Mount and Extract files from images
-
@BedCruncher Haven’t tried this yet but please go for it and let us know if it is working: http://www.idealworldinc.com/partclone-utils/
-
@Sebastian-Roth
I was able to get it working to at least mount the images. I did run a touch on the d1p2_extracted.img file, but I am not sure if that’s specifically required or not.I had to download partclone using the following command
wget https://forensics.cert.org/centos/cert/7/x86_64/partclone-0.2.88-1.el7.x86_64.rpmWould it be possible to make this a feature or at least addon in the future images? I mean at least in my case I needed to extract a couple of files that I had misplaced and didn’t want to have to restore to my test machine, grab the files, restore the proper image back and then put them in place. Figured if I could restore the image to a junk location on the server then I would save a lot of extra steps.
-
@BedCruncher said:
Figured if I could restore the image to a junk location on the server then I would save a lot of extra steps.
The commands you posted in your first message are doing exactly this!
I was able to get it working to at least mount the images.
How did you do it? Please give us some more details! I don’t really understand what you mean by having to download partclone rpm by hand?!?
-
@Sebastian-Roth
Yeah I know they are doing that, but I was wondering if there would be a way to add this to the project as an automatic thing. Where if I say checked a box and selected the image that I wanted to mount in this way, then it would do that and maybe alert me it was done so that I could then pop into the restored image grab what I wanted from it. It could then dismount the image and delete it from the temp directory without having to manually doing it myself.For the Partclone part of it, I tried to download that package directly from the REPO’s that I had added to my server, but got
yum install partclone Loaded plugins: fastestmirror Loading mirror speeds from cached hostfile * base: centos.mirrors.tds.net * epel: fedora-epel.mirror.lstn.net * extras: mirror.beyondhosting.net * remi: mirrors.mediatemple.net * remi-safe: mirrors.mediatemple.net * rpmforge: mirror.nexcess.net * updates: mirror.beyondhosting.net No package partclone available. -
@BedCruncher i don’t know why you’d really want to use a feature like that. it only takes me ~5 minutes to image a spare computer and have access to all of the files that way, and how often are you needing something that’s in your image?
-
@BedCruncher Have you actually had a look at the link I posted? Tried it?
-
@Junkhacker
I was thinking more along the lines of if I didn’t have a spare PC handy to do just that. I don’t often need it, but thought since I had run into it, and others might have also that this would be a good thing. -
@Sebastian-Roth
I haven’t as far as running the image mount part of it. I will have to try that tomorrow and see. -
@BedCruncher Whats your goal here? Do you need to extract something out of the partclone file (i.e. read a value of a file) or add something to the captured image?
I’m not trying to discount your need here, I did use the ghost explorer back in the day and it was handy to be able to manipulate the captured gho image without having to recapture it.
-
I’d opt for a simple shell script that could display available images, and a user just input the number they want, and the script do the rest.
This is a extreme edge case in my opinion, but maybe just supplying a script to do the job would work? I could even produce such a script for consideration to be included into the FOG file collection.
-
@george1421
My goal basically was to be able to quickly and easily access images without the need to restore them to get access to the files and add in or copy out simple flat files, not make any major OS changes, or anything other than just dealing with the captured image to either add or remove something.I know in the case of adding something I would have to go in and recompress the image and basically get it back to the proper directory and named the proper way at least according to what FOG expects for its own operation. Long term that isn’t what I was thinking about. It was more to be able to at least open an image in a read only format and be able to get access to the image and all files stored within without needing a host box to restore the image to. Espescially if the host box I have on hand is sufficiently different from the original and it BSOD’s on boot.
-
@BedCruncher There’s a moderator here named @ch3i who has a script that can decompress and recompress images on the fog server itself. It’s buried somewhere in the forums but it’s here. I think that would be a good starting point.
-
@BedCruncher The tools Sebastian posted about will let you mount the partclone image on the fog server and let you read the contents of the image file within the linux environment. You can extract files from this mounted file system. While I have not tried this, I’m envisioning that it works the same way as you can mount an .iso image in windows or linux as a read only file system.
-
@george1421 that would be integrated into any script I write.
-
@Sebastian-Roth @george1421
I’ve got the latest version of those tools downloaded and installed. I will attempt to get one of my images mounted in that way and let you both know how I fare. -
@george1421 @Sebastian-Roth
I was having issues with the newer one trying to get it mounted. I uninstalled it and then tried to install the one you sent me the link to, but when I am trying to find any kind of documentation with relevant references to get it working, I can’t really see anything on how to properly use it.The restore command I ran is
cat /images/W7Px64PreSysprep/d1p2.img | gzip -d -c > /tmp/test_img.imgI then ran
imagemount -d /dev/nbd0 -f /tmp/test_img.img -m /mnt -t ntfsand got no errors, but when I do a ls on /mnt I see nothing.
I had saw on other places such as the Clonezilla FAQ where I might have to run the command
modprobe nbd, but I get the errormodprobe: FATAL: Module nbd not found. -
@BedCruncher said in Mount and Extract files from images:
I know in the case of adding something I would have to go in and recompress the image and basically get it back to the proper directory and named the proper way at least according to what FOG expects for its own operation. Long term that isn’t what I was thinking about. It was more to be able to at least open an image in a read only format and be able to get access to the image and all files stored within without needing a host box to restore the image to. Espescially if the host box I have on hand is sufficiently different from the original and it BSOD’s on boot.
When you restore to another box, you don’t have to boot it. What I do is place a second drive in a machine, pull the image to that drive then boot from the first drive, you can then access the files with in the image as a second drive on the machine, never actually booting the image. Then just recapture if any changes are made. No need for having the same hardware.
-
@BedCruncher said:
Module nbd not found.That sounds kind of odd. I use the nbd module all the time. Possibly compiled into the kernel instead of compiled as a kernel module? What system are you trying this on? Kernel version? OS version?
-
@Sebastian-Roth
CentOS Linux release 7.2.1511 (Core)
3.10.0-327.13.1.el7.x86_64 -
I think I may start crying in a moment… http://purplepalmdash.github.io/blog/2015/08/13/build-nbd-kernel-module-on-centos7/
Why the hell does CentOS discard nbd kernel module? Haven’t done much research on this yet. Maybe there is a good reason, I don’t know.
You definitely need the kernel module to be able to use /dev/nbd0!
