Hands on: Brush up your image

A partition on a hard drive holds a filesystem, which is an ordered and structured layout on the disk for files and directories to be stored on.

Linux – or any other operating system – must be able to understand how this layout works to read and write to it, and thus access the files in any way, and it does this using a filesystem driver.

The raw data on the disk, however, needs no such understanding. The operating system needs only to be able to read and write to the disk itself which, in an operating system such as Linux, is handled completely separately from the filesystem drivers.

A raw image of a drive or partition can be created using the dd or ddrescue commands. These read every byte on the drive and duplicate it exactly. The resulting file is known as an image, since it reflects the exact contents of the original.

Any filesystem can be duplicated in this way, so long as Linux can read each byte from the source successfully.

Loop filesystems
When you mount a block device (such as a partition), you make it accessible for reading and writing. A typical mount command is something such as:

# mount /dev/hda1 /var/myfiles

Here the filesystem stored on the hda1 partition is laid onto the root filesystem in the /var/myfiles directory. This is standard across all forms of Unix and you have no doubt seen or used the command before.

However, what difference is there between a device file such as /dev/hda1 and an image file created by duplicating the data on that device? Each contains the same data, laid out in exactly the same way.

It would be useful if Linux could treat the image file like a device and mount it as such. And it can.

As above, the driver that handles the filesystem (such as ext3 or Fat) is entirely separate from the driver that handles the disk drive (such as IDE or Sata); one is effectively layered on top of the other.

This means that the only practical difference between mounting an image file and mounting a device is at the lowest level: the filesystem driver is the same.