Re: [Bug-ddrescue] Merging individual partition image in to whole disk image

[Ketil Froyn]

Perhaps a one-liner like this could replace the spreadsheet job?

cat log | perl -pe 'if (!/^#/) { @fields=split(); $fields[0] =
hex($fields[0]) + 26844594176; print(join(" ", @fields));  }'

On 29 June 2017 at 18:40, Scott Dwyer <address@hidden> wrote:

> Well dang, Paul, when I saw the title and your name on it, I thought it
> was going to be a tutorial :)
>
> I am going to give the short version of this, you may have to fill in some
> blanks. Also please look carefully at any commands, as I have not tried
> them, only putting them there for reference. The first thing is to make a
> third "merged" image from the other two using ddrescue, and using the log
> (map) files as the domain file. This is easy for the full image, but you
> must use the --output-offset option on the partition image. From your
> output, the offset for that partition will be 52430848 * 512 (the start
> sector of the partition * the sector size in bytes), or 26844594176.
>
> ddrescue --domain log img newimg templog1
>
> ddrescue --domain log-sdc2 --output-offset 26844594176 img-sdc2 newimg
> templog2
>
> Don't use the same log for the two different runs. Technically we don't
> need those logs, but they are nice to have just in case. Now this has
> copied all the data that has been read so far into one image, with the
> partition at the proper offset. This was the easy part.
>
> Merging the logs is more complicated. The original log from the whole disk
> is okay, but the log from the partition copy must be altered (make sure to
> work with a copy of this log and not the original). The best way to do this
> is with a spreadsheet program. You need to get all of the lines in the log
> that follow the current position into the spreadsheet into three columns. I
> will let you figure out how to do that with whatever spreadsheet you use.
> But there is one more thing, spreadsheets HATE hexadecimal numbers. So once
> you figure out how to get the data into the sheet, you need to convert the
> hex numbers into decimal. You may have to use the replace function to
> remove all of the leading 0's from the 0x's (I remember having to do this
> somewhere). Then you need to figure out what special formula will extract
> decimal numbers from the hex columns (Google is your friend). Once you have
> done that, you then need to use a formula to add the offset 26844594176 to
> all the values in the position column (don't add them to the size column).
> Once you have done that, you need to export that (or copy and paste if it
> works) into a text file, the columns need to be separated by spaces, or I
> think tabs can work also. You also need to add one line at the top, "0
> 26844594176 ?". You also need to add a current position line, it would be
> best to copy all of the header data from the original log into the new text
> file. Notice I never mentioned converting back to hex, that is because you
> don't need to, ddrescue will accept decimal numbers in the log just fine,
> if they don't start with "0x" they are considered decimal.
>
> Now that you have a modified partition log, you should be able to create a
> merged log file using the --or-mapfile option of ddrescuelog. This will
> logically "OR" the original log and the modified partition log into one
> log, so that any area that was finished in either log will show as finished
> in the merged log. The only thing is that I think it will loose all the
> data for which blocks are bad and non-trimmed and such, I think it will
> make them all non-tried. I don't think there is a way to keep that without
> manually splicing the logs together :(
>
> ddresucelog --or-mapfile modified-partition-log log > newlog
>
> Hope that helps and is not too confusing, and that I got everything right,
>
> Scott
>
>
> On 6/29/2017 4:11 AM, Paul Daniels wrote:
>
>> I've got a drive that's being quite difficult.  Initially I started
>> reading the whole device (/dev/sdc) but due to the rapidly failing nature
>> after I had pulled the first lot of data off I decided to try attack
>> /dev/sdc2 directly (which is the Windows partition with the data).
>>
>> Anyhow, due to changing my mind a bit, I now have two partial images and
>> I wish to merge them and then continue on with reading the *whole* drive
>> again;  the drive now has lost the ability to read the partition table (
>> don't bother telling me to send it to a cleanroom, I've already been over
>> this with the client, they don't want to spend the $, they just want to see
>> what they can get off with software recovery ).
>>
>> I have img and log  ( ddrescue -v -f -O -P16 /dev/sdc img log )
>> ..and I have  img-sdc2 and log-sdc2  ( ddrescue -v -f -O -P16 /dev/sdc2
>> img-sdc2 log-sdc2 )
>>
>> There's some degree of overlap; about 50GB of data in the img-sdc2 that
>> hasn't been (yet) picked up in 'img'.
>>
>> Here's the main image.
>> Disk /dev/loop0: 698.7 GiB, 750156374016 bytes, 1465149168 sectors
>> Units: sectors of 1 * 512 = 512 bytes
>> Sector size (logical/physical): 512 bytes / 512 bytes
>> I/O size (minimum/optimal): 512 bytes / 512 bytes
>> Disklabel type: dos
>> Disk identifier: 0xc1735e81
>>
>> Device       Boot     Start        End   Sectors   Size Id Type
>> /dev/loop0p1           2048   52430847  52428800    25G 1c Hidden W95
>> FAT32 (LBA)
>> /dev/loop0p2 *     52430848  681576447 629145600   300G  7
>> HPFS/NTFS/exFAT
>> /dev/loop0p3      681576448 1465145343 783568896 373.7G  f W95 Ext'd (LBA)
>> /dev/loop0p5      681578496 1465145343 783566848 373.6G  7 HPFS/NTFS/exFAT
>>
>>
>> So, in summary, how can I merge what is recovered in img-sdc2 in to img ?
>>
>> Regards, Paul.
>>
>>
>> _______________________________________________
>> Bug-ddrescue mailing list
>> address@hidden
>> https://lists.gnu.org/mailman/listinfo/bug-ddrescue
>>
>>
>
> _______________________________________________
> Bug-ddrescue mailing list
> address@hidden
> https://lists.gnu.org/mailman/listinfo/bug-ddrescue
>



-- 
-Ketil <http://ketil.froyn.name/>