Mounting and extracting files from an image

benc

TL;DR: +1 for this feature

Since I started using Fog around 2017 there have been several occasions where it would have been really handy to be able to decompress and mount a Fog image so I can grab a few files or folders from it. I tend to use Fog for backing up old machines just as much as deploying new ones. Right now I’ve got a dummy VM on a lab server set to boot from the network and I’ll deploy an image to it when I need to recover something. This works OK, and I usually end up just mounting the .vhdx to another test VM as a secondary drive so I can browse and copy what I need. It just takes a while when I have an image that is several hundred GB and I only need one file from it. I know even if this were done on the Fog server it would still have to decompress and extract the entire image, but it would be nice if this could be automated. It would eliminate a lot of image juggling and deploying and potential human error.

I’ve spent the last two days trying to figure out how to mount a Fog image in Ubuntu 16 Server. I can decompress it but partclone always gives some kind of error or tells me I need almost an exabyte of memory. Here is what I’ve tried:

sudo -i
cd /images/_Windows10Prox641909
touch d1p4.extracted.img
cat d1p4.img | zstd -dcf | partclone.restore -C -s - -O /d1p4.extracted.img --restore_raw_file

and here is what I get:

Partclone v0.2.86 http://partclone.org
Starting to restore image (-) to device (d1p4.extracted.img)
There is not enough free memory, partclone suggests you should have 820488013636592786 bytes memory
Partclone fail, please check /var/log/partclone.log !

I’ve come across several examples of this being done as well as different ways to do the same thing, but none of them have worked for me. If I could figure out what partclone needs or figure out the correct syntax I could script the process and make it a bit less painful. I’ve also tried partclone.ntfs instead of partclone.restore but it gives the same results. This Ubuntu box has 2.17 TB free space so there should be plenty of room to extract the entire image to a raw file. d1p4.img is a 127 GB NTFS partition in this case.

Thank you for your time and consideration.

Quazz

Let’s start with installing partclone 0.3.13, since FOG has been using that for a while and the image format is different to how it used to be. (it can still restore images made under older versions though)

Next up, you need to check the zstd version. FOG uses a fairly recent version (again backwards compatible, but older versions may fail on newer compressed files) Should be 1.45 I believe.

zstdmt -dc </tmp/pigz1 | partclone.restore -n "Storage Location $storage, Image name $img" -O ${target} -Nf 1

Is what FOS uses to restore an image back to a disk (deployment).

So for this case we can modify to

zstdmt -dc </images/_Windows10Prox641909/d1p4.img | partclone.restore -C -O /d1p4.extracted.img -Nf 1 --restore_raw_file

Tested this on my FOG server and it worked fine. Let me know how it goes.

benc

I ran apt update and apt upgrade but my partclone is still at 0.2.86. I also ran

zstdmt -dc </images/_Windows10Prox641909/d1p4.img | partclone.restore -C -O /d1p4.extracted.img -Nf 1 --restore_raw_file

and this time it brought up a text-based graphical interface for partclone and it gave me the same error that I needed 820488013636592786 bytes of memory.

I did some digging on Google and now I’m wondering if I need to upgrade to Ubuntu 18 to be able to get the new partclone.

EDIT: My zstd is at version 1.3.1. I’m able to decompress the image file (3 GB) to another image file that is roughly the size of the data that should be on that partition (8 GB), so I’m thinking zstd is ok.

Quazz

@benc Can you do

zstdmt -dc </images/_Windows10Prox641909/d1p4.img | partclone.info -s -

And paste the output here? It will tell us which version the image was made with. (if it works ofc)

You can of course build partclone from source from their github repo.

benc

I’m finding that partclone error messages aren’t very helpful. Perhaps I should be using some debug or verbose option.

root@fog:~# zstdmt -dc </images/_Windows10Prox641909/d1p4.img | partclone.info -s -
Partclone v0.2.86 http://partclone.org
Display image information
main, 153, not enough memory
Partclone fail, please check /var/log/partclone.log !

benc

I bet my issue is partclone being an older version. I spun up a new Ubuntu 18 server during lunch and installed partclone and zstd and ran

zstdmt -dc </images/_Windows10Prox641909/d1p4.img | partclone.restore -C -O /d1p4.extracted.img -Nf 1 --restore_raw_file

and it extracted the image successfully. I suppose it’s time for me to get away from Ubuntu 16.

I’m a little hesitant to jump into learning how to compile programs from source. The last time I compiled anything was in QBasic in the late 90s.

@Quazz I really appreciate your help.

benc

Ran this from the Ubuntu 18 box:

root@ubuntu18:~# zstdmt -dc </images/_Windows10Prox641909/d1p4.img | partclone.info -s -
Partclone v0.3.11 http://partclone.org
Showing info of image (-)
File system:  NTFS
Device size:    9.9 GB = 2412369 Blocks
Space in use:   9.6 GB = 2351625 Blocks
Free Space:   248.8 MB = 60744 Blocks
Block size:   4096 Byte

image format:    0002
created on a:    64 bits platform
with partclone:  v0.3.13
bitmap mode:     BIT
checksum algo:   NONE
checksum size:   n/a
blocks/checksum: n/a
reseed checksum: n/a

Mounting and extracting files from an image

127

11.7k

17.2k

154.7k