
/dev/loop0            9.5M  1.1M  7.9M  13% /mnt

However, I still get the same when trying to mount to ntfs drive image

Callandor:/virtual # mount -o loop,offset=32256
/virtual/80GBNotebookDrive.dd.img /mnt/image/

Interminable hang . . .


***************************
NTFS Loopback Offset - no go
****************************

Callandor:/virtual # losetup -o 32256 /dev/loop5
/virtual/80GBNotebookDrive.dd.img
Callandor:/virtual # file -s /dev/loop5
/dev/loop5: x86 boot sector
Callandor:/virtual # od -cv /dev/loop5 | head
0000000 353   R 220   N   T   F   S                  \0 002  \b  \0  \0
0000020  \0  \0  \0  \0  \0 370  \0  \0   ?  \0 377  \0   ?  \0  \0  \0
0000040  \0  \0  \0  \0 200  \0 200  \0 377 023 250 004  \0  \0  \0  \0
0000060  \0  \0  \f  \0  \0  \0  \0  \0   ? 201   J  \0  \0  \0  \0  \0
0000100 366  \0  \0  \0 001  \0  \0  \0 374 177 334   < 226 334   <   H
0000120  \0  \0  \0  \0 372   3 300 216 320 274  \0   | 373 270 300  \a
0000140 216 330 350 026  \0 270  \0  \r 216 300   3 333 306 006 016  \0
0000160 020 350   S  \0   h  \0  \r   h   j 002 313 212 026   $  \0 264
0000200  \b 315 023   s 005 271 377 377 212 361   f 017 266 306   @   f
0000220 017 266 321 200 342   ? 367 342 206 315 300 355 006   A   f 017

Callandor:/virtual # mount -t ntfs /dev/loop5 /media/disk/

Interminable hang . . .

Or

Callandor:/virtual # Cannot create link /etc/mtab~
Perhaps there is a stale lock file?

How about this sequence (works here):

==
# dd if=/dev/zero of=/tmp/ntfs_fs.img bs=1024 count=10000
10000+0 records in
10000+0 records out
10240000 bytes (10 MB) copied, 0.182193 s, 56.2 MB/s

# mkfs.ntfs --force /tmp/ntfs_fs.img
/tmp/ntfs_fs.img is not a block device.
mkntfs forced anyway.
The sector size was not specified for /tmp/ntfs_fs.img and it could
not be obtained automatically. It has been set to 512 bytes.
The partition start sector was not specified for /tmp/ntfs_fs.img and
it could not be obtained automatically. It has been set to 0.
The number of sectors per track was not specified for /tmp/ntfs_fs.img
and it could not be obtained automatically. It has been set to 0.
The number of heads was not specified for /tmp/ntfs_fs.img and it
could not be obtained automatically. It has been set to 0.
Cluster size has been automatically set to 512 bytes.
To boot from a device, Windows needs the 'partition start sector', the
'sectors per track' and the 'number of heads' to be set.
Windows will not be able to boot from this device.
Initializing device with zeroes: 100% - Done.
Creating NTFS volume structures.
mkntfs completed successfully. Have a nice day.

# mount -o loop /tmp/ntfs_fs.img /mnt

# mount
/dev/sda5 on / type ext3 (rw,acl,user_xattr)
/proc on /proc type proc (rw)
sysfs on /sys type sysfs (rw)
debugfs on /sys/kernel/debug type debugfs (rw)
udev on /dev type tmpfs (rw)
devpts on /dev/pts type devpts (rw,mode=0620,gid=5)
/dev/sda6 on /home type ext3 (rw,acl,user_xattr)
fusectl on /sys/fs/fuse/connections type fusectl (rw)
securityfs on /sys/kernel/security type securityfs (rw)
//10.0.1.39/forensics on /I type cifs (rw,mand)
//10.0.1.44/data on /T type cifs (rw,mand)
//10.0.1.42/data on /Z type cifs (rw,mand)
/proc on /var/lib/ntp/proc type proc (ro)
gvfs-fuse-daemon on /home/gaf/.gvfs type fuse.gvfs-fuse-daemon
(rw,nosuid,nodev,user=gaf)
/dev/loop0 on /mnt type fuseblk (rw,allow_other,blksize=512)

#
--

If that works, try doing the mkfs.ntfs at an offset sector. (See the man page.)

Then do the loopback mount to the offset.

If all of that works, there must be an issue with your image.

Greg
--
Greg Freemyer
Litigation Triage Solutions Specialist
http://www.linkedin.com/in/gregfreemyer
First 99 Days Litigation White Paper -
http://www.norcrossgroup.com/forms/whitepapers/99%20Days%20whitepaper.pdf

The Norcross Group
The Intersection of Evidence & Technology
http://www.norcrossgroup.com
--
To unsubscribe, e-mail: opensuse+unsubscribe@xxxxxxxxxxxx
For additional commands, e-mail: opensuse+help@xxxxxxxxxxxx

Relevant Pages