Ubuntu

I created this image with backtrack 4 release 2 using the AIR imager. the block size was set to 512. it is one big image with all the partitions on it.

I have no idea whether you'll be able to mount an image made by backtrack disk manager, it might not be raw. In any case you can't mount something that's not a partition, and that's not, it's an entire disk. Try '/sbin/fdisk -ul ./image-filename' to see if it finds the partitions on it.

I recommend that you start again. This time do logical imaging (i.e. by filesystem) rather than physical drive imaging. The standard free (as in beer) tool for doing this in the computer forensics world is dcfldd (DOD Computer Forensics Lab) dd.

If you do not want to start again you can use the mmls utility (may need -t dos option) to extract metadata for the relevant logical partition from the physical image. You can then use dcfldd skip=start_sector count=lenght bs=512 to extract the logical partition from the physical image.


Then, if partition is NTFS as is likely, use

Code:

mount  -t ntfs  -o ro,noexec,loop,show_sys_files  partition.img /mnt

Both dcfldd and mmls are available for download on the Internet. mmls is part of TSK (The Sleuth Kit.) dcfldd is available on SourceForge.

If it is a loopback filesystem, such as an ISO or dump (dd, or such) of a file system, he can mount it.

Actually you dont need any tool for backup raw data..
If you clone as raw method in backtrack what block size is not very important

You can use dd command

Code:

dd if=/dev/sdb conv=sync,noerror bs=4096 | gzip -c  > /media/250189482C661005/recovery_image.img.gz

Yes, hence why I asked for a 'fdisk -ul' readout.

It's already been described as a whole disk though -- so it's almost certainly not a filesystem. If it's a plain raw dump he could use offset-tricks to mount partitions in it, otherwise he'll need to convert it somehow first.

---------- Post updated at 08:28 AM ---------- Previous update was at 08:25 AM ----------

You can mount part of a file as a partition when mounting in linux with -o loop. Wish I'd known that years ago, could have done that instead of making a vmware virtual machine.

Code:

mount -o loop,ro,offset=offset-in-bytes,sizelimit=length-in-bytes -t filesystemtype ./huge-wad-of-partitions.img

making new image its at work so i wont be able to try to mount again till fri evening