forensics
Using dd to extract a partition from a disk image
Submitted by soccerfiend on Wed, 2008-10-01 14:41I came across this little problem today. I had an image of an entire hard drive, but all I wanted was to extract a single partition.
Most of what I wanted to do was described in this post.
First, I needed to see what was on the disk image, using fdisk:
Device Boot Start End Blocks Id System
myimage.bin1 * 63 275225579 137612758+ 83 Linux
myimage.bin2 275225580 17117257+ 7 HPFS/NTFS
and so on.
The "u" option tells fdisk to display the results in units of 512 bytes, which should match the block size. This may not be true of disks imaged that are 3 terabytes or larger.
What I then did was use dd to extract only partition 1
- dd if=myimage.bin of=myimage-1.bin bs=512 skip=$[Start-1] count=$[Stop-Start+1]
Below is a real world example based on the output of dd above.
- dd if=myimage.bin of=myimage-1.bin bs=512 skip=$[63-1] count=$[275225579-63+1]
I now have a second file myimage-1.bin which I can then mount and copy files off of.
- mount myimage-1.bin /mnt/tmp -o loop
