Mount E01 containing VMDK/XFS from RHEL system
You're provided with an E01 of a VMDK from a RedHat Enterprise Linux system, which is formatted using XFS and is part of an LVM group.
We created a RedHat Linux (RHEL) v9.2 virtual machine with a single 10GB virtual disk, formatted with XFS, and part of an LVM. We created a file called 'files.txt' on the user's desktop.
We have the following file; RHEL-9.2-LVM-XFS.E01
The following will provide two examples of how to mount an E01 file and inspect its contents.
My preference is to use a combination of xmount, kpartx, and lvscan. This will provide you with the ability to mount the E01 (either single file or split segments), create/map partitions using kpartx, scan for LVM segments using lvscan, and then mount it using mount.
The second method is to use ewfmount, and guestfish.
You'll need the following tools;
xmount; mount/convert mulitple input file types (including ewf/E01 images, virtual disks, etc)
kpartx; reads partition tables on block devices and maps partitions
diskinfo; display information about a disk device
ewftools; mount E01 files read-only (no cache, optional)
sleuthkit; inspect filesystem information using mmls and fls (optional)
$ file RHEL-9.2-LVM-XFS.E01
RHEL-9.2-LVM-XFS.E01: EWF/Expert Witness/EnCase image file formatFirst method - using xmount and kpartx
Use xmount to mount the disk
$ sudo xmount --in ewf RHEL-9.2-LVM-XFS.E01 --out vmdk --cache rhel-cache /mnt/RHEL--in ewf specifies input format (can be a range of E01 segments (use E?? instead of E01))
-- out vmdk specifies output format (can be multiple formats, raw, vhd, vmdk, etc)
--cache rhel-cache the output temp cache folder (as a write overlay) for temporary image writes
/mnt/RHEL the location we want to mount our image
Identify partitions from raw (dd) image
We can see from the output of both disktype and fdisk that the second partition (starting at offset 2099200) is a Linux LVM member.
Use kpartx to mount both partitions
Mount root partition to destination mount point
See if we can access the file 'files.txt' on the user's desktop
Second method - using ewfmount and guestfish
We can see the above partition (p2) is an LVM member.
Now, since ewfmount doesn't support write overlay, I always seem to run into errors with XFS filesystems (even mounting using the -ro option). Probably PEBKAC, tbh.
Run vgscan to see volume group objects
Run lvscan to see logical volumes;
Activate;
Try and mount /dev/rhel/root (which is just a symlink back to /dev/mapper/dm-*)
Run dmesg to see a stack of I/O read/write errors;
So we can mount /dev/rhel/root using the -ro and loop options;
Another way is to mount using guestfish
In another terminal/tab
Last updated