Every time you build an embedded image, patch a Raspberry Pi SD card, drop a config onto an EFI System Partition, or rescue files off a legacy USB stick, you reach for the same tired ritual: losetup, partx, mount -o loop,offset=, edit as root, sync, umount, detach. Miss a step and you leave a stale loop device or a dirty filesystem.

mtools — written in 1991, still shipped in Debian, Fedora, Arch, and Alpine — sidesteps the whole dance. It talks FAT12/16/32 (and exFAT via mtools-4.0.44+) directly against a device node or a raw image file, with zero kernel involvement, zero mount tables touched, and zero root required if your user can read/write the file.

The interface is a set of DOS-flavored commands prefixed with m: mdir, mcopy, mtype, mmove, mdel, mattrib, mformat, mlabel, mmd/mrd, mbadblocks, mshowfat. Drives are letters — configured in ~/.mtoolsrc — but you can pass paths inline with a leading ::.

The one-liners that pay for themselves:

# Peek inside a Raspberry Pi image without mounting it.
# partition 1 of raspios.img starts at sector 8192 (512-byte sectors).
$ mdir -i raspios.img@@$((8192*512)) ::/
 Volume in drive : is bootfs
 Directory for ::/

bcm2711-rpi-4-b dtb   57534 2025-08-01  10:14
config      txt        2071 2025-08-15  09:33
cmdline     txt         176 2025-08-15  09:33
...

# Drop a headless-wifi config in — no sudo, no loop device.
$ mcopy -i raspios.img@@$((8192*512)) wpa_supplicant.conf ::/
$ mcopy -i raspios.img@@$((8192*512)) -o ssh ::/       # empty ssh file

The @@offset syntax is the killer feature: mtools knows how to skip a partition table. No loop device, no kpartx, no lingering /dev/loop7 if your terminal dies.

Configuring drive letters makes it feel like DOS again, in a good way:

# ~/.mtoolsrc
drive p: file="/home/shaun/images/pi.img" partition=1
drive e: file="/dev/nvme0n1p1"                        # your EFI System Partition
drive s: file="/dev/sdc1"                             # SD card

# Now:
$ mdir e:/EFI/BOOT/
$ mcopy new-refind.conf e:/EFI/refind/refind.conf
$ mtype p:/config.txt | grep dtoverlay

Why it beats mount -o loop:

• No root. If you own the file, you own the FAT. Useful in CI, containers, and Nix builds where you can't CAP_SYS_ADMIN.
• No kernel state. Nothing to clean up. No stale loop devices. No "device busy" when you forgot a shell was still cd'd in.
• Works on partitioned images natively. @@offset or partition=N in the config — done. No kpartx -av chain.
• Deterministic writes. mtools flushes on every command, so scripting it doesn't leave you wondering when sync actually ran.
• Preserves DOS attributes. mattrib +h +s sets hidden/system bits the kernel FAT driver quietly ignores or requires funny mount options for.

The classic gotcha: pass -s to mcopy for recursive copies (it's DOS xcopy /S, not Unix cp -r), and -p to preserve attributes. And set MTOOLS_SKIP_CHECK=1 if you're working with a mildly-inconsistent-but-readable filesystem — mtools is stricter than the Linux kernel by default.

For anything vfat-shaped — bootloader partitions, camera SD cards, old Zip disks in the closet — mtools turns a five-command mount dance into one line. Thirty-four years old and still the shortest path.