Any Linux user that tried to do any advanced things with disks and disk images probably used dd. Maybe he backed up a hard disk, maybe he downloaded a USB disk image and wrote it to a stick. But what about doing a little more advanced operations with disk images (partitioning, editing, mounting)?
It turn out that Linux has a lot of tools that can make working with disk images just as easy and much safer than working with “real” disks.
dd
We all know that dd has a count argument that allows you to copy a specific size. But it also has two other nice options:
- skip can be used to skip a number of blocks from the start of input.
- seek can be used to skip a number of blocks from the start of output.
So one could use skip to extract only a region of the disk image (for example, the third partition). Or he could use seek to overwrite an area of the disk image (wiping out the unencrypted swap partition, for example).
Loop devices
Ever mounted a iso file? You probably used something like “mount -o loop file.iso /some/dir” ? You already used loop devices. Except mounting CD images, loop devices can be used to map a random portion of a file to a /dev/loopX device which can then be used just like any “real” block device.
losetup is the program that is used to link a disk image to a /dev/loopX device, and the generic usage is:
losetup /dev/loopX filename.img
(you can find out what loop device you can use by running losetup -f).
But losetup also has two other useful options:
- -o offset is used to skip a number of bytes from the beginning of the image file.
- –sizelimit limit tells losetup to only use ‘limit’ bytes.
So a combination of -o and –sizelimit will be very useful if you want to access, as a block device, a certain range of bytes from the image file. For example, you might want to link a partition from a hard disk image to a loop device. You will then be able to format, mount and copy files to it.
Mounting
If you just want to mount a partition from a disk image, you don’t need to do it manually in two steps, mount understands the options offset and sizelimit, which it will pass automagically to losetup:
mount -o loop,offset=12345,sizelimit=123456789 file.img /some/dir
is equivalent to:
losetup -o 12345 --sizelimit 123456789 /dev/loop0 file.img
mount /dev/loop0 /some/dir
Partitioning
Most partitioning tools will usually work with disk images, but some will get confused because they can’t detect the disk geometry (welcome back to 1980′s!). Fortunately, most tools also have command switches to force a specific geometry:
fdisk -b sectorsize -C cyls -H heads -S sects is the way to force a geometry on fdisk. For most disk images sectorsize is 512, heads is 255, sects is 63 and cyls can be calculated by dividing the image size in bytes to sectorsize, heads and sects: cyls=size/sectorsize/heads/sects.
cfdisk -c cyls -h heads -s sects is how you can do the same with cfdisk. sfdisk also accepts -C cyls -H heads -S sects. parted doesn’t have these options, but is usually smarter about figuring out disk geometries.
If you use the geometry options, these partitioning tools should work directly on the image files, but my experience is that this doesn’t happen all the time. My advice is to use losetup to create a proper block device first. With a loop device and the geometry arguments from above I always got them to work flawlessly.
I use and abuse these tools to experiment with disks without messing up with my hardware. One can also use them for forensic and rescue purposes. So I hope this post is useful. Enjoy 
Do you know any other standard Linux tool that can be used to manipulate disk images? Tell me in the comments below!
Image credit: Fadookie.
Related posts:
