Mount a RAID Reconstructor disk image in linux

This post came to life because I had gotten a image file of a 120GB linux ext2 RAID partition that I couldn’t access using Windows software. The partition had been rescued by RAID Reconstructor, a Windows software that can rebuild RAID arrays by combining the disks from the RAID and store it as one image file.

The solution was to use linux and try to mount it as a loop filesystem. My assumption was that the partition itself had an unknown offset, so I used this script to search and mount the partition. The script tries to mount the partition within the first 20000 blocks. I assume the block size is 512 bytes and I already know that the partition is formatted as ext2.

for ((i=0 ; $i < 20000 ; i=$i + 1)) ; do
    mount -t ext2 -o loop,offset=$(($i * 512)) diskimage.img /mnt/point && break
done

If it succeeds you can issue the mount command to get the offset value to the mounted partition

# mount | grep diskimage

/dev/loop0 on /mnt/point type ext2 (rw,offset=32256)

In my case the offset was 32256.

This script can also be used to mount a partition from a backup of your filesystem.

Example
This is my example disk I'm going to create an image of

# fdisk -l

Disk /dev/hda: 80.0 GB, 80026361856 bytes
255 heads, 63 sectors/track, 9729 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

   Device Boot      Start         End      Blocks   Id  System
/dev/hda1   *           1          14      112423+  83  Linux
/dev/hda2              15          96      658665   83  Linux
/dev/hda3              97        3394    26491185   83  Linux
/dev/hda4            3395        9729    50885887+   f  W95 Ext'd (LBA)
/dev/hda5            3395        7218    30716248+  83  Linux
/dev/hda6            7219        8750    12305758+  83  Linux
/dev/hda7            8751        9533     6289416   83  Linux
/dev/hda8            9534        9729     1574338+  83  Linux

Create a backup image of your entire disk

# dd if=/dev/hda of=imagefile.img

To mount one of these partitions as a loop filesystem you can issue a mount command and tell it the right offset. Use the script above if you don't know the offset, it will take the guesswork for you and mount the partition.

Example of mounting /dev/hda3 if the offset is known

# mount -t ext3 -o loop,offset=49664 /dev/hda3 /mnt/point

Determining the offset is easy when you know the disk geometry have access to the file table.
In this case the hda3 partition has an offset of 512 bytes * 96 blocks = 49664.

EDIT
This post could have been avoided if I had known about the linux tool TestDisk. testDisk is a powerful free data recovery software! It was primarily designed to help recover lost partitions and/or make non-booting disks bootable again when these symptoms are caused by faulty software, certain types of viruses or human error (such as accidentally deleting a Partition Table). It could also be used as a forensic tool.

Leave a Reply