Post #4207033

2026-07-29 17:03 UTC

Here's a challenge for all you Linux DFIR types that I've never been able to satisfactorily solve: You have multiple Linux disk images that were all derived from a common base image. Consequently, they have duplicate LVM2 group names, volume GUIDs, etc. You'd like to be able to mount the images simultaneously, but Linux doesn't allow mounting LVM volumes with duplicate names. To date, the only solution I have found is to make a working copy of the image and then destructively rename things with vgrename, etc. Yes, you could use overlayfs, but that effectively makes a working copy in the merged directory and adds additional overhead. What I want is a way in Linux to add an on-the-fly copy on write cache file to absorb any changes necessary to the underlying image file so that the underlying image is not impacted. Has anybody come up with a workable solution? #Linux #DFIR

Replies (2)

@csem_cn@mstdn.social 2026-07-29 17:09

@hal_pomeranz@infosec.exchange I find the challenge and question fascinating. Yet, what I am trying to figure out - what exactly is the use case to do that?

Open ##4207031
@ewenmcneill@cloudisland.nz 2026-07-30 05:16

@hal_pomeranz@infosec.exchange the first idea that came to mind was to mount each “version set” inside a separate VM, and then for convenience share those mounts (read only, no squash) back out to the host with NFS. Since the NFS “network” is virtio, I’d guess the performance would be similar to native disk bandwidth. (One could use cloud init or similar to automate the mount-and-NFS-share steps, from boot arguments, to make this relatively low setup overhead.)

Open ##4227938