[Bug-ddrescue] Warning that Windows will try to "fix" a partially copied ntfs partition.

[Jon Pinkley]

This is not a bug report about ddrescue, only a recommendation to update the 
documentation for ddrescue.

I am primarily a Windows user.  I had problems with a WD 2TB external USB hard 
drive, and after a web search, found that ddrescue was the best available tool 
for getting as much data off the drive as possible.  So I bought a 2TB Samsung 
SATA drive, installed it in my PC, downloaded the Parted Magic distribution for 
USB flash, and started the recovery process.   After about 10 GB had been 
copied, I interrupted, and verified that I could restart (I am using a logfile 
on the USB stick).  Everything worked well, so I let it continue recovery over 
night.

The next morning, the PC was needed for use with Windows XP SP3.  So I 
shutdown, removed the external USB drive (the source), and rebooted Windows.

I hadn't realized what would happen.  The destination disk was an internal 
drive in the PC, and Windows saw a valid partition table entry for the ntfs 
partition, but detected inconsistencies, and tried to "fix" things.

So before I started the recovery again, I used gparted and marked the partition 
of the USB external hard drive as hidden.  Then I deleted my ddrescue logfile 
and started ddrescue over again (since I had no idea what blocks Windows had 
modified on the partially recovered destination drive).

After about 10 GB had been copied, I interrupted, verified with gparted that 
both the source and destination disks' partitions were hidden, and then 
shutdown.

I rebooted Windows XP, and this time it did not try to fix the drive.

The important concept is that any partially copied partitions should be hidden 
before allowing them to be touched by any operating system that is going to 
attempt to mount and "fix" the partitions it sees.  You could hide the 
partitions on the destination drive, but if you don't want Windows to see the 
drive you are recovering from (to prevent any changes), then marking the 
partitions on the input drive will also ensure that the output drive will have 
hidden partitions as well (since the partition table is copied too), and it 
will insulate your drives from Windows.  After the copy is complete, then the 
partitions of the output device can be unhidden, and then the checking/fixing 
of the drive may be appropriate.