Mount and Extract files from images
-
@Junkhacker
I was thinking more along the lines of if I didn’t have a spare PC handy to do just that. I don’t often need it, but thought since I had run into it, and others might have also that this would be a good thing. -
@Sebastian-Roth
I haven’t as far as running the image mount part of it. I will have to try that tomorrow and see. -
@BedCruncher Whats your goal here? Do you need to extract something out of the partclone file (i.e. read a value of a file) or add something to the captured image?
I’m not trying to discount your need here, I did use the ghost explorer back in the day and it was handy to be able to manipulate the captured gho image without having to recapture it.
-
I’d opt for a simple shell script that could display available images, and a user just input the number they want, and the script do the rest.
This is a extreme edge case in my opinion, but maybe just supplying a script to do the job would work? I could even produce such a script for consideration to be included into the FOG file collection.
-
@george1421
My goal basically was to be able to quickly and easily access images without the need to restore them to get access to the files and add in or copy out simple flat files, not make any major OS changes, or anything other than just dealing with the captured image to either add or remove something.I know in the case of adding something I would have to go in and recompress the image and basically get it back to the proper directory and named the proper way at least according to what FOG expects for its own operation. Long term that isn’t what I was thinking about. It was more to be able to at least open an image in a read only format and be able to get access to the image and all files stored within without needing a host box to restore the image to. Espescially if the host box I have on hand is sufficiently different from the original and it BSOD’s on boot.
-
@BedCruncher There’s a moderator here named @ch3i who has a script that can decompress and recompress images on the fog server itself. It’s buried somewhere in the forums but it’s here. I think that would be a good starting point.
-
@BedCruncher The tools Sebastian posted about will let you mount the partclone image on the fog server and let you read the contents of the image file within the linux environment. You can extract files from this mounted file system. While I have not tried this, I’m envisioning that it works the same way as you can mount an .iso image in windows or linux as a read only file system.
-
@george1421 that would be integrated into any script I write.
-
@Sebastian-Roth @george1421
I’ve got the latest version of those tools downloaded and installed. I will attempt to get one of my images mounted in that way and let you both know how I fare. -
@george1421 @Sebastian-Roth
I was having issues with the newer one trying to get it mounted. I uninstalled it and then tried to install the one you sent me the link to, but when I am trying to find any kind of documentation with relevant references to get it working, I can’t really see anything on how to properly use it.The restore command I ran is
cat /images/W7Px64PreSysprep/d1p2.img | gzip -d -c > /tmp/test_img.imgI then ran
imagemount -d /dev/nbd0 -f /tmp/test_img.img -m /mnt -t ntfsand got no errors, but when I do a ls on /mnt I see nothing.
I had saw on other places such as the Clonezilla FAQ where I might have to run the command
modprobe nbd, but I get the errormodprobe: FATAL: Module nbd not found. -
@BedCruncher said in Mount and Extract files from images:
I know in the case of adding something I would have to go in and recompress the image and basically get it back to the proper directory and named the proper way at least according to what FOG expects for its own operation. Long term that isn’t what I was thinking about. It was more to be able to at least open an image in a read only format and be able to get access to the image and all files stored within without needing a host box to restore the image to. Espescially if the host box I have on hand is sufficiently different from the original and it BSOD’s on boot.
When you restore to another box, you don’t have to boot it. What I do is place a second drive in a machine, pull the image to that drive then boot from the first drive, you can then access the files with in the image as a second drive on the machine, never actually booting the image. Then just recapture if any changes are made. No need for having the same hardware.
-
@BedCruncher said:
Module nbd not found.That sounds kind of odd. I use the nbd module all the time. Possibly compiled into the kernel instead of compiled as a kernel module? What system are you trying this on? Kernel version? OS version?
-
@Sebastian-Roth
CentOS Linux release 7.2.1511 (Core)
3.10.0-327.13.1.el7.x86_64 -
I think I may start crying in a moment… http://purplepalmdash.github.io/blog/2015/08/13/build-nbd-kernel-module-on-centos7/
Why the hell does CentOS discard nbd kernel module? Haven’t done much research on this yet. Maybe there is a good reason, I don’t know.
You definitely need the kernel module to be able to use /dev/nbd0!
-
@Sebastian-Roth
I’ve got the proper kernel source downloaded and am building according to the link you provided. Will update once I have any info to add. -
@Sebastian-Roth
I’ve got the module build and loaded properly and am starting the restore process to see the it from beginning to end and trying to mount the image using imagemount. Will update once I know more.EDIT:
@george1421 @Sebastian-Roth
Ran into a slight hitch with the kernel module. Didn’t realize when I rebooted earlier this AM that I had a kernel update. Had to redownload and recompile the nbd module. Still in the testing part of getting the image restored and mounted. -
@Sebastian-Roth @george1421
OK, I’ve run it through all of the steps that I can think of to get imagemount working. I’ve not succeeded in this endeavor.To generate the image I first tried
cat /images/W7Px64PreSysprep/d1p2.img | pigz -d -c > /tmp/test_img.imgI’ve also tried to restore it using
cat W7Px64PreSysprep/d1p2.img | gzip -d -c | partclone.ntfs -r -C --restore_raw_file -s - -O /tmp/test_img.imgand
cat /images/W7Px64PreSysprep/d1p2.img | pigz -d -c | partclone.restore -C -s - -O /tmp/test_img.imgand tried to mount the image using
imagemount -d /dev/nbd0 -f test_img.img -rimagemount -d /dev/nbd0 -f test_img.img -r -m /mnt -t ntfsimagemount -d /dev/nbd0 -f test_img.img -r -m /mnt -t ntfs -v verboseDo either of you have a thought about how to do anything different?
EDIT:
I did get the nbd kernel module loaded with my current kernel3.10.0-327.18.2.el7.x86_64 -
Hmmmmm. I will give this a try on Debian over the weekend… Will let you know. Thanks fro testing and reporting so far.
-
@BedCruncher Ouch! Not going to suggest those partclone-utils anymore. After playing a little bit with those tools without being successful in regards of actually mounting an image I now have two (four) very ugly un-interruptable processes in my process list:
ps ax | grep imagemount 7979 ? Ds 0:00 /path/to/partclone-utils-0.2.1/src/imagemount -d /dev/nbd0 -f disk.img -m /mnt/ -t ntfs 7980 ? Z 0:00 [imagemount] <defunct> 8020 ? D 0:00 /path/to/partclone-utils-0.2.1/src/imagemount -d /dev/nbd0 -f disk.img -m /mnt/ -t ntfs 8023 ? Z 0:00 [imagemount] <defunct>I probably need to reboot to get rid of those. This tool is definitely a bit odd and probably needs some good work to make it work.
[edit]At least I was able to clean things up by starting imagemount as a foreground process and enable verbose logging like this
./imagemount -d /dev/nbd0 -f sys.img -m /mnt/ -t ntfs -Dr -v 2- but still there is nothing in/mnt. Some image files even fail with weird “No such file or directory” errors although the file does exist and is readable. I have no idea…[/edit] -
There is another project called partclone-nbd. Although I had to modify CMakeList.txt (change version from 3.1 to 3.0 as debian comes with cmake 3.0.2) and src/signals.c (define the loop counter before the for loop) to be able to build that tool.
/path/to/partclone-nbd/partclone-nbd -c sys.img [ DBG ] Log file initialized. [ DBG ] Image file opened. [ DBG ] Image header readed. [ DBG ] Correct image signature. [ DBG ] Detected supported image version 0001. [ DBG ] Header data loaded. [ DBG ] [ DBG ] Information from header: [ DBG ] - device size: 532417536 bytes [ DBG ] - blocks count: 98138 [ DBG ] - used blocks: 16499 [ DBG ] - block size: 4096 bytes [ DBG ] - checksum size: 4 bytes [ DBG ] - blocks per checksum: 1 [ DBG ] [ DBG ] Bitmap type is "byte". [ DBG ] Memory required by bitmap: 12272. [ DBG ] Memory for bitmap allocated. [ DBG ] Bytemap mapped to memory. [ DBG ] Correct bitmap signature. [ DBG ] Bytemap loaded to bitmap. [ DBG ] Bytemap unmapped. [ DBG ] Bitmap created. [ DBG ] Memory required by cache array: 24. [ DBG ] Memory for bitmap cache allocated. [ DBG ] Cache created. [ DBG ] Image image created. [ INF ] Image loaded. [ DBG ] A pair of sockets created. [ DBG ] /dev/nbd0 device opened. [ DBG ] NBD device socket cleared. [ DBG ] Socket for communication with kernel set. [ DBG ] Image block size (4096) sent. [ DBG ] Number of blocks (98138) sent. [ DBG ] Read only device attribute set. [ DBG ] Lock thread created. [ DBG ] Memory for storing a chunk allocated. [ DBG ] Signal return point set. [ DBG ] SIGHUP handler set. [ DBG ] SIGINT handler set. [ DBG ] SIGTERM handler set. [ DBG ] SIGQUIT handler set. [ DBG ] SIGUSR1 handler set. [ DBG ] SIGUSR2 handler set. [ INF ] Waiting for requests ...Looks promising I thought. But when I try mounting /dev/nbd0 I get:
ntfs-3g-mount: mount failed: Permission denied(yes I am root!) - not sure what I’m doing wrong.[edit]Ok, getting closer I suppose. Tried a different image (all dummy test images). When trying to mount I get this:
Failed to read last sector (204798): Invalid argument HINTS: Either the volume is a RAID/LDM but it wasn't setup yet, or it was not setup correctly (e.g. by not using mdadm --build ...), or a wrong device is tried to be mounted, or the partition table is corrupt (partition is smaller than NTFS), or the NTFS boot sector is corrupt (NTFS size is not valid). Failed to mount '/dev/nbd2': Invalid argument The device '/dev/nbd2' doesn't seem to have a valid NTFS. Maybe the wrong device is used? Or the whole disk instead of a partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?