I am trying to open a debugfs on an image obtained from dd. I'm interested in the 3rd/5th partition.

Number  Start       End          Size         Type      File system     Flags
 1      32256B      254983679B   254951424B   primary   ext2            boot
 2      254983680B  509967359B   254983680B   primary   linux-swap(v1)
 3      509967360B  4293596159B  3783628800B  extended
 5      509999616B  4293596159B  3783596544B  logical   ext3

I've tried many variations, but the one that I thought would work was:

debugfs -b 4096 -s 509999616 drive.img

However, this has been giving me the error "Attempt to read block from filesystem resulted in short read while opening filesystem".

I've also tried not using the -b and -s options, which gives me "Bad magic number in super-block while opening filesystem"

What is the correct way to do this?

  • 1
    Related: Reading a filesystem from a whole disk image. Use losetup to create a device that represents just the partition you need. – Mark Plotnick Nov 18 '16 at 1:38
  • Ah! Of course. I had mounted via "mount -o ro,loop,offset=509967360 drive.img /mnt/mymountpoint". losetup shows the loop device and just do "sudo debugfs /dev/loop[#]" to get it open. Thanks! You're welcome to submit that as an answer if you care about credit :) – Maxthecat Nov 18 '16 at 1:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.