gie*_*s0r 5 linux mount partitioning lvm forensics
输入:HDD 的 RAW/DD 图像。fdisk -l
显示分区
fdisk -l image.dd
Disk image.dd: 15 GiB, 16106127360 bytes, 31457280 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x00093f57
Device Boot Start End Sectors Size Id Type
image-1.dd1 * 2048 499711 497664 243M 83 Linux
image-1.dd2 501758 31455231 30953474 14.8G 5 Extended
image-1.dd5 501760 31455231 30953472 14.8G 8e Linux LVM
Run Code Online (Sandbox Code Playgroud)
尝试使用start-sector*sector size
(如此处所述;通常用于安装分区)来安装它会带来错误
(„mount: /mnt/vmdisk: unknown filesystem type 'LVM2_member'.“
Run Code Online (Sandbox Code Playgroud)
可以使用, ,等工具在此处找到最充分的解决方案。但是这些工具没有选项可以扫描这些卷的原始文件。lvm2
vgscan
vgchange
lvs
那么如何访问Linux LVM
usingmount
或类似内容的内容呢?
安装 kpartx
sudo apt-get install kpartx
Run Code Online (Sandbox Code Playgroud)
整合卷dev/mapper
使用
sudo kpartx -a -v image.dd
Run Code Online (Sandbox Code Playgroud)
检查dev/mapper
以查看您的分区
administrator@cdc-ansible:~$ ls -l /dev/mapper/
total 0
lrwxrwxrwx 1 root root 7 Nov 19 12:50 123--yourname--ewu--vg-root -> ../dm-3
lrwxrwxrwx 1 root root 7 Nov 19 12:50 123--yourname--ewu--vg-swap_1 -> ../dm-4
crw------- 1 root root 10, 236 Nov 19 07:59 control
lrwxrwxrwx 1 root root 7 Nov 19 12:50 loop2p1 -> ../dm-0
lrwxrwxrwx 1 root root 7 Nov 19 12:50 loop2p2 -> ../dm-1
lrwxrwxrwx 1 root root 7 Nov 19 12:50 loop2p5 -> ../dm-2
Run Code Online (Sandbox Code Playgroud)
之后sudo lvscan
找到lv的名字:
sudo lvscan
ACTIVE '/dev/123--yourname--ewu--vg/root' [12.71 GiB] inherit
ACTIVE '/dev/123--yourname--ewu--vg/swap_1' [<2.00 GiB] inherit
Run Code Online (Sandbox Code Playgroud)
再次尝试挂载:
sudo mount /dev/123--yourname--ewu--vg/root /mnt/rootfs
Run Code Online (Sandbox Code Playgroud)
挂载的文件系统(tada!):
ll /mnt/rootfs/
total 116
drwxr-xr-x 22 root root 4096 Oct 30 09:37 ./
drwxr-xr-x 5 root root 4096 Nov 19 12:59 ../
drwxr-xr-x 2 root root 4096 Oct 30 09:35 bin/
drwxr-xr-x 2 root root 4096 Sep 28 2015 boot/
drwxr-xr-x 4 root root 4096 Sep 28 2015 dev/
drwxr-xr-x 102 root root 12288 Oct 30 09:37 etc/
drwxr-xr-x 4 root root 4096 Nov 11 2016 home/
drwxr-xr-x 22 root root 4096 Nov 24 2017 lib/
drwxr-xr-x 2 root root 4096 Feb 2 2018 lib64/
drwx------ 2 root root 16384 Sep 28 2015 lost+found/
drwxr-xr-x 4 root root 4096 Sep 28 2015 media/
drwxr-xr-x 2 root root 4096 Nov 24 2017 mnt/
drwxr-xr-x 3 root root 4096 Aug 26 2016 opt/
drwxr-xr-x 2 root root 4096 Apr 10 2014 proc/
drwx------ 7 root root 4096 Oct 9 10:08 root/
drwxr-xr-x 2 root root 4096 Sep 28 2015 run/
drwxr-xr-x 2 root root 12288 Oct 30 09:35 sbin/
drwxr-xr-x 2 root root 4096 Jul 22 2014 srv/
drwxr-xr-x 2 root root 4096 Mar 13 2014 sys/
drwxrwxrwt 8 root root 4096 Oct 30 09:43 tmp/
drwxr-xr-x 10 root root 4096 Sep 28 2015 usr/
drwxr-xr-x 12 root root 4096 Sep 28 2015 var/
lrwxrwxrwx 1 root root 30 Oct 30 09:36 vmlinuz -> boot/vmlinuz-4.4.0-137-generic
Run Code Online (Sandbox Code Playgroud)
顺便说一下,如果您来自其他映像类型(例如 VMDK、VDI 等),请使用此链接将其转换为 DD。