Raw File

    VM with partitions

    Useful when you're not able to access the VM through ssh or login.

    mkdir /mnt/168
    mount -o ro,loop,offset=1048576 -t auto /var/lib/vz/images/168/vm-168-disk-1.raw /mnt/168


    • offset is computed from start sector * size of a sector in bytes. You can retrieve these informations through fdisk -u sectors -l /var/lib/vz/images/168/vm-168-disk-1.raw
    • remove ro, if you need to write




    losetup /dev/loop0 /var/lib/vz/images/100/vm-100-disk-1.raw
    mount /dev/loop0p1 /mnt/tmpdiskrescue

    Note: I think it's possible to avoid losetup ... by using mount -o loop which will automatically find an available loopX


    umount /mnt/tmpdiskrescue
    losetup -d /dev/loop0

    Get informations from a binary image

    You can use binwalk

    See an example with an OpenWRT image:

    binwalk openwrt-mediatek-mt7622-ubnt_unifi-6-lr-v1-squashfs-sysupgrade.bin 
    0             0x0             Flattened device tree, size: 3879108 bytes, version: 17
    236           0xEC            LZMA compressed data, properties: 0x6D, dictionary size: 8388608 bytes, uncompressed size: 12048392 bytes
    3848628       0x3AB9B4        Flattened device tree, size: 29127 bytes, version: 17
    3932160       0x3C0000        Squashfs filesystem, little endian, version 4.0, compression:xz, size: 5916012 bytes, 1096 inodes, blocksize: 262144 bytes, created: 2023-11-14 13:38:11

    However, binwalk is heavy. An alternative is to use simple commands (less verbose, but lightweight) permitting to spot the partitions (if you know which one are in the image), then mount it (to read).

    # search for partition SquashFS header (list of header available at
    # which is 0x73717368
    hexdump openwrt-mediatek-mt7622-ubnt_unifi-6-lr-v1-squashfs-sysupgrade.bin -C | grep '73 71 73'
    #003c0000  68 73 71 73 48 04 00 00  43 78 53 65 00 00 04 00  |hsqsH...CxSe....|
    # extract the squashfs partition
    # first let see the sector size
    fdisk -lu openwrt-mediatek-mt7622-ubnt_unifi-6-lr-v1-squashfs-sysupgrade.bin 
    #Disk openwrt-mediatek-mt7622-ubnt_unifi-6-lr-v1-squashfs-sysupgrade.bin: 9.5 MiB, 9961984 bytes, 19457 sectors
    #Units: sectors of 1 * 512 = 512 bytes
    #Sector size (logical/physical): 512 bytes / 512 bytes
    #I/O size (minimum/optimal): 512 bytes / 512 bytes
    # its 512 bytes, let start at the right place (header offset bytes / sector size)
    dd if=openwrt-mediatek-mt7622-ubnt_unifi-6-lr-v1-squashfs-sysupgrade.bin of=openwrt.squashfs skip=$((16#003C0000 / 512))
    # NOTE 1: in this case squashfs was the latest partition and occupied all the remaining space.
    # in other scenarios you might have to set seek=
    # NOTE 2: with binwalk you can extract all FS with `binwalk --dd='.*' openwrt-mediatek-mt7622-ubnt_unifi-6-lr-v1-squashfs-sysupgrade.bin`
    # in a container you might need `--run-as=root`
    # control we extract what we want
    file openwrt.squashfs 
    #openwrt.squashfs: Squashfs filesystem, little endian, version 4.0, xz compressed, 5916012 bytes, 1096 inodes, blocksize: 262144 bytes, created: Tue Nov 14 13:38:11 2023
    # we can mount (yay)
    sudo mount -o ro,loop -t squashfs openwrt.squashfs /mnt/tmp
    ls /mnt/tmp/
    #bin  dev  etc  init  lib  lib64  mnt  overlay  proc  rom  root  sbin  sys  tmp  usr  var  www
    # alternatively to a mount you can do `unsquashfs openwrt.squashfs`
    # in case of ohter simplier file system you might directly use offset=
    mount -o ro,loop,offset=... -t squashfs openwrt-mediatek-mt7622-ubnt_unifi-6-lr-v1-squashfs-sysupgrade.bin /mnt/tmp