Re: [Bug-ddrescue] How to properly repair rescued image?

[James W. Watts]

Hi Ariel,

Thanks again for the info. The reason I didn't CC the bug list initially was 
that I didn't want to
misuse the list as a support forum. If it truly is a bug submission vehicle, 
then I apologize to
the friendly folk who are on the list. But if support is fair game, then I 
welcome all responders.

Thanks for confirming my fears. I knew I was gambling with fate. Thank goodness 
my drive made it
thru ok with HDD Regenerator. You mentioned that you would have let ddrescue 
work on the drive
directly. How would you do this? How would you know which infile to point 
ddrescue to? You
suggested to let ddrescue work on the first sector only. But how?

How do you point ddrescue to a source drive that is not listed in /dev?

You asked about what I meant by "write (not copy)". I was referring to the 
feature of Get Data
Back for NTFS (a tool I found previously and that was highly recommended by 
another member of this
list). The tool will apparently take a drive image and write that image to a 
target drive. I hope
to put this to the test soon.

Finally, one of my original questions... Are there any Linux-based tools that 
will fix images
taken from NTFS partitions? The contributor I mentioned earlier suggested 
TestDisk. Are there
others? I take it that in Linux it does not matter that the image file is NTFS 
and is sitting on
an EXT2 partition.

What's the best way to deal with what I have now -- a ddrescue'd image of my 
crashed XP NTFS
partition?

Thanks,

James




--- Ariel <address@hidden> wrote:

> 
> On Mon, 11 Jun 2007, James W. Watts wrote:
> 
> > Anyways... Let me see if I'm understanding this properly. Given what I have 
> > now (an NTFS image
> > file on an EXT2 partition), can I first mount that image in Linux to do 
> > some quick-n-dirty
> data
> > recovery (i.e. dragging files to a USB drive)? Many of the tutorials that 
> > I've read point to
> this
> > possibility. What do you think?
> 
> First, please remember to CC the mailing list when replying.
> 
> _If_ linux is able to mount the ntfs image then yes! get what you can. 
> Make SURE to mount it ro (read only).
> 
> It depends on how damaged it is, if it's bad linux might not be able to 
> mount it.
> 
> > I gather from your response that the partition type of the drive does need 
> > to match that of
> the
> > image file. And so does the recovery tool. Though, now that I think about 
> > it -- when I write
> (not
> > copy) the rescued NTFS image to a different HD for use in XP, that HD will 
> > "become" NTFS by
> that
> > process, right?
> 
> The partition type only matters on windows. Linux doesn't care. And no, 
> copying the image to a drive will not change the partition type, you need 
> to use a partioning tool for that.
> 
> And I don't understand what you mean by "write (not copy)".
> 
> Please go online and read whatever you can find about partitions and 
> filesystems.
> 
> After you do that: you can have a filesystem in a partition, or you can 
> have it as a (very large) file, sitting inside another filesystem, which 
> itself is sitting on a partition. (Only on linux - windows does not 
> support filesystem images as files, it can only read them in partitions. 
> Maybe there is some tool for windows that can do it, I don't know.)
> 
> > Another question. Was it necessary for me to run HDD Regenerator? 
> > ddrescue's info file makes
> > reference to reading "raw" devices. Don't get me wrong. I feel lucky that 
> > HDD Regenerator
> > successfully repaired the drive so that it showed up correctly in 
> > /etc/fstab. But I feel like
> this
> > was a risky move and could have further damaged the drive.
> 
> In general no, I would not have done so. I would just have let ddrescue 
> work on the drive directly. However your problem was that the partition 
> table was messed up, and the drive just showed up as one big no-partition 
> drive, and that could be a problem, so maybe running it just on the first 
> sector of the drive (where the partition table is stored) would have been 
> a good idea, but not to touch the rest of it.
> 
> Instead, first I would run ddrescue to get what I can without writing to 
> the damaged disk. Then once I've done that let HDD Regenerator do what it 
> can, and have ddrescue get anything extra it can find, since at that 
> point you would have nothing to loose.
> 
> Also, there are tools on linux that can let you regenerate a partition 
> table, so you could have copied the entire disk, and then run those.
> 
>       -Ariel
> 
> > --- Ariel <address@hidden> wrote:
> >
> >>
> >> On Mon, 11 Jun 2007, James W. Watts wrote:
> >>
> >>> I used ddrescue v1.3 to copy a crashed Windows XP NTFS partition. The 
> >>> rescued NTFS image
> file
> >> is
> >>> stored on a hard drive with a single EXT2 partition. Referencing the 
> >>> tutorial in
> >> 'ddrescue.info',
> >>> I will next copy the image to a different drive for the repair stage.
> >>>
> >>> The tutorial states, "After the copy is repaired, with e2fsck or some 
> >>> other tool appropriate
> >> for
> >>> the type of partition..." I'm confused. Does this mean that the tool for 
> >>> repair needs to
> match
> >> the
> >>> file system of the rescued image file (NTFS in my case) or the file 
> >>> system of the partition
> on
> >>> which the rescued image file resides (EXT2 in my case)? Please advise.
> >>>
> >>> If the latter is true, I presume I will be able to run e2fsck against the 
> >>> image for repair.
> If
> >> the
> >>> former is true, I'm not sure how to repair the image. Would I need to 
> >>> copy the image to an
> >>> NTFS-formatted hard drive, mount that HD in an XP machine, then run an 
> >>> NTFS partition repair
> >> tool?
> >>> I've looked for such a tool that is Linux-based (e.g. ntfsck), but it 
> >>> does not yet exist.
> >>
> >> You need to create a partition EXACTLY the same size as the old partition
> >> was (down to the byte exactly).
> >>
> >> Then copy the ntfs data to that partition, boot windows and have windows
> >> checkdisk (or some other commercial tool) work on it.
> >>
> >> Unlike linux windows can not open a filesystem that is stored as a regular
> >> file, it has to be in a partition (and make sure the partition type is
> >> correct).
> >>
> >> Hmm, actually it's theoretically possible you could use VMware, or other
> >> virtualizer, to mount the file as if it was a real partition.
> >>
> >> When you create the partition you must use a tool that can show you
> >> exactly how big it is (in sectors - multiply by 512 to get bytes).
> >>
> >> You may need to tell the partitioning tool to use a specific number of
> >> heads and sectors-per-track (i.e. to use the same number as was used on
> >> the original partition), otherwise you will find it impossible to make a
> >> partition exactly the same size.
> >>
> >> Good luck.
> >>
> >>    -Ariel
> >>
> >
> >
>