Re: [Bug-ddrescue] Best way to read image created by ddrescue

[Dave Burton]

address@hidden (James W. Watts) wrote:

> I have successfully created an 80GB image of a damaged drive using
> ddrescue. The drive was from an NTFS XP machine. What's the best
> way to read/mount this image file for data recovery? I've been
> using GetDataBack for NTFS on another machine. No results.


Hi James,

You can read it directly on the Linux box.

First, you need to find out where the NTFS partition is.
(The LBA sector offset on the drive of the NTFS partition.)
You can probably just do fdisk on the sick drive:

fdisk -lu /dev/hdc

Alternately, you can do fdisk on the image file, via a loopback
device:

losetup -r /dev/loop0 drive.ima
fdisk -lu /dev/loop0

The most common starting offset is LBA sector 63.  If that
is what yours is then mount the NTFS partition like this:

# Mount the image copy of /dev/hdc1 via loopback device (use "-r" for 
read-only):
losetup -r /dev/loop1 -o 32256 drive.ima
# Note: 32256 is 63 x 512, where '63' is the 'Start' offset shown by 'fdisk -lu'
mkdir /mnt/img1 2>/dev/null
mount -t ntfs /dev/loop1 /mnt/img1

Now you can access your NTFS partition just like any other
file system under Linux, e.g.,

ls -al /mnt/img1/

When you are done, you can unmount it like this:

losetup -d /dev/loop0
umount /mnt/img1
losetup -d /dev/loop1


If, due to too many bad sectors, that fails, then you'll need
to let Windows try to fix it.  Start by copying the image to
a scratch drive which is at least as large as the image file.
Then connect the scratch drive to a Windows XP or Windows 200x
box, and let Windows chkdsk it.  (This might take a while!)
Then, when it is done, look for your data.


How many unrecovered sectors are there?

Be sure that you did at least one "-r 1" data recovery pass
using ddrescue's -d (raw) mode.  Otherwise you're probably
giving up a lot of recoverable data!

Here's a typical recovery script for one of my recovery chores:

fdisk -lu /dev/hdc >fdisk-lu_out.txt
# first try we go for speed:
hdparm -d1 /dev/hdc
hdparm -a256 /dev/hdc
hdparm -A1 /dev/hdc
blktool /dev/hdc read-ahead 256
ddrescue -B -n /dev/hdc drive.ima drive.log
cp -p drive.log drive.log.1a
# second try is similar, but read only 4K at a time:
hdparm -a8 /dev/hdc
hdparm -A0 /dev/hdc
blktool /dev/hdc read-ahead 0
ddrescue -B -c 8 /dev/hdc drive.ima drive.log
cp -p drive.log drive.log.2a
# third try we only read one sector at a time, and use direct (raw) I/O:
hdparm -a0 /dev/hdc
hdparm -A0 /dev/hdc
hdparm -k1 /dev/hdc
hdparm -K1 /dev/hdc
## mknod /dev/raw/raw9 c 162 9 2>/dev/null
## raw /dev/raw/raw9 /dev/hdc
# "-d" takes the place of using the raw device (starting w/ ddrescue 1.4):
ddrescue -B -c 1 -r 1 -d /dev/hdc drive.ima drive.log
cp -p drive.log drive.log.3a
# fourth try is with DMA disabled, and five retries:
hdparm -d0 /dev/hdc
ddrescue -B -c 1 -r 5 -d /dev/hdc drive.ima drive.log
cp -p drive.log drive.log.4a
## raw /dev/raw/raw9 0 0
# restore drive parameters:
hdparm -a256 /dev/hdc
hdparm -A1 /dev/hdc
blktool /dev/hdc read-ahead 256
hdparm -d1 /dev/hdc

You can also use Microsoft's NFI tool with my ddr2nfi.pl and
nficruncher.pl scripts to determine which files are damaged
based on ddrescue's .log file.  This seems to not be 100%
reliable, but it is the best I've been able to come up with.

On the Linux box:
/rescue/ddr2nfi.pl nficmds.bat - fdisk-lu_out.txt drive.log

On the Windows box:
First, edit nficmds.bat to fix the drive letter.  Then run
nficmds.bat, redirecting (capturing) the output into a text
file.  Then use nficruncher.pl to analyze the captured
output.

(Get these scripts from ddr2sr.zip on the downloads page
of my web site.)

I hope this helps.

-Dave
www.burtonsys.com


address@hidden (James W. Watts) wrote:

> Hello,
>
> I have successfully created an 80GB image of a damaged drive using ddrescue. 
> The drive was from an
> NTFS XP machine. What's the best way to read/mount this image file for data 
> recovery? I've been
> using GetDataBack for NTFS on another machine. No results.
>
> Other or better options?
>
> James