1

I have a 120 GB .dmg where I would like to study one directory. However, my Mac's HD is much smaller. I get a warning you cannot mount the directory.

I used the command to create the image

sudo dd if=/dev/sda of=/media/ubuntu/ntfsDisc/sda.hfs.dmg bs=512 status=progress

How can you mount/read some content of a big .dmg image in small HD?

0

1 Answer 1

2

The command sudo dd if=/dev/sda of=/media/ubuntu/ntfsDisc/sda.hfs.dmg doesn't create a mountable dmg file!

Your "sda" - which is the complete /dev/disk0 translated to OS X naming conventions - probably contains several partition tables (1st and 2nd GUIDpt/MBR), free space and several file systems on the different partitions (sda1-sda4?).

So sda.hfs.dmg neither contains a valid file system (parts of the file could be extracted to contain one though) nor does it behave like a typical dmg. Instead it's a raw (data) file.


Example: Whenever I have to backup a rescue thumb drive containing OS X (or save the content because I need the thumb drive for other purposes) I execute:

dd if=/dev/disk4 of=/Users/user/backup/OSXRescue.raw bs=1m

Besides the main partition this "raw" file also contains 3 partition tables (1st and 2nd GUIDpt/MBR), some "unallocated" space, an EFI and a Recovery HD partition. The file has the same size as the thumb drive and but is not mountable because it doesn't contain a real and consistent file system as expected by diskutil or hdiutil.

To restore this OSXRescue.raw to the same thumb drive I have to execute

dd if=/Users/user/backup/OSXRescue.raw of=/dev/disk4 bs=1m

This should restore an exact copy of the content of the rescue thumb drive (even the remnants of deleted files which don't occur in the file system(s) of the original thumb drive).

I may also use another drive (with at least the same size as the original thumb drive) to restore the full content of the rescue thumb drive to it. The result is fully bootable. The previous content of the external drive will be overwritten though!


To rescue your .tex file you have to dd the "raw" file to a real hard drive. This will restore the original partitions and you should be able to modify the wrong partition type of partition 2 (diskXs2), then mount the HFS+ partition and examine it with a data recovery tool.

You may be able to mount the HFS+ part of the raw file in OS X similar to this Linux how-to with on-board tools or after installing additional tools (probably with Homebrew). I didn't test this though.

6
  • Can you use the sda.hfs.dmg image somehow although it does not mount? Commented Jun 6, 2016 at 4:03
  • 1
    @Masi Sure, you can dd it back to another hard drive and then examine it. This will restore the complete content of your internal disk on an external one. You may also search for the tex file content in the sda.hfs.dmg (I'd prefer to use the *.bin or *.raw suffix) with a hex reader (if you know specific strings of the lost file).
    – klanomath
    Commented Jun 6, 2016 at 4:09
  • How can you search the .dmg image? I know the path to the file. I would like to search .tex files. generally. Commented Jun 6, 2016 at 7:21
  • @Masi The raw copy of a disk is no "structured" file or file system (in contrary to a jpeg, a doc file or an NTFS volume). It's just a bunch of bits and bytes. You may just open the file (yes the 120 gb file!) in HexFiend (a hex editor) and search for specific strings. Depending on the position of the tex file on the disk (= the raw file) this may take a while because several GigaBytes have to be scanned to find the first occurrence of the search string.
    – klanomath
    Commented Jun 6, 2016 at 7:32
  • Can you give any one-liners to start? I need a systematic approach. Commented Jun 6, 2016 at 8:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .