If you can't mount the image you might still be able in some cases to "stream out" some of its data with cpio
.
Once you've ascertained whether the image is:
- An image using a supported filesystem and a partition -->
mount
- An image using a supported filesystem and more than one partition -->
mount with offset
, or use dd
to extract a partition with offset then
mount that partition only or use something like kpartx
- An image not using a supported filesystem or with no filesystem
at all --> kernel support and further investigation...
You can use the hexdump
and strings
utilities to try to analyze the header and to extract text strings from the image and gain more information about the image file and its structure.
Something captured my interest in doing so:
@(#)/usr/bin/echo.sl 1.1 4.0 10/01/90 16865 AT&T-SF
There's a line like this for every single binary in the image so you somewhat know what's in there. Also, in this case, when you take a closer look at how the installation process occurs on the original platform with installpkg
, you find out that:
The basic mechanism to transfer software from a floppy disk to the
UNIX System V /386 hard disk is cpio.
Basically, the data is extracted with cpio
to /usr/tmp/install and a series of files are included with this (an install, ascii, file, name and size file). It so happens here that this command:
cat U19.IMA | cpio -imdv
outputs malformed number errors to begin with, but then creates a /usr/bin folder with the contents of the image! The tr
I was looking for is there:
#file tr
tr: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), stripped.
Trying cpio
in the first place can't hurt!
Best Answer
Mounts, typically, must be done on block devices. The loop driver puts a block device front-end onto your data file.
If you do a loop mount without
losetup
then the OS does one in the background.eg
You may need to call
losetup
directly if your file image has embedded partitions in it.eg if I have this image:
I can't mount that directly
But if I use
losetup
andkpartx
then I can access the partitions: