Changing data inside an image file (.img) without mounting.

[pjadl]

I'm interested in knowing if it's possible to edit a single text file from within an image file. Here's my idea...

If I make an image of my drive with 'dd'. Then I edit an existing file (the one I want to edit in the .img file), save it, and make another image file with dd. Then by comparing the bytes from each file, find out exactly where I would need to edit the .img file.

That way if someone wants a copy, I can just run a program that injects, lets say, a serial number linked to that user hidden in the .img file.

I know I would have to edit the template to include spaces where the serial number will go, so that way I'm just changing existing bits, and not making the .img file bigger.

Is this possible, or do I actually have to look at programming a way to mount the .img file first before it gets edited every time?

[Salem]

If I make an image of my drive with 'dd'. Then I edit an existing file (the one I want to edit in the .img file), save it, and make another image file with dd. Then by comparing the bytes from each file, find out exactly where I would need to edit the .img file.

You'll find that mounting most file systems (unless it's something simple like DOS-FAT) write a lot of structural information to the volume, in addition to the file itself.
Further, depending on your editing program, the new copy of the file could be in a different location on the volume (for safety).

> Is this possible, or do I actually have to look at programming a way to mount the .img file first before it gets edited every time?
You can just mount it using loopback
guide:mount_loopback [Open Source (tm) Guides & Tutorials]

[pjadl]

Further, depending on your editing program, the new copy of the file could be in a different location on the volume (for safety).

I see this as being a problem. What about if I add a unique entry in place of the desired serial number, make the image file and search the .img file by bit shifting until a matching pattern is found?

I would like to save mounting the .img file as a final resort if possible.

[Salem]

If you're only changing the content of individual sectors or clusters, then you should be OK.

[pjadl]

If you're only changing the content of individual sectors or clusters, then you should be OK.

Thank you very much for your input. I'm just starting to program in the C language, and wanted to do this project. I was afraid I was setting out to try and do something that couldn't be done (which can stifle the learning process). Once you said it was possible, I knew I could have the mind set to complete it no matter what.

Surprisingly, this was a very easy thing to do. But thank you for your input!

[cyberfish]

Unless the filesystem does any checksuming, like ZFS and BTRFS.

Basically if we think of the image file as the disk (underlying storage for the filesystem), what you are doing is corrupting it. Some filesystems (not very common right now, but will become more common as time goes on) try to detect and correct corruptions in underlying storage, and editing the image file won't work with those file systems.

Mounting the filesystem and editing the file through the filesystem is much safer.