View files within fog image

Recently I moved from Win 8.1 to W10. Unfortunately I forgot to save my office product key…..Happily I had an fog image of this machine.
Question, can one restore the files inside this container without using fog? (which restores it back to the original device)
YES you can.
First decompress the “fog” file and write it to a file in raw file:

# apt-get install partclone pigz
# cat d1p2.img | pigz -d -c | partclone.ntfs -C -r -s -O foo.img –restore_raw_file

  • d1p2.img = the original image
  • pigz = to decompress the image
  • partclone.ntfs = to restore the image to a ntfs partition type

Partclone v0.2.73 http://partclone.org
Starting to restore image (-) to device (foo.img)
Calculating bitmap… Please wait… done!
File system: NTFS
Device size: 109.2 GB = 26655231 Blocks
Space in use: 48.6 GB = 11859567 Blocks
Free Space: 60.6 GB = 14795664 Blocks
Block size: 4096 Byte
Elapsed: 00:00:04, Remaining: 00:09:40, Completed: 0.68%, 4.99GB/min,
current block: 90541, total block: 26655231, Complete: 0.34%
….
Complete 100%

Then mount foo.img with OSFmount
N
ext use the productkey viewer from Nirsoft to open the SOFTWARE registry hive.
(Note: The Nirsoft tool needs to be started with Admin rights)

Leave a Reply

Your email address will not be published. Required fields are marked *

*