I was recently converting a Windows installation from a physical desktop to a virtual machine. Because the installation was an OEM installation the P2V conversion failed the “hardware” check and the target VM was unregistered. The only way to fix was to do a repair install changing the installation from an OEM to a Retail version of Windows. This needed to be done on the physical source desktop. There’s no way I was going to attempt this without a total backup of the system. I could have just copied important files, but I decided a disk clone was more appropriate. I booted off of a
Debian rescue cd, mounted a
NFS share, and dd’d a copy of the entire drive to a flat file.
# mkdir /mnt/nfsserver/diskclone # mount nfsserver:/vol/diskclone /mnt/nfsserver/diskclone # cd /mnt/nfsserver/diskclone # # dd if=/dev/sda of=desktop.img 156250000+0 records in 156250000+0 records out 80000000000 bytes (80 GB) copied, 7079.64601 seconds, 11.3 MB/s # # ls -l total 78278496 -rw-r--r-- 1 root root 80000000000 2013-05-20 15:47 desktop.img
I then needed to mount the image and take a look at the contents. A flat disk image file is just a block for block copy of the actual disk, so the first step is to look at the partition table listed in sectors and find the offset. The offset will tell mount where the beginning of the file system is.
# losetup /dev/loop0 desktop.img # # fdisk -l -u /dev/loop0 Disk /dev/loop0: 80.0 GB, 80000000000 bytes 255 heads, 63 sectors/track, 9726 cylinders, total 156250000 sectors Units = sectors of 1 * 512 = 512 bytes Device Boot Start End Blocks Id System /dev/loop0p1 * 63 156232124 78116031 7 HPFS/NTFS # #
Find the offset by multiplying the 63 (start sector) by 512 bytes ( 63*512 ) and the offset is 32256. Now we can tell mount where the start is.
# mkdir /mnt/diskimage # mount -t ntfs -o offset=32256,ro desktop.img /mnt/diskimage #
I mounted readonly so that we don’t mess anything up. You may need to install ntfsprogs to be able to read an NTFS file system (apt-get install ntfsprogs) if you don’t have it installed already