[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Bug-ddrescue] Merging individual partition image in to whole disk i

From: Scott Dwyer
Subject: Re: [Bug-ddrescue] Merging individual partition image in to whole disk image
Date: Thu, 29 Jun 2017 12:40:12 -0400
User-agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101 Thunderbird/52.2.1

Well dang, Paul, when I saw the title and your name on it, I thought it was going to be a tutorial :)

I am going to give the short version of this, you may have to fill in some blanks. Also please look carefully at any commands, as I have not tried them, only putting them there for reference. The first thing is to make a third "merged" image from the other two using ddrescue, and using the log (map) files as the domain file. This is easy for the full image, but you must use the --output-offset option on the partition image. From your output, the offset for that partition will be 52430848 * 512 (the start sector of the partition * the sector size in bytes), or 26844594176.

ddrescue --domain log img newimg templog1

ddrescue --domain log-sdc2 --output-offset 26844594176 img-sdc2 newimg templog2

Don't use the same log for the two different runs. Technically we don't need those logs, but they are nice to have just in case. Now this has copied all the data that has been read so far into one image, with the partition at the proper offset. This was the easy part.

Merging the logs is more complicated. The original log from the whole disk is okay, but the log from the partition copy must be altered (make sure to work with a copy of this log and not the original). The best way to do this is with a spreadsheet program. You need to get all of the lines in the log that follow the current position into the spreadsheet into three columns. I will let you figure out how to do that with whatever spreadsheet you use. But there is one more thing, spreadsheets HATE hexadecimal numbers. So once you figure out how to get the data into the sheet, you need to convert the hex numbers into decimal. You may have to use the replace function to remove all of the leading 0's from the 0x's (I remember having to do this somewhere). Then you need to figure out what special formula will extract decimal numbers from the hex columns (Google is your friend). Once you have done that, you then need to use a formula to add the offset 26844594176 to all the values in the position column (don't add them to the size column). Once you have done that, you need to export that (or copy and paste if it works) into a text file, the columns need to be separated by spaces, or I think tabs can work also. You also need to add one line at the top, "0 26844594176 ?". You also need to add a current position line, it would be best to copy all of the header data from the original log into the new text file. Notice I never mentioned converting back to hex, that is because you don't need to, ddrescue will accept decimal numbers in the log just fine, if they don't start with "0x" they are considered decimal.

Now that you have a modified partition log, you should be able to create a merged log file using the --or-mapfile option of ddrescuelog. This will logically "OR" the original log and the modified partition log into one log, so that any area that was finished in either log will show as finished in the merged log. The only thing is that I think it will loose all the data for which blocks are bad and non-trimmed and such, I think it will make them all non-tried. I don't think there is a way to keep that without manually splicing the logs together :(

ddresucelog --or-mapfile modified-partition-log log > newlog

Hope that helps and is not too confusing, and that I got everything right,


On 6/29/2017 4:11 AM, Paul Daniels wrote:
I've got a drive that's being quite difficult. Initially I started reading the whole device (/dev/sdc) but due to the rapidly failing nature after I had pulled the first lot of data off I decided to try attack /dev/sdc2 directly (which is the Windows partition with the data).

Anyhow, due to changing my mind a bit, I now have two partial images and I wish to merge them and then continue on with reading the *whole* drive again; the drive now has lost the ability to read the partition table ( don't bother telling me to send it to a cleanroom, I've already been over this with the client, they don't want to spend the $, they just want to see what they can get off with software recovery ).

I have img and log  ( ddrescue -v -f -O -P16 /dev/sdc img log )
..and I have img-sdc2 and log-sdc2 ( ddrescue -v -f -O -P16 /dev/sdc2 img-sdc2 log-sdc2 )

There's some degree of overlap; about 50GB of data in the img-sdc2 that hasn't been (yet) picked up in 'img'.

Here's the main image.
Disk /dev/loop0: 698.7 GiB, 750156374016 bytes, 1465149168 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0xc1735e81

Device       Boot     Start        End   Sectors   Size Id Type
/dev/loop0p1 2048 52430847 52428800 25G 1c Hidden W95 FAT32 (LBA) /dev/loop0p2 * 52430848 681576447 629145600 300G 7 HPFS/NTFS/exFAT /dev/loop0p3 681576448 1465145343 783568896 373.7G f W95 Ext'd (LBA) /dev/loop0p5 681578496 1465145343 783566848 373.6G 7 HPFS/NTFS/exFAT

So, in summary, how can I merge what is recovered in img-sdc2 in to img ?

Regards, Paul.

Bug-ddrescue mailing list

reply via email to

[Prev in Thread] Current Thread [Next in Thread]