[NBLUG/talk] Linux util to read Norton Ghost .img files?

[Chris Palmer]

Daniel Smith writes:

> I want to recover a few old .img files, and have Linux or OS X readily
> available (trying not to drag an old Windows box out of offsite
> storage)
> 
> Any Linux utils that can extract from an .img?

What does file(1) say it is? If you're lucky (unlikely), it might just
be an exact image of whatever type of filesystem it is. Try just
mounting it:

    # mkdir /mnt/chirpy-bird
    # mount -oloop ./chirpy-bird.img /mnt/chirpy-bird

Linux will try to guess what kind of filesystem it is, and it might even
succeed.

Barring that, there is a high likelihood that an exact image of the
filesystem is stored at some offset in the .img file (possibly with some
trailing junk). You can use dd(1) to skip to that offset, then read out
the right number of bytes and write the result to a file that Linux will
mount.

Finding the right value for that offset is the fun part. Dig around with
Google, and in the forensics at security-focus.com archives:

    http://marc.theaimsgroup.com/?l=forensics&r=1&w=2


-- 
https://www.eff.org/about/staff/#chris_palmer

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 186 bytes
Desc: not available
Url : http://nblug.org/pipermail/talk/attachments/20051213/239d4b0d/attachment.pgp