Suppose that you clone a harddrive to a file on another harddrive (dd if=/dev/sda of=/home/user/dump.img). All of the partitions on the drive are in the dump file. How do you access a file on one of the partitions?

I’ve had to do this several times in the last two months. Today, my image is 50GB (not an exact harddrive image because I took a round-about way to pull the data):

ls -lh recovered.img 

-rw-r--r-- 1 chris root 50G Jul  9 15:48 recovered.img

sfdisk (probably as root) will show where the partitions are at:

sfdisk -l -uS recovered.img
Disk recovered.img: cannot get geometry
Disk recovered.img: 6527 cylinders, 255 heads, 63 sectors/track
Units = sectors of 512 bytes, counting from 0
   Device Boot    Start       End   #sectors  Id  System
recovered.img1          2048  93114367   93112320   7  HPFS/NTFS
recovered.img2             0         -          0   0  Empty
recovered.img3             0         -          0   0  Empty
recovered.img4             0         -          0   0  Empty

This indicates one NTFS partition at sector 2048. In order to turn that number into a byte offset, you have to multiply it by the number of cylinders on the drive (despite what sfdisk claims it knows about the file). That number has always been 512 for my data operations, which means 2048 * 512 = 1048576. With this magic number, we should be able to mount the partition as root:

mount -t ntfs-3g -o loop,offset=1048576 recovered.img /mnt/hd

The “loop” option tells “mount” that we are mounting a file instead of a literal device. If you can’t figure out the rest, go read the man page for mount.