This post came to life because I had gotten a image file of a 120GB linux ext2 RAID partition that I couldn’t access using Windows software. The partition had been rescued by RAID Reconstructor, a Windows software that can rebuild RAID arrays by combining the disks from the RAID and store it as one image file.
The solution was to use linux and try to mount it as a loop filesystem. My assumption was that the partition itself had an unknown offset, so I used this script to search and mount the partition. The script tries to mount the partition within the first 20000 blocks. I assume the block size is 512 bytes and I already know that the partition is formatted as ext2.
for ((i=0 ; $i < 20000 ; i=$i + 1)) ; do mount -t ext2 -o loop,offset=$(($i * 512)) diskimage.img /mnt/point && break done
If it succeeds you can issue the mount command to get the offset value to the mounted partition
# mount | grep diskimage /dev/loop0 on /mnt/point type ext2 (rw,offset=32256)
In my case the offset was 32256.
This script can also be used to mount a partition from a backup of your filesystem.
This is my example disk I'm going to create an image of
# fdisk -l Disk /dev/hda: 80.0 GB, 80026361856 bytes 255 heads, 63 sectors/track, 9729 cylinders Units = cylinders of 16065 * 512 = 8225280 bytes Device Boot Start End Blocks Id System /dev/hda1 * 1 14 112423+ 83 Linux /dev/hda2 15 96 658665 83 Linux /dev/hda3 97 3394 26491185 83 Linux /dev/hda4 3395 9729 50885887+ f W95 Ext'd (LBA) /dev/hda5 3395 7218 30716248+ 83 Linux /dev/hda6 7219 8750 12305758+ 83 Linux /dev/hda7 8751 9533 6289416 83 Linux /dev/hda8 9534 9729 1574338+ 83 Linux
Create a backup image of your entire disk
# dd if=/dev/hda of=imagefile.img
To mount one of these partitions as a loop filesystem you can issue a mount command and tell it the right offset. Use the script above if you don't know the offset, it will take the guesswork for you and mount the partition.
Example of mounting /dev/hda3 if the offset is known
# mount -t ext3 -o loop,offset=49664 /dev/hda3 /mnt/point
Determining the offset is easy when you know the disk geometry have access to the file table.
In this case the hda3 partition has an offset of 512 bytes * 96 blocks = 49664.
This post could have been avoided if I had known about the linux tool TestDisk. testDisk is a powerful free data recovery software! It was primarily designed to help recover lost partitions and/or make non-booting disks bootable again when these symptoms are caused by faulty software, certain types of viruses or human error (such as accidentally deleting a Partition Table). It could also be used as a forensic tool.