When working with hard drives it is always a good idea to back the entire thing up before proceeding. I wanted to write down the procedure so I don’t keep forgetting it.
Create disc image
dd does the trick here.
sudo dd if=/dev/<drive device file> of=image.img bs=64M
If you wish to see the progress of the above dd command you can open up a separte window and issue the kill command
kill -USR1 `pidof dd`
Mount disc image read only
You can now disconnect the drive and work with its image instead (great for forensics or dealing with a dying drive.)
In later versions of Linux you can do this with losetup and partprobe.
sudo losetup -Pr -f <path to image file>
sudo losetup #find which loop device file corresponds with your image here
sudo mount -o ro /dev/<loopdevice>p<partition number> <mountpoint>
For example, this is what I did on my system for my aunt’s laptop (I was interested in the 2nd partition on her drive, the one containing Windows files)
sudo losetup -Pr -f susan-ssd.img
NAME SIZELIMIT OFFSET AUTOCLEAR RO BACK-FILE DIO
/dev/loop0 0 0 0 1 /home/partimag/susan-ssd.img 0
sudo mount -o ro /dev/loop0p2 mount/
When you’re done, unmount the image and delete the image mapping:
umount <path to mount directory> sudo losetup -d <loop file obtained earlier>