[Bug-ddrescue] partially recovered mftshort

[Andy Malcolm]

Hi all, firstly, thanks so much Scott for such awesome software!

Secondly, I've used ddrescue to copy /dev/sda to /dev/sde and it's mostly completed before grinding to a halt, or rather a patience trying pace.

Then I found and tried ntfsfindbad hoping that it would tell me that my mp3 collection was magically intact and I could just forget about this whole data recovery thing. Alas, it was not to be. Also, $MFT showed on the list of bad.

Then I tried ddru_ntfsbitmap /dev/sda4 domain_logfile

which yielded:
"__mftshort.log
__mftshort

current pos:     3221 MB,  current status: finished
domain size:     16384 B,  in    1 area(s)
    rescued:         0 B,  in    0 area(s)  (  0%)
  non-tried:         0 B,  in    0 area(s)  (  0%)

    errsize:     16384 B,  errors:       1  (100%)
non-trimmed:         0 B,  in    0 area(s)  (  0%)
  non-split:         0 B,  in    0 area(s)  (  0%)
 bad-sector:     16384 B,  in    1 area(s)  (100%)"

so I ran this

sudo ddrescue -i3221225472 -o0 -s16384 -r-1 -R /dev/sda4 __mftshort __mftshort.log

which I found in a log file and just stuck it on infinite retry and put it in -Reverse as that seems to help sometimes.

which recovered all of it apparently. I started this email because it had only recovered two thirds after about 25 retries and I wanted to know if the remainder could be deduced from what else was known about the filesystem, no need now apparently. Hooray.

Now I have the same issue with $Bitmap, however. I guess I'll just put that on infinite retry until it works also.

8hrs later....

2121 kB rescued  27787 kB errsize.

Since I've already started a /dev/sda to /dev/sde with ddrescue, is there some way to write these ntfsbitmap retrying results onto /dev/sde and update my original ddrlog.txt, like my 16k mftshort data which I don't think made it from /dev/sda to /dev/sde originally?

Also, since the $Bitmap recovery is taking such a long time, is it possible to check /dev/sde to see if there are any fragments on there already, as in do a merge of $Bitmap from both /dev/sde and /dev/sda? Then instruct ntfsbitmap to look on /dev/sda only for what it knows isn't on /dev/sde?

since /dev/sde is exactly the same size (capacity) and layout as /dev/sda and a partial ddrescue copy of /dev/sda could I just run the ntfsbitmap commend on sde first and then on sda?

Lastly, is a partially recovered $Bitmap at all usefull?

Thanks again for writing this software, and thanks in advance for answering the questions of a dim user!

Andy.