How to extract files from a disk image without mounting it

disk-imagefilesystemsmount

Say I have a disk image (possibly partitioned) that I have permission to read. However, I don't have permission to mount it via loopback*. In theory, the data is all there; I could write code that resembles the Linux kernel's, partition editors and mount's own code to parse the image, look for partitions, interpret the filesystem and extract a file. But does such a tool already exist for GNU/Linux systems?

*Really, I'm in the position of writing tools to deal with it, and I don't want to (a) assume that the user of those tools can sudo and (b) require them to sudo where it might not be necessary.

(If the answer changes depending on filesystem, ext2-4 is more important to me. But answers that cover multiple popular filesystems will be preferred.)

Best Answer

ext[234]

If in the root directory of /dev/whatever is a file foo:

debugfs -f <(echo cat /foo) /dev/whatever | tail -n +2 > /restore/file

general approach

A general approach would be to create a VM with two disk drives (files in raw mode), one being the image (given to the VM read-only) and another one for restoring the file (if you cannot use networking for transferring it).

You should be able to boot from the image (if not: create a VM with three disk drives, one for booting) and thus be easily capable of accessing the filesystem.

As you cannot mount you have to write the data in some form which is recognizable without a filesystem, e.g.

tar -cf /dev/vdc /etc/passwd

On the host you can simply read the image file:

tar -xf imagefile.img

tar recognizes the end of the archive and ignores the rest of the file.

Related Question