SIFT Workstation: Video 3 – Mount Disk Image via Command Line

Welcome back for our third video.

In this video I show you how to use a couple different commands to mount a disk image that we created in video two. Some of the commands I show you how to use are; mmls, losetup and mount. I also show you how to calculate the partition offset so we can specify that offset within the loop device setup command.

I also mentioned in the video that I would give you a bit more information about the mmls command and its output.

Well, here you go:

Silvrback blog image

Calculating the Partition Offset

Partition Offset = Starting offset (in our case 2048) *  Bytes per sector (512) = 1048576

You can do this via the command line by typing; echo $((512 * 2048)) that way you don't have to stop and use your mouse.

  • 00, 01, 02 is an Index
  • Slot: shows the location in the media management structures where the partition entry came from. So 00:00 in our picture above shows that it's the first entry in the first partition table. (01:00 would be the first entry in the second partition table.)
  • Start, End, and Length are all in sectors
  • Length is given to you so you don't have to subtract the ending and starting addresses if you were to run a dd type command.