osx - Mount Core Storage partitions on image of hard drive created with ddrescue

07
2014-07

Matthew Strax-Haber

How do I mount a whole-disk image with an encrypted CoreStorage partition?

Update: I found the answer!

It was super-simple:

hdiutil attach -nomount somePath.img

The "nomount" flag is critical because without it the command will fail as the image is not directly mountable. Once hdiutil has attached the diskimage, you should see the CoreStorage volume show up in diskutil cs list and, if everything is behaving normally, it will either automatically mount in the Finder or ask for your password (because the CoreStorage daemon does not respect the "nomount" flag according to my observation under OSX 10.9.2).

Background: I am trying to recover data off a hard drive with a few bad blocks. This is irrelevant as the bad blocks are contiguous and in the middle of the drive, nowhere near the partition tables.

I created an image of the drive using the following command:
ddrescue /dev/disk1 ~/tmp/somePath.img ~/tmp/somePath.img.log
(For those unfamiliar with ddrescue, this is essentialy the same as dd with better failure recovery)

Disk1 was a physical drive that contained a CoreStorage volume as shown here:
-> diskutil list disk1
/dev/disk1
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *2.0 TB     disk1
   1:                        EFI EFI                     209.7 MB   disk1s1
   2:          Apple_CoreStorage                         2.0 TB     disk1s2
   3:                 Apple_Boot Boot OS X               134.2 MB   disk1s3
How do I mount this? I have tried mounting it using the Finder and Disk Utility without success. Using hdid has the following result:
-> hdid -section 409640 -nomount -imagekey diskimage-class=CRawDiskImage somePath.img
/dev/disk11

-> diskutil list disk11
/dev/disk11
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:                                                   *2.0 TB     disk11
I am not sure what to do next... Any advice, SuperUser community??

Answers

Know someone who can answer? Share a link to this question via email, Google+, Twitter, or Facebook.

Related Answers

mark4o

When reading a CD, /dev/disk1 will access the entire 2352 bytes of each block. This is useful for reading an audio CD. It is sometimes called a raw image, or a CloneCD image.

On a MODE 1 CD-ROM, 2048 bytes of each 2352-byte block is used for data and most of the rest is used for error correction codes, because the integrity of the data is so important. With file system data, it is not possible to just ignore an erroneous sample like on an audio CD. Use /dev/disk1s0 to read the 2048-byte blocks, using the error correction codes to detect and correct any errors within each block. An ISO 9660 file system image is made up of these 2048-byte blocks, and you will be able to mount the resulting image directly.

Wikipedia has more information on the different formats.

If the CD-ROM contains a file system then there is not much point in capturing it in the raw format, since the error correction codes are redundant and will be recreated when you record the ISO image to another CD-ROM. However, if you already have the raw image and want to strip off the extra information, there is a program called ccd2iso which will do that.

Diago

IMG and ISO's mount natively in OSX. Alternatively use the Disk Utility in Leopard.

OSX cannot read RAW or CSFS images and mount them. You will therefore need to use dd and create an ISO of the raw image which can then be mounted.

To create an ISO using DD:

dd if=[filename.img] of=file.iso bs=2048

Loïc Wolff

Double-clicking didn't work?

It works for .iso files, maybe you should try to create an iso and mount it that way. I think you can create iso files with Disk Utility.app

William Hilsum

Try this -

go to the directory of the image and type -

hdiutil mount MY_CDROM_IMAGE.img

The guide I read this from uses ISO, but I would assume it also works for IMG files

AngelCervantes

I know it is late. But I saw this question and got the answer from your comments. kinokijuf said its a raw image. Then derobert mentioned that a raw image is what is usually called an iso image. So then change the name or extension of the file to something like > image.iso

The command would be something like:

  mv image.img image.iso

The just double-click the iso file, and you got your image :).

Hope it helps someone.

Home

osx - Mount Core Storage partitions on image of hard drive created with ddrescue