Mounting a LVM partition from a QEMU file

Last week we had an interesting problem, one of our customers needed us to recover files from a KVM disk image. They had no idea how the disk had been partitioned or about the KVM it came from (on further inspection it would not boot). Like a set of matryoshkas dolls the raw image contained a GUID Partition Table, which contained a Logical Volume Group which contained the partition we needed to mount.

We started by trying to view the partition table using fdisk to gave us an idea of what was inside.


# fdisk -l /var/vm/thema.img 

WARNING: GPT (GUID Partition Table) detected on '/var/vm/thema.img'! The util fdisk doesn't support GPT. Use GNU Parted.

This confirmed that the img contains a GUID Partition Table. So we have a look inside using parted, which supports GPT.

[root@monte ~]# parted /var/vm/thema.img print
Model:  (file)
Disk /var/vm/thema.img: 21.5GB
Sector size (logical/physical): 512B/512B
Partition Table: gpt

Number  Start   End     Size    File system  Name  Flags
 1      1049kB  2097kB  1049kB                     bios_grub
 2      2097kB  526MB   524MB   ext4         ext4  boot
 3      526MB   21.5GB  20.9GB                     lvm

Create the device mappings for the partitions and scan for the volume group.

[root@monte ~]#  kpartx -av /var/vm/thema.img 
add map loop0p1 (253:0): 0 2048 linear /dev/loop0 2048
add map loop0p2 (253:1): 0 1024000 linear /dev/loop0 4096
add map loop0p3 (253:2): 0 40912896 linear /dev/loop0 1028096
[root@monte ~]# vgscan 
  Reading all physical volumes.  This may take a while...
  Found volume group "vg_thema" using metadata type lvm2

The vgscan command finds the group name, which is then used to activate the volume with the vgchange command.

[root@monte ~]#  vgchange -ay vg_thema

After vgchange has run, the partitions should all be available in /dev/vg_thema/. Mount them as you usually would.

[root@monte ~]# mount /dev/vg_thema/lv_root /mnt/