-
Notifications
You must be signed in to change notification settings - Fork 0
Preparation of your data
This text is WIP!
We assume you already have made a copy of a complete physical hard disk containing several partitions, e.g. pc4_disk01_hd10.dd
.
First we need to find the offsets to mount single partitions of interest.
The fdisk
command can also be applied to files:
# fdisk -u -l pc4_disk01_hd10.dd You must set cylinders. You can do this from the extra functions menu. Disk pc4_disk01_hd10.dd: 0 MB, 0 bytes 255 heads, 63 sectors/track, 0 cylinders, total 0 sectors Units = sectors of 1 * 512 = 512 bytes Disk identifier: 0x00021897 Device Boot Start End Blocks Id System pc4_disk01_hd10.dd1 * 63 112454 56196 83 Linux pc4_disk01_hd10.dd2 112455 1124549 506047+ 82 Linux swap / Solaris pc4_disk01_hd10.dd3 1124550 312576704 155726077+ 83 Linux Partition 3 has different physical/logical endings: phys=(1023, 254, 63) logical=(19456, 254, 63)
Simply multiply the starting sector with the size of a sector in bytes
# echo $((1124550*512)) 575769600
and use the result as in
# mount -o ro,loop,offset=575769600 pc4_disk01_hd10.dd /mnt
This should give you a valid file hierarchy below /mnt
. If mount
complaints about a missing file system type, the offset is most probably wrong.
If manual mounting goes well, insert a new row into the session table of your database and fill in all necessary information – most importantly a unique sessionid
, datapath
which points to your image file and the correct mount
command.
Recent versions of Indexer
will do a temporary mount by itself and do not need pre-mounted file systems anymore.
Simply do not specify an offset in your mount
command.
Simply do not specify an offset in your mount
command.
If you want to recursively process a folder full of files (and not an image file) simply point datapath
to that folder and leave the mount
column empty.
Please visit our homepage DLA Marbach