L'Antre du Tryphon

This post explains how to mount a partition from a disk image file on a Linux system. Such a file may have been created using the dd command. The disk image file in this example is named windowsws.img. This is the image of a disk that contains a Windows system. Let’s say we want to mount the partition that contains the OS and the user’s file.

The first step is to display the partition table. You can display it using either fdisk or gdisk using the command fdisk -l windowsws.img or gdisk -l windowsws.img. You will end-up with a result similar to this one:

Disk windowsws.img: 953.87 GiB, 1024209543168 bytes, 2000409264 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: gpt
Disk identifier: 45FBDC88-7C27-461E-A1F6-559B95FB0B4D

Device              Start        End    Sectors   Size Type
windowsws.img1       2048     534527     532480   260M EFI System
windowsws.img2     534528     567295      32768    16M Microsoft reserved
windowsws.img3     567296 1996312575 1995745280 951.6G Microsoft basic data
windowsws.img4 1996312576 2000408575    4096000     2G Windows recovery environment

The data we are searching for is located on the partition named windowsws.img3. Here’s the trick! We need to compute the offset of the partition in the file. In this case, it will be the start sector of the windowsws.img3 partition which is 567296 times the number of bytes per sector, which is 512. The number of bytes per sector is given on the line Sector size. The offset we want is then 567296 x 512, thus 290455552.

You must then create a loop device for the partition. Let’s say we name it /dev/myloopdev. Then, you create it using the command sudo losetup -o 290455552 /dev/myloopdev windowsws.img where 290455552 is the offset we’ve computed on the previous step.

You can then mount the partition using the command sudo mount /dev/myloopdev /mnt or use any command that targets disk devices on /dev/myloopdev.

You can remove the loop device for the partition by issuing the command sudo losetup -d /dev/myloopdev. The partition must be unmounted.