VM에 하드디스크 추가로달고 마운트하기
Volatility 으로 분석용 VM을 만들었는데..
처음 Ubuntu를 설치할때 아무생각없이 기본으로 설정하는 바람에 HDD가 20G밖에 안된다..ㅠ
Ubuntu 패키지 업데이트 하고 이거저거 깔고보니 남은 HDD가 4G OTL…
그래서 VM에 하드디스크를 추가로 20G 달고 마운트 시켰다..
먼저 Setting에서 Add 를 눌러 HDD 를 추가..(간단하니 생략…)
부팅후 fdisk -l 으로 확인
apollo89@ubuntu:~$ sudo fdisk -l [sudo] password for apollo89: Disk /dev/sda: 21.5 GB, 21474836480 bytes 255 heads, 63 sectors/track, 2610 cylinders, total 41943040 sectors Units = sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 512 bytes I/O size (minimum/optimal): 512 bytes / 512 bytes Disk identifier: 0x0003b263 Device Boot Start End Blocks Id System /dev/sda1 * 2048 39845887 19921920 83 Linux /dev/sda2 39847934 41940991 1046529 5 Extended /dev/sda5 39847936 41940991 1046528 82 Linux swap / Solaris Disk /dev/sdb: 21.5 GB, 21474836480 bytes 255 heads, 63 sectors/track, 2610 cylinders, total 41943040 sectors Units = sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 512 bytes I/O size (minimum/optimal): 512 bytes / 512 bytes Disk identifier: 0x00000000 Disk /dev/sdb doesn't contain a valid partition table
일단 파티션 부터…
apollo89@ubuntu:~$ sudo fdisk /dev/sdb
Device contains neither a valid DOS partition table, nor Sun, SGI or OSF disklabel
Building a new DOS disklabel with disk identifier 0xeddae74d.
Changes will remain in memory only, until you decide to write them.
After that, of course, the previous content won't be recoverable.
Warning: invalid flag 0x0000 of partition table 4 will be corrected by w(rite)
Command (m for help): p
Disk /dev/sdb: 21.5 GB, 21474836480 bytes
255 heads, 63 sectors/track, 2610 cylinders, total 41943040 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0xeddae74d
Device Boot Start End Blocks Id System
Command (m for help): n
Partition type:
p primary (0 primary, 0 extended, 4 free)
e extended
Select (default p): p
Partition number (1-4, default 1): 1
First sector (2048-41943039, default 2048):
Using default value 2048
Last sector, +sectors or +size{K,M,G} (2048-41943039, default 41943039):
Using default value 41943039
Command (m for help): w
The partition table has been altered!
Calling ioctl() to re-read partition table.
Syncing disks.
apollo89@ubuntu:~$ sudo fdisk -l
Disk /dev/sda: 21.5 GB, 21474836480 bytes
255 heads, 63 sectors/track, 2610 cylinders, total 41943040 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x0003b263
Device Boot Start End Blocks Id System
/dev/sda1 * 2048 39845887 19921920 83 Linux
/dev/sda2 39847934 41940991 1046529 5 Extended
/dev/sda5 39847936 41940991 1046528 82 Linux swap / Solaris
Disk /dev/sdb: 21.5 GB, 21474836480 bytes
213 heads, 34 sectors/track, 5791 cylinders, total 41943040 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0xeddae74d
Device Boot Start End Blocks Id System
/dev/sdb1 2048 41943039 20970496 83 Linux
이제 파티션은 나눴으니 포맷하고 마운트~
apollo89@ubuntu:~$ sudo mke2fs -j /dev/sdb1 mke2fs 1.42 (29-Nov-2011) Filesystem label= OS type: Linux Block size=4096 (log=2) Fragment size=4096 (log=2) Stride=0 blocks, Stripe width=0 blocks 1310720 inodes, 5242624 blocks 262131 blocks (5.00%) reserved for the super user First data block=0 Maximum filesystem blocks=4294967296 160 block groups 32768 blocks per group, 32768 fragments per group 8192 inodes per group Superblock backups stored on blocks: 32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632, 2654208, 4096000 Allocating group tables: done Writing inode tables: done Creating journal (32768 blocks): done Writing superblocks and filesystem accounting information: done apollo89@ubuntu:~$ sudo mkdir /image_sample apollo89@ubuntu:~$ sudo mount -t ext3 /dev/sdb1 /image_sample apollo89@ubuntu:~$ df -h Filesystem Size Used Avail Use% Mounted on /dev/sda1 19G 14G 4.3G 76% / udev 989M 4.0K 989M 1% /dev tmpfs 200M 796K 199M 1% /run none 5.0M 0 5.0M 0% /run/lock none 999M 152K 998M 1% /run/shm /dev/sdb1 20G 173M 19G 1% /image_sample
마운트도 끝~
그럼 부팅할때마타 마운트가 자동으로 되도록 uuid확인해서 fstab 을 설정해보자..
apollo89@ubuntu:~/Volatility$ sudo blkid /dev/sda1: UUID="04823b71-5bc4-4ad3-92f6-e79122a35643" TYPE="ext4" /dev/sda5: UUID="50cf469e-9d0e-4023-93d3-c348792ce580" TYPE="swap" /dev/sdb1: UUID="fa62d939-d896-4f29-9445-129456509524" TYPE="ext3" apollo89@ubuntu:~/Volatility$ cat /etc/fstab ... # new hdd UUID=fa62d939-d896-4f29-9445-129456509524 /image_sample ext3 relatime,errors=remount-ro 0 0
이제 재부팅해도 자동으로 마운트가 되어 올라오는지 확인해보자.
