From an old disk which I don't have at hand, I have created a file named winxp.img using partimage. As the filename suggests, the partition contained Windows XP and was formatted with NTFS.

(The file contains only a 4.6 GiB NTFS partition, not the whole disk.)

How can I access the files inside this image without restoring it onto a physical disk?


As mentioned in partimage documentation1,

(...) It is also impossible to extract a file from an image.

But need not despair! With the power of Unix philosophy ("Everything is a file"), you can access the files without the need to allocate disc space for a separate partition. And here's how:

..0. You say your image created with partimage is named winxp.img and it holds the backup of a 4.6 GiB NTFS partition. Fine. You have more than 4.6 GiB of free space on your Linux system? Perfect! (Otherwise, get some free space.) You can restore the contents of partimage archive to a "dummy" file that will pretend to be a real partition.

  1. First, you need to create an empty file of at least 4.6 GiB size:

    dd if=/dev/zero of=dummy_disk.raw bs=1M count=4711

    (The value of count parameter comes from rounding up 1024*4.6 to achieve an amount above 4.6 GiB. For an exact value, you would need to know the bytesize of the original partition - but if you have enough free space, you can simply use 5K instead, to be on the safe side.)

    Now, tell partimage to restore your NTFS filesystem to that dummy space. What? It refuses to treat a normal file as hard drive partition? No problem - if Unix says "Everything is a file", then a disk handle such as /dev/sda1 is a file also - so we just need to reverse this situation and supply a "block device" type of file to partimage - and that is where loopback device construct comes in handy (read on).

  2. Create a loopback device attached to your newly created dummy disk (this needs root privileges on most systems, therefore sudo is used):

    sudo losetup -f --show dummy_disk.raw

    The command will output something like /dev/loop0 - that is the loopback device name you need to supply to partimage instead of real partition. You can also check that the loopback device is attached to your file by running losetup -a - this is of course optional.

  3. Run partimage to restore the archived filesystem to the dummy file (replace /dev/loop0 with the name you got in the previous step) :

    partimage restore /dev/loop0 winxp.img

    Once it finishes successfully, your dummy_disk.raw file will contain the restored NTFS filesystem! You just need to mount it now, in order to access the files:

  4. Mount the dummy. You will just need an empty directory for this. You can create it with mkdir mountpoint or use an existing one. There are two alternative ways to mount the filesytem:

    sudo mount -t ntfs-3g /dev/loop0 mountpoint

    (replace /dev/loop0 with the device name you got previously)


    sudo mount -o loop -t ntfs-3g dummy_disk.raw mountpoint

    The former method will use the existing loopback device, while the latter will automatically create a new one (resource usage difference is negligible).

That's it! The contents of your archive are now accessible under the mountpoint directory.

Side note: For the future tasks of archiving filesystems, consider using a more up-to-date tool, such as FSAsarchiver. I'm not saying it's perfect, but at least it is still maintained. You can check the differences between those two tools at the FSArchiver wiki page.

1 This might be slightly inaccurate, since the software is unmaintained and the website lists that page of documentation as "Outdated".

  • How do you disconnect the loop device (i.e. /dev/loop0) ? – Drew Chapin Apr 26 '18 at 15:50

I don't think you can do this directly as there is no "partimagefs" solution that I'm aware. You could check fuse tools but I think there's an easier way...

You can use a virtual disk (with KVM, qemu, VirtualBox) and let partimage unpack the image there. If you use the raw format you can then safely mount it.

The necessary steps are described here

  • The offset=32256 as described on the page you're referring to, is only required when using an entire disk image. According to Alois, this is not the case – jippie May 21 '12 at 20:52

I haven't got a NTFS volume handy, but this may help you forward:

mount -t ntfs -o loop,ro /path/to/winxp.img /mnt

Where /mnt is an unused mountpoint. Many distributions have /mnt available, but you can easily create another one when necessary. ro indicates 'read-only' which is a good plan when you don't want your image being changed.

  • 1
    It isn't a raw image, so this won't work – psusi May 21 '12 at 23:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.