- # assume $Dump points at the hard disk dump (this dump may have been obtained using a command like `dd if=/dev/hda of=$Dump conv=noerror`):
export Dump=/tmp/dump.img
- # have a look at the partition table:
sudo fdisk -u -l $Dump
- # compute the partition offset of the desired partition:
export StartSector=63 # fdisk shows the start sector for each partition it finds
export BytesPerSector=512 # fdisk reports this as the unit size (in bytes)
export Offset=$[$StartSector*$BytesPerSector]
- # mount the partition (e.g., assuming fdisk reported an ntfs or vfat partition, have a look at `cat /proc/filesystems` to know which filesystems your kernel recognizes, and extend the list of partition types to try accordingly):
export MountPoint=/tmp/dump
sudo mkdir -p $MountPoint
for PartitionType in ntfs vfat;do
sudo mount -o loop,ro,offset=$Offset -t $PartitionType $Dump $MountPoint;
done
sudo ls -aRl $MountPoint