search

Mount E01 containing VMDK/XFS from RHEL system

You're provided with an E01 of a VMDK from a RedHat Enterprise Linux system, which is formatted using XFS and is part of an LVM group.

We created a RedHat Linux (RHEL) v9.2 virtual machine with a single 10GB virtual disk, formatted with XFS, and part of an LVM. We created a file called 'files.txt' on the user's desktop.

We have the following file; RHEL-9.2-LVM-XFS.E01

The following will provide two examples of how to mount an E01 file and inspect its contents.

My preference is to use a combination of xmount, kpartx, and lvscan. This will provide you with the ability to mount the E01 (either single file or split segments), create/map partitions using kpartx, scan for LVM segments using lvscan, and then mount it using mount.

The second method is to use ewfmount, and guestfish.

You'll need the following tools;

  • xmount; mount/convert mulitple input file types (including ewf/E01 images, virtual disks, etc)

  • kpartx; reads partition tables on block devices and maps partitions

  • diskinfo; display information about a disk device

  • ewftools; mount E01 files read-only (no cache, optional)

  • sleuthkit; inspect filesystem information using mmls and fls (optional)

$ file RHEL-9.2-LVM-XFS.E01
RHEL-9.2-LVM-XFS.E01: EWF/Expert Witness/EnCase image file format

hashtag
First method - using xmount and kpartx

Use xmount to mount the disk

$ sudo xmount --in ewf RHEL-9.2-LVM-XFS.E01 --out vmdk --cache rhel-cache /mnt/RHEL

--in ewf specifies input format (can be a range of E01 segments (use E?? instead of E01))

-- out vmdk specifies output format (can be multiple formats, raw, vhd, vmdk, etc)

--cache rhel-cache the output temp cache folder (as a write overlay) for temporary image writes

/mnt/RHEL the location we want to mount our image

Identify partitions from raw (dd) image

We can see from the output of both disktype and fdisk that the second partition (starting at offset 2099200) is a Linux LVM member.

Use kpartx to mount both partitions

Mount root partition to destination mount point

See if we can access the file 'files.txt' on the user's desktop

hashtag
Second method - using ewfmount and guestfish

We can see the above partition (p2) is an LVM member.

Now, since ewfmount doesn't support write overlay, I always seem to run into errors with XFS filesystems (even mounting using the -ro option). Probably PEBKAC, tbh.

Run vgscan to see volume group objects

Run lvscan to see logical volumes;

Activate;

Try and mount /dev/rhel/root (which is just a symlink back to /dev/mapper/dm-*)

Run dmesg to see a stack of I/O read/write errors;

So we can mount /dev/rhel/root using the -ro and loop options;

Another way is to mount using guestfish

In another terminal/tab

PreviousMinIO/S3/R2 ghost filesNextDisk images for various filesystems and configurations

Last updated