Recovering files from a Ghost 4 Linux/Unix bzipped image (G4U/G4L)

Recently a colleague of mine used G4L to backup his disk. G4L is nice and handy if you want to backup an entire disk in zipped (bz2) format and ship it off to an ftp server for backup. We now needed to recover some files off that backup. The issue is all of our machines are identical, and since the backup was a lowlevel image of the entire disk, unzipping the img would not be possible. This post describes the steps I took to manage to mount partitions out of the bzipped image.

Doing some research, it became apparent that G4L uses Gnu DD behind the scenes to create the disk image. Basically G4L is a wrapper around dd to make it easier to perform networked backups. This was great as it meant that I did not have to deal with proprietery or weird formats.

As mentioned, unzipping the img first was not an option, this is because the image required the entire disk to expand into. Using G4L to recover the partition was also not an option as we needed a free machine to push the image onto. After googling a bit, I managed to find AVFS (A Virtual File System). AVFS makes it easy to deal with all kinds of archives and network drives. In this situation I needed its bz2 support. I installed the fuse module for avfs and started it as root, this was required such that I can use the mount command while being able to use the avfs fuse filesystem.

To not keep typing for ages, I will conclude by showing the commands that were required to mount the device and I will display a few output messages from these commands as well.

assuming the following setup

Setting up avfs

mkdir ~/.avfs # needed by avfs mountavfs # mounts the avfs virtual filesystem mounting the partitions fdisk -ul ~/.avfs${zipimg}# note that the first time you run this command will be slow (if the file is big enough) as avfs has to do its magic on the zipped file.
The output will be something like

YES you guessed it, it was a raid setup. I was interested in the home partition which I found out was the last one START=82911528. To mount it you need to calc 82911528 * 512 = 42450702336

OK so you also need to know the filesystem type, in this case it was ext3, the -r flag means it is mounted as a read only filesystem.

Many things fell into place for me to get to this point, without God’s grace I would have given up early.