I would like to point something out that relates to both an
"unfinished" image, and using ddru_ntfsbitmap (something I need to
add to the documentation). In any event, anything less than a 100%
recovery will leave portions on the target image/drive that have not
been written to by ddrescue. If copying to a brand new hard drive,
those areas are (hopefully) likely to be zeros. But in any other
case, those areas will contain whatever data was there previously.
For someone that uses their system for data recovery on a regular
basis, and is using image files or reusing hard drives, those areas
could contain data from a previous recovery! This could be a privacy
issue in some cases, but also could cause an issue with running any
other sort of repair/file recovery tools on the recovered
image/drive. The unrecovered parts could contain "garbage" data that
could affect accurate recovery. In these cases I would recommend
using the fill mode of ddrescue to fill any unfinished/untried areas
with zeros. Example command:
ddrescue --fill-mode=?/*- /dev/zero recovered_image logfile
This would write zeros to any portion of the recovery that was not
successfully read from the source.
So now to answer your question about an "unfinished" recovery. That
depends on how much and what areas were recovered. You can obviously
only recover what was successfully read. In the case of NTFS, if the
MFT (master file table) is not recovered in full or is damaged, it
makes recovery much more difficult. Which gives me the idea of
adding an option in ddru_ntfsbitmap to create a secondary domain
file for just recovering the MFT first :)
Scott
On 11/11/2013 12:22 PM, Andrej
Trobentar wrote:
On 11/11/2013 06:00 PM, Scott D
wrote:
I am at work so I must be brief. I see you are
using my very new utility ddru_ntfsbitmap. I hope it works
well for you. What I do see in your commands is that after
a failure, you leave out "-m /tmp/domain_logfile". Leaving
that out will cause ddrescue to read the whole partition
and not just the used part. So your command after a
failure should be more like "ddrescue -A "-m
/tmp/domain_logfile -v /dev/sdb1 /tmp/Image.img
/tmp/Image.log", unless you do wish to recover the whole
partition and not just the used part.
First of all thanks for your fast reply!
OK, I'll add the "-m /tmp/domain_logfile" in case of driver
failure - glad I asked first :)
As for mounting, I personally would not try to
mount it until the recovery is finished. And if it were
me, if possible I would make a backup copy of the recovery
before attempting any "fixing" or mounting, especially if
there are errors.
Of course I would make a copy of the "unfinished" image and do all
the experiments on the copy, but thanks for pointing that out.
But let's assume that the drive doesn't power up any more. How to
recover from the "unfinished" .img file that we got left? Is this
even possible?
Thanks for your answers and greetings from Slovenia,
Andrej.
_______________________________________________
Bug-ddrescue mailing list
address@hidden
https://lists.gnu.org/mailman/listinfo/bug-ddrescue
|