LVM tools on raw block copy

Question

I have several raw block copies of disks that have both NTFS and Linux partitions. The parition tables generally have both a Windows NTFS partition and a Linux LVM partition. I need to work on all of these partitions to build a supertimeline (log2timeline) but I need a good way to find the ext partitions inside the LVM.

I am not familiar at all with and of the LVM commands, though I have a decent grasp on the terminology. Once I get to the byte offset of the ext partitions, I'll be fine, but I'd rather not scan the disk byte by byte for the partition headers and superblocks.

Answer 1

As far as I know, the Linux LVM kernel driver can only use block devices as physical volumes, and I'm not aware of any userland tools to access LVM volumes conveniently. So you need to make the physical volume appear as a loop device. (I assume you're running Linux; if not, run it, in a virtual machine if necessary.)

First, determine the offset of the partition. You can use fdisk for that:

fdisk -lu /path/to/disk.image

Note the offset of the partition you want (in the Start column), e.g. 123456. The unit is 512-byte sectors. Now create a loop device from the image, starting at the desired offset.

losetup -fv -o $((123456*512)) /path/to/disk.image

The partition will be available as the block device /dev/loop0 (the number may be different if you already have active loop devices).

There's a patch to the Linux kernel to access partitions on a loop device automatically. Debian applies it in its stock kernel; most other distributions don't. If you have this patch, you can run losetup -fv /path/to/disk.image and access the partitions on the device as e.g. /dev/loop0p1 and so on. You may need to pass an explicit argument to the driver to enable this feature: rmmod -r loop && modprobe loop max_part=63.

Now run pvscan. This should pick up /dev/loop0 or /dev/loop0p1 or whatever the device name turns out to be as a physical volume. You can then activate the volume group(s) on it with vgchange -ay and the access the logical volumes under /dev/mapper.