[Bug-ddrescue] ddrescue support questions

[James W. Watts]

Hello Antonio,

This is a long-winded message, so I hope you will bear with me.  :)

First I want to thank you for writing software that has helped so many people. 
I have been
scouring the net for the past week or so learning as much as I can about the 
right way to do data
recovery. I want to learn so I can better help others, too. I work as a PC 
Desktop Support
technician and more and more frequently, I encounter users with unbootable hard 
drives. Most
recently, one of these users happened to be my best friend. His PC, which I 
built for him a few
years ago, died -- XP won't boot, blah blah blah...  And now it's up to me to 
recover as much data
as I can from his HD.

Now, I'm not looking for a step-by-step, hold-my-hand troubleshooting session 
from you. I'm sure
you don't have time for that. What I'm asking for is direction and guidance. 
Let me tell you what
I've done so far:
1. Removed the damaged HD and connected it to a different PC.
2. BIOS and XP detect the drive. SMART indicates imminent failure. XP shows a 
drive letter for it,
but will not read any of its contents.
3. Testdisk did not detect any partitions. The "Search!" found the partition on 
the backup sector,
but it failed to overwrite the existing Sector 0. Repeated attempts produced 
the same results.
4. Get Data Back for NTFS saw the drive once but could not read off any data. 
Repeated attempts
resulted in it no longer detecting the drive.
5. Spinrite (on Level 2) would never get past Sector 0. I forced it to start 
again at 0.4% and
left it running Friday when I left work. I hope the drive is not dead when I 
return Monday.
6. Knoppix sees the drive. But cannot mount it to drag-and-drop files to a USB 
drive. Plus, since
I am an amateur at Linux, I did not try anything without learning more.
7. Pray.

Since all of the above have failed (I don't have much faith in Spinrite at this 
point), I turned
to Google. As an aside, what is the deal with Spinrite? What does it do? How 
does it fit into the
data recovery field? It seems pretty stumped w/ my friend's HD at the moment. 
Thoughts?

With Google, I have been reading articles, forums, newsgroups, and your 
ddrescue's E-mail archive.
I've also downloaded several Live CDs for data recovery (Knoppix, RIP, Helix, 
System Rescue CD,
etc.). But since the majority of these are Linux-based, I've hesitated 
launching any of them.

>From what I've read, it seems to be best practice to first try creating an 
>image of the damaged
hard drive onto a new or blank hard drive of equal or greater size. From what 
I've read, your
"ddrescue" software is perfectly suited for this task. Is this correct? I've 
also read how it
differs from "dd" and "dd_rescue". Your software's design is praised as being 
the more efficient
approach -- image all the easy to read sectors first, then come back and work 
on the damaged ones.
That makes sense. I need clarification on the physical setup of this step. 
Including the damaged
drive, does it require a total of two hard drives (damaged + target drive) or 
three (damaged +
target + drive w/ OS)? Currently my setup is as follows:

1. Primary HD (master drive on IDE1; non-empty -- contains one partition w/ 
Windows XP but
sufficient free space to hold the entire contents of the damaged HD)
2. DVD-ROM (slave drive on IDE1)
3. Damaged HD (single drive on IDE2)
4. An available external USB HD.

Is this a workable setup? I read that the HD that will receive the image of the 
damaged HD should
be new or empty. What's the best way to make it "empty"?

The next step, per your instructions, is to repair the image that "ddrescue" 
creates. The "fsck"
tool seems to be the most commonly used way to do so. But I've read that it 
does not work with
NTFS partitions. Is that true? If so, what tool do I use to repair an NTFS 
image? My hunch is that
it will be the "ntfsfix" tool which is part of the "ntfsprogs" package. Please 
help.

Again, referring to your instructions, once the image has been repaired, the 
next step is to mount
the image and use various tools for data recovery. Assuming I can successfully 
pull and repair and
image, which tool(s) would you recommend using for this mounting and recovery 
step? Again, in my
case it will be an NTFS (Windows XP) partition.

Congratulations on making it to the end of my message! I look forward to your 
expert advice. If
you need any clarification about my situation, please let me know.

Thank you very much!

James