Mounting and extracting files from an image

  • Re: Mount and Extract files from images

    TL;DR: +1 for this feature

    Since I started using Fog around 2017 there have been several occasions where it would have been really handy to be able to decompress and mount a Fog image so I can grab a few files or folders from it. I tend to use Fog for backing up old machines just as much as deploying new ones. Right now I’ve got a dummy VM on a lab server set to boot from the network and I’ll deploy an image to it when I need to recover something. This works OK, and I usually end up just mounting the .vhdx to another test VM as a secondary drive so I can browse and copy what I need. It just takes a while when I have an image that is several hundred GB and I only need one file from it. I know even if this were done on the Fog server it would still have to decompress and extract the entire image, but it would be nice if this could be automated. It would eliminate a lot of image juggling and deploying and potential human error.

    I’ve spent the last two days trying to figure out how to mount a Fog image in Ubuntu 16 Server. I can decompress it but partclone always gives some kind of error or tells me I need almost an exabyte of memory. Here is what I’ve tried:

    sudo -i
    cd /images/_Windows10Prox641909
    touch d1p4.extracted.img
    cat d1p4.img | zstd -dcf | partclone.restore -C -s - -O /d1p4.extracted.img --restore_raw_file

    and here is what I get:

    Partclone v0.2.86
    Starting to restore image (-) to device (d1p4.extracted.img)
    There is not enough free memory, partclone suggests you should have 820488013636592786 bytes memory
    Partclone fail, please check /var/log/partclone.log !

    I’ve come across several examples of this being done as well as different ways to do the same thing, but none of them have worked for me. If I could figure out what partclone needs or figure out the correct syntax I could script the process and make it a bit less painful. I’ve also tried partclone.ntfs instead of partclone.restore but it gives the same results. This Ubuntu box has 2.17 TB free space so there should be plenty of room to extract the entire image to a raw file. d1p4.img is a 127 GB NTFS partition in this case.

    Thank you for your time and consideration.

  • Ran this from the Ubuntu 18 box:

    root@ubuntu18:~# zstdmt -dc </images/_Windows10Prox641909/d1p4.img | -s -
    Partclone v0.3.11
    Showing info of image (-)
    File system:  NTFS
    Device size:    9.9 GB = 2412369 Blocks
    Space in use:   9.6 GB = 2351625 Blocks
    Free Space:   248.8 MB = 60744 Blocks
    Block size:   4096 Byte
    image format:    0002
    created on a:    64 bits platform
    with partclone:  v0.3.13
    bitmap mode:     BIT
    checksum algo:   NONE
    checksum size:   n/a
    blocks/checksum: n/a
    reseed checksum: n/a

  • I bet my issue is partclone being an older version. I spun up a new Ubuntu 18 server during lunch and installed partclone and zstd and ran

    zstdmt -dc </images/_Windows10Prox641909/d1p4.img | partclone.restore -C -O /d1p4.extracted.img -Nf 1 --restore_raw_file

    and it extracted the image successfully. I suppose it’s time for me to get away from Ubuntu 16.

    I’m a little hesitant to jump into learning how to compile programs from source. The last time I compiled anything was in QBasic in the late 90s.

    @Quazz I really appreciate your help.

  • I’m finding that partclone error messages aren’t very helpful. Perhaps I should be using some debug or verbose option.

    root@fog:~# zstdmt -dc </images/_Windows10Prox641909/d1p4.img | -s -
    Partclone v0.2.86
    Display image information
    main, 153, not enough memory
    Partclone fail, please check /var/log/partclone.log !
  • Moderator

    @benc Can you do

    zstdmt -dc </images/_Windows10Prox641909/d1p4.img | -s -

    And paste the output here? It will tell us which version the image was made with. (if it works ofc)

    You can of course build partclone from source from their github repo.

  • I ran apt update and apt upgrade but my partclone is still at 0.2.86. I also ran

    zstdmt -dc </images/_Windows10Prox641909/d1p4.img | partclone.restore -C -O /d1p4.extracted.img -Nf 1 --restore_raw_file

    and this time it brought up a text-based graphical interface for partclone and it gave me the same error that I needed 820488013636592786 bytes of memory.

    I did some digging on Google and now I’m wondering if I need to upgrade to Ubuntu 18 to be able to get the new partclone.

    EDIT: My zstd is at version 1.3.1. I’m able to decompress the image file (3 GB) to another image file that is roughly the size of the data that should be on that partition (8 GB), so I’m thinking zstd is ok.

  • Moderator

    Let’s start with installing partclone 0.3.13, since FOG has been using that for a while and the image format is different to how it used to be. (it can still restore images made under older versions though)

    Next up, you need to check the zstd version. FOG uses a fairly recent version (again backwards compatible, but older versions may fail on newer compressed files) Should be 1.45 I believe.

    zstdmt -dc </tmp/pigz1 | partclone.restore -n "Storage Location $storage, Image name $img" -O ${target} -Nf 1

    Is what FOS uses to restore an image back to a disk (deployment).

    So for this case we can modify to

    zstdmt -dc </images/_Windows10Prox641909/d1p4.img | partclone.restore -C -O /d1p4.extracted.img -Nf 1 --restore_raw_file

    Tested this on my FOG server and it worked fine. Let me know how it goes.