如何从 dd/raw/vmdk 映像挂载 LVM 卷?

gie*_*s0r 5 linux mount partitioning lvm forensics

输入:HDD 的 RAW/DD 图像。fdisk -l显示分区

fdisk -l image.dd 
Disk image.dd: 15 GiB, 16106127360 bytes, 31457280 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x00093f57

Device            Boot  Start      End  Sectors  Size Id Type
image-1.dd1 *      2048   499711   497664  243M 83 Linux
image-1.dd2      501758 31455231 30953474 14.8G  5 Extended
image-1.dd5      501760 31455231 30953472 14.8G 8e Linux LVM
Run Code Online (Sandbox Code Playgroud)

尝试使用start-sector*sector size(如此处所述;通常用于安装分区)来安装它会带来错误

(„mount: /mnt/vmdisk: unknown filesystem type 'LVM2_member'.“
Run Code Online (Sandbox Code Playgroud)

可以使用, ,等工具在此处找到最充分的解决方案。但是这些工具没有选项可以扫描这些卷的原始文件lvm2vgscanvgchangelvs

那么如何访问Linux LVMusingmount或类似内容的内容呢?

gie*_*s0r 8

安装 kpartx

sudo apt-get install kpartx
Run Code Online (Sandbox Code Playgroud)

整合卷dev/mapper使用

sudo kpartx -a -v image.dd
Run Code Online (Sandbox Code Playgroud)

检查dev/mapper以查看您的分区

administrator@cdc-ansible:~$ ls -l /dev/mapper/
total 0
lrwxrwxrwx 1 root root       7 Nov 19 12:50 123--yourname--ewu--vg-root -> ../dm-3
lrwxrwxrwx 1 root root       7 Nov 19 12:50 123--yourname--ewu--vg-swap_1 -> ../dm-4
crw------- 1 root root 10, 236 Nov 19 07:59 control
lrwxrwxrwx 1 root root       7 Nov 19 12:50 loop2p1 -> ../dm-0
lrwxrwxrwx 1 root root       7 Nov 19 12:50 loop2p2 -> ../dm-1
lrwxrwxrwx 1 root root       7 Nov 19 12:50 loop2p5 -> ../dm-2
Run Code Online (Sandbox Code Playgroud)

之后sudo lvscan找到lv的名字:

sudo lvscan
  ACTIVE            '/dev/123--yourname--ewu--vg/root' [12.71 GiB] inherit
  ACTIVE            '/dev/123--yourname--ewu--vg/swap_1' [<2.00 GiB] inherit
Run Code Online (Sandbox Code Playgroud)

再次尝试挂载:

sudo mount /dev/123--yourname--ewu--vg/root /mnt/rootfs 
Run Code Online (Sandbox Code Playgroud)

挂载的文件系统(tada!):

ll /mnt/rootfs/
total 116
drwxr-xr-x  22 root root  4096 Oct 30 09:37 ./
drwxr-xr-x   5 root root  4096 Nov 19 12:59 ../
drwxr-xr-x   2 root root  4096 Oct 30 09:35 bin/
drwxr-xr-x   2 root root  4096 Sep 28  2015 boot/
drwxr-xr-x   4 root root  4096 Sep 28  2015 dev/
drwxr-xr-x 102 root root 12288 Oct 30 09:37 etc/
drwxr-xr-x   4 root root  4096 Nov 11  2016 home/
drwxr-xr-x  22 root root  4096 Nov 24  2017 lib/
drwxr-xr-x   2 root root  4096 Feb  2  2018 lib64/
drwx------   2 root root 16384 Sep 28  2015 lost+found/
drwxr-xr-x   4 root root  4096 Sep 28  2015 media/
drwxr-xr-x   2 root root  4096 Nov 24  2017 mnt/
drwxr-xr-x   3 root root  4096 Aug 26  2016 opt/
drwxr-xr-x   2 root root  4096 Apr 10  2014 proc/
drwx------   7 root root  4096 Oct  9 10:08 root/
drwxr-xr-x   2 root root  4096 Sep 28  2015 run/
drwxr-xr-x   2 root root 12288 Oct 30 09:35 sbin/
drwxr-xr-x   2 root root  4096 Jul 22  2014 srv/
drwxr-xr-x   2 root root  4096 Mar 13  2014 sys/
drwxrwxrwt   8 root root  4096 Oct 30 09:43 tmp/
drwxr-xr-x  10 root root  4096 Sep 28  2015 usr/
drwxr-xr-x  12 root root  4096 Sep 28  2015 var/
lrwxrwxrwx   1 root root    30 Oct 30 09:36 vmlinuz -> boot/vmlinuz-4.4.0-137-generic
Run Code Online (Sandbox Code Playgroud)

感谢这些来源1 2 3

顺便说一下,如果您来自其他映像类型(例如 VMDK、VDI 等),请使用此链接将其转换为 DD。