Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have several raw block copies of disks that have both NTFS and Linux partitions. The parition tables generally have both a Windows NTFS partition and a Linux LVM partition. I need to work on all of these partitions to build a supertimeline (log2timeline) but I need a good way to find the ext partitions inside the LVM.

I am not familiar at all with and of the LVM commands, though I have a decent grasp on the terminology. Once I get to the byte offset of the ext partitions, I'll be fine, but I'd rather not scan the disk byte by byte for the partition headers and superblocks.

share|improve this question
2  
"Partitions" are not necessarily stored linearly in LVM physical volumes. I don't think you'll be able to mount those partitions without activating LVM on those images. –  Mat Aug 22 '11 at 6:04
1  
Any ideas on how to activate LVM on a file, rather than a block device? My initial experiments with pvdisplay did not turn up what I wanted. –  David Souther Aug 22 '11 at 6:09
    
If I did I'd have posted an answer :-) Sorry, I don't, but I thought pointing that out would help you in the search for a solution. –  Mat Aug 22 '11 at 6:11

1 Answer 1

up vote 1 down vote accepted

As far as I know, the Linux LVM kernel driver can only use block devices as physical volumes, and I'm not aware of any userland tools to access LVM volumes conveniently. So you need to make the physical volume appear as a loop device. (I assume you're running Linux; if not, run it, in a virtual machine if necessary.)

First, determine the offset of the partition. You can use fdisk for that:

fdisk -lu /path/to/disk.image

Note the offset of the partition you want (in the Start column), e.g. 123456. The unit is 512-byte sectors. Now create a loop device from the image, starting at the desired offset.

losetup -fv -o $((123456*512)) /path/to/disk.image

The partition will be available as the block device /dev/loop0 (the number may be different if you already have active loop devices).

There's a patch to the Linux kernel to access partitions on a loop device automatically. Debian applies it in its stock kernel; most other distributions don't. If you have this patch, you can run losetup -fv /path/to/disk.image and access the partitions on the device as e.g. /dev/loop0p1 and so on. You may need to pass an explicit argument to the driver to enable this feature: rmmod -r loop && modprobe loop max_part=63.

Now run pvscan. This should pick up /dev/loop0 or /dev/loop0p1 or whatever the device name turns out to be as a physical volume. You can then activate the volume group(s) on it with vgchange -ay and the access the logical volumes under /dev/mapper.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.