Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I created an image of a failing drive with:

dd if=/dev/sde of=/mnt/image001.dd

The drive had only two partitions:

   Device Boot      Start         End      Blocks   Id  System
/dev/sde1   *           1          13      102400    7  HPFS/NTFS
/dev/sde2              13       60802   488282112    7  HPFS/NTFS

How can I split the image (image001.dd) into two or three files (1: MBR; 2: Partition 1; 3: Partition 2) so that I can mount the filesystems in it?

A solution I've found that wouldn't work for me is to use split to create many 512K files, then cat them back together into three files (1: 512K, 2: 105M, 3: the rest), but I don't have the disk space for that.

I have already copied the entire image to a new drive, and it boots and mostly works. It seems that the FS was corrupted on the old failing drive, and dd copied the corrupted parts (as it should), and I wrote them to the new drive. My solution is to mount the FS that I copied and the copy just the files (using rsync or something) so that hopefully I won't copy the bad bits.

UPDATE 1: I've tried dd if=/mnt/image001.dd of=/mnt/image001.part1.dd bs=512 count=204800 skip=1 but mount complains that NTFS signature is missing, so I think I didn't do it right.

share|improve this question
up vote 16 down vote accepted

You don't need to split this at all.

Use parted to get details about the partition table:

parted image001.dd

In parted, switch to byte units with the command u, then B. After that, issue the command print.

You will get an output that looks like this (output is from an actual system, not an image):

Model: Virtio Block Device (virtblk)
Disk /dev/vda: 25165824000B
Sector size (logical/physical): 512B/512B
Partition Table: msdos

Number  Start         End           Size          Type     File system     Flags
 2      1048576B      400556031B    399507456B    primary  ext4            boot
 3      400556032B    21165506559B  20764950528B  primary  ext4
 1      21165506560B  25164775423B  3999268864B   primary  linux-swap(v1)

You can use the Start number as an offset for a loopback mount:

mount -o loop,ro,offset=400556032 image001.dd /mnt/rescue

would mount the third partition at /mnt/rescue.

share|improve this answer
Both this and kpartx solve my problem. I chose this answer because I'd imagine that parted is more common than kpartx, however kpartx is a bit easier. – Joe A Feb 26 '12 at 6:32

It's much better to simply use kpartx tool.

usage : kpartx [-a|-d|-l] [-v] wholedisk
    -a add partition devmappings
    -d del partition devmappings
    -l list partitions devmappings that would be added by -a


# kpartx -l whole_disk # only listing
loop0p1 : 0 518144 /dev/loop0 2048
loop0p2 : 0 3674112 /dev/loop0 520192
# kpartx -a whole_disk 
# file -sL /dev/mapper/loop0p*
/dev/mapper/loop0p1: Linux/i386 swap file (new style), version 1 (4K pages), size 64767 pages, no label, UUID=e4990860-c87d-4850-9e8d-ecb0a0506516
/dev/mapper/loop0p2: SGI XFS filesystem data (blksz 4096, inosz 256, v2 dirs)

At this point I can mount /dev/mapper/loop0p2.

After unmounting call kpartx -d whole_disk to clean up.

share|improve this answer
+1 This is nice, never heard of that tool. – Sven Feb 25 '12 at 20:03
Both this an SvenW's answer below work very well! Both let me mount a partition within the drive image. – Joe A Feb 26 '12 at 6:31

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.