I got a virtual disk from a CyberSecurity vendor, I want to check the files on it.
When I set my virtual machine boot from this disk, it can normally boot.
I want to check the files on it, so I attach this disk to my Rocky linux VM.
But when I try to mount this disk, I got this:
[root@rocky ~]# mount /dev/sda1 /mnt/
mount: /mnt: wrong fs type, bad option, bad superblock on /dev/sda1, missing codepage or helper program, or other error.
And fdisk -l
result seems no partition is bootable, and could not show the file system type:
[root@rocky ~]# fdisk -l /dev/sda
Disk /dev/sda: 2 GiB, 2147483648 bytes, 4194304 sectors
Disk model: VMware Virtual S
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x00000000
Device Boot Start End Sectors Size Id Type
/dev/sda1 8192 270335 262144 128M 83 Linux
/dev/sda2 270336 794623 524288 256M 83 Linux
/dev/sda3 794624 1843199 1048576 512M 83 Linux
/dev/sda4 1843200 4194303 2351104 1.1G 83 Linux
Other commands like file -sL
, lsblk
also cound not show the file system:
[root@rocky ~]# file -sL /dev/sda
/dev/sda: DOS/MBR boot sector
[root@rocky ~]# file -sL /dev/sda1
/dev/sda1: data
[root@rocky ~]# file -sL /dev/sda2
/dev/sda2: data
[root@rocky ~]# blkid /dev/sda1
[root@rocky ~]# lsblk -f
NAME FSTYPE FSVER LABEL UUID FSAVAIL FSUSE% MOUNTPOINTS
sda
├─sda1
├─sda2
├─sda3
└─sda4
sdb
├─sdb1 crypto_LUKS 1 cd0f54e1-c215-4f6a-ab52-cf45dbd5fe96
├─sdb2 crypto_LUKS 1 35474f2f-1152-4c42-8c2c-0fd31b8efd93
├─sdb3 crypto_LUKS 1 3e03772c-43cf-4f95-9296-cf31257e9555
├─sdb4
├─sdb5 crypto_LUKS 1 b7284d45-1c55-4824-8f53-bb634850a0ca
├─sdb6 crypto_LUKS 1 60b950b0-681c-438e-840e-f324ba69c0eb
└─sdb7 swap 1 4af799e0-846f-4b44-9162-65864992b315
nvme0n1
├─nvme0n1p1 xfs e520efe8-6d78-4257-888f-29fa74a7ac05 826M 19% /boot
└─nvme0n1p2 LVM2_member LVM2 001 zND1Rf-olxV-jiuN-7ZHN-EuK4-IGr1-2H08Qv
└─rl-root xfs 508099b5-3255-4e00-b28e-fb07efb80f2c 37.7G 23% /
[root@rocky ~]# lsblk -no FSTYPE /dev/sda
[root@rocky ~]# lsblk -no FSTYPE /dev/sda1
[root@rocky ~]# lsblk -no name,fstype
sda
├─sda1
├─sda2
├─sda3
└─sda4
sdb
├─sdb1 crypto_LUKS
├─sdb2 crypto_LUKS
├─sdb3 crypto_LUKS
├─sdb4
├─sdb5 crypto_LUKS
├─sdb6 crypto_LUKS
└─sdb7 swap
nvme0n1
├─nvme0n1p1 xfs
└─nvme0n1p2 LVM2_member
└─rl-root xfs
The only command which can provide something is fsck
, it shows this may be an ext2 format partition:
[root@rocky ~]# fsck -N /dev/sda
fsck from util-linux 2.37.4
[/usr/sbin/fsck.ext2 (1) -- /dev/sda] fsck.ext2 /dev/sda
[root@rocky ~]# fsck -N /dev/sda1
fsck from util-linux 2.37.4
[/usr/sbin/fsck.ext2 (1) -- /dev/sda1] fsck.ext2 /dev/sda1
But mount with -t ext2
still not work:
[root@rocky ~]# mount -t ext2 /dev/sda1 /mnt/
mount: /mnt: wrong fs type, bad option, bad superblock on /dev/sda1, missing codepage or helper program, or other error.
[root@rocky ~]#
I upload this vmdk to OneDrive: disk1.vmdk
Anybody have ideas, what can i do next?
Thanks a lot!
I want to know how to mount this virtual disk.
chengyue qi is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.