Dd on Michael’s Domain

Mounting individual partitions from disk dumps

Thu, 26 Dec 2013 00:00:00 +0000

You can make disk dumps from individual partitions or from a hard drive that contains more than one partition. The ladder has the advantage that you can restore the computer by dumping back the image onto the same or another hard drive. But if you want to access an individual partition from a hard drive image, you need to know where the partition boundaries are. You can note them down from the output of fdisk. However, fdisk -l gives the partition boundaries, but the unit is sectors. You need to multiply this number by the logical sector size to get the partition boundaries in bytes.Alternatively you can use parted (after invoking parted, execute commands unit, B, print in that order) to display the partition boundaries in byte. parted can be also used on a disk dump, e.g. parted /home/backups/diskdump.img to determine the partition boundaries.jeltsch@Michael:~$ sudo parted /home/backup/diskdump.img GNU Parted 2.3Using /home/backup/diskdump.imgWelcome to GNU Parted! Type 'help' to view a list of commands.(parted) unit Unit? [compact]? B (parted) print Model: (file)Disk /home/backup/diskdump.img: 160041885696BSector size (logical/physical): 512B/512BPartition Table: msdosNumber Start End Size Type File system Flags 1 1048576B 524287999B 523239424B primary ntfs boot 2 524288000B 80282124287B 79757836288B primary ntfs 3 80283171840B 160041009151B 79757837312B extended 5 80283172864B 122626684415B 42343511552B logical ext4 7 122626768896B 157924769279B 35298000384B logical ext4 6 157932322816B 160041009151B 2108686336B logical linux-swap(v1)(parted)Then you just mount the image as a loop device with the additional parameter offset using the start boundary of the partition you want to mount:sudo mount -o loop,ro,offset=524288000 /home/backup/diskdump.img /mnt

Disk dumps (dd) and copying over the network (netcat)

Tue, 16 Feb 2010 00:00:00 +0000

On the receiving machine (disk sda MUST be unmounted, e.g. by booting from a live CD or USB stick):netcat -l -p 4778 | dd of=/dev/sdaOn the sending machine (disk sdb MUST be unmounted, e.g. by booting from a live CD or USB stick):dd if=/dev/sdb | netcat 192.168.0.4 4778(-l listen; -p port)To copy a directory over the network, enter the directory and execute on the sending machine:tar -cz . | nc -q 10 -l -p 45454On the receiving machine, create the directory, enter it and execute:nc -w 10 192.168.0.11 45454 | tar -xzBTW: If you want to see the progress of a disk dump (how much was already copied in what time at what average speed), you can use (in newer versions of dd) the status option. I guess this might not work for network copying, but I have not tried… dd if=/dev/sdb of=/target status=progress

How to erase hard drives (shred, dd)

Sun, 25 Jan 2009 00:00:00 +0000

You could write zeros to the whole hard drivedd if=/dev/zero of=/dev/hdaFor newer versions of dd, you can monitor the progress:dd if=/dev/zero of=/dev/hda status=progressHowever, it has been recommended to write a few passes of random noise (n = 3 is the default). If the writing process entirely got rid of the magnetic history and your source of randomness was perfect, a single pass would ALWAYS be enough. In reality, you only need n>1 if you are dealing with the state secrets since recovering anything after an n=1 erase requires special equipment which you cannot buy in any store. shred -vfz -n3 /dev/hda

Mounting disk image files and encrypted filesystems/partitions

Sat, 26 May 2007 00:00:00 +0000

To dump a disk (or a partition) into a file, you use the following command:dd if=/dev/hda3 of=file.binThis command writes the complete data on the hda3 partition into the file file.bin.To mount the filesystem that is in the file, you need to create a loopback device:losetup /dev/loop0 file.binNow you can mount the filesystem as usual:mount -r -t filesystemtype /dev/loop0 /mnt/mountpointApparently, one can combine the last two commands into one:mount -t filesystemtype -o loop ./file.bin /mnt/mountpointIf you want to encrypt the data on a file, that contains a whole filesystem, it is getting a bit more complicated:sudo mkdir /mnt/secure (create mount point for the filesystem)dd if=/dev/zero of=path/to/file bs=1k count=409600 (create an empty file with 400 MB size) sudo /sbin/losetup -e xor /dev/loop0 path/to/file/sbin/mkfs -t ext2 /dev/loop0 409600 (format the device as ext2)sudo mount -t ext2 /dev/loop0 /mnt/secure (mount the device file)cd /mnt/securechown username . (change the owner of the top level directory of the filesystem)If you want to unmount the filesystem:sudo umount /dev/loop0If you want to get rid of the filesystem, you have to un-associate it from the loop device 0: /sbin/losetup -d /dev/loop0For some reason RedHat 9 doesn’t come with DES support, so for the time being (until I patch the kernel or move to Suse Linux) I am using the faster, but much weaker xor encryption.Suse 9 comes with inbuilt strong encryption and offers already during the installation the possibility to create an encrypted partition. Suse 9 asks during booting for the passphrase to mount the encrypted filesystem. The boot process stops and waits for 2 minutes before continuing if you don’t type in the password. In order to reduce this time, you can edit the file /etc/init.d/boot.crypto. Change in the following line 120 to e.g. 10::${TIMEOUT:=120}If you have missed your chance to type in the passphrase during boot time, you can mount the encrypted partition as follows:/sbin/losetup -e twofish /dev/loop0 /dev/hda7 mount /dev/loop0 /media/confBTW: The information about encrypted filesystems resides in /etc/cryptotab.

Execution of dd command via ssh and output redirection to local file

Wed, 04 Apr 2007 00:00:00 +0000

I wanted to copy a whole encrypted partition over the network into a file. You can execute many commands via ssh, but occasionally there are problems to direct the output where you want it. E.g. the “more” command doesn’t output to standard out when used via ssh. You need to use “less” to get the file content displayed locally (at least using a RedHat 8 remote machine). With dd you cannot use the “dd if=input of=output” syntax but you need the “dd output” syntax. The command I finally managed with is ssh -l root remote-machine 'dd hda1.bin

Creating and mounting iso images (CD image files) under linux (dd)

Sat, 23 Dec 2006 00:00:00 +0000

Creating and mounting iso images under linux is very easy.Creating:dd if=/dev/cdrom of=filename.isoMounting:sudo mount -o loop -t iso9660 filename.iso /mnt/isoThe file endings iso, raw and cdr denote all iso files. Image files with the bin/cue ending, however, are not iso files. You can convert them into iso files with bchunk . bchunk needs the cue file to do this! Allthough some non-Linux burning applications (e.g. Toast Titanium for MacOS) can handle (burn and convert) the bin file without the cue file.