Re: [Bug-ddrescue] Having trouble mounting ddrescue image

[Ian Oliver]

In article <address@hidden>, Lonestarshack wrote:
> First of all Ian...Thank you for explaining a few things to me. It cleared up
> a lot of misunderstandings that I had about the correct way to use ddrescue.

My pleasure.

> I took your suggestion and it appears I was able to save about half the
> drive after letting it run for a really long time.

Half doesn't sound too good. Did it finish all the trimming and splitting and 
get to retries?

> However, now I can't seem
> to figure out how to mount the image. I believe I am using the correct
> offset and everything. Any thoughts? 
> 
> address@hidden gw_bak]# losetup -r /dev/loop0 gw_r1.img

I assume that gw_r1.img is an image of the full disk?

> address@hidden gw_bak]# fdisk -lu /dev/loop0
> 
> Disk /dev/loop0: 54.3 GB, 54288610304 bytes
> 255 heads, 63 sectors/track, 6600 cylinders, total 106032442 sectors
> Units = sectors of 1 * 512 = 512 bytes
> Sector size (logical/physical): 512 bytes / 512 bytes
> I/O size (minimum/optimal): 512 bytes / 512 bytes
> Disk identifier: 0xedaaedaa
> 
>       Device Boot      Start         End      Blocks   Id  System
> /dev/loop0p1   *    14346045   195350399    90502177+   7  HPFS/NTFS
> /dev/loop0p2              63    14346044     7172991    b  W95 FAT32
> 
> Partition table entries are not in disk order

That all seems sensible other than the partition order, which shouldn't matter.

address@hidden gw_bak]# losetup -r /dev/loop1 -o 7345175040 gw_r1.img
> address@hidden gw_bak]# mkdir /mnt/gwimg 2>/dev/null
> address@hidden gw_bak]# mount -t ntfs /dev/loop1 /mnt/gwimg
> NTFS signature is missing.

I can't see there being an issue with two ro loops pointing at one file, but 
you might want to remove loop0 before creating loop1.

I agree that your offset looks right. (BTW, bash has a sort of calculator - you 
can do "losetup -o $((512x14346045))" )

> Maybe the wrong device is used? Or the whole disk instead of a
> partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?

As fdisk has shown your partition table, I think that you've done everything 
right.  my guess would be that the boot sector of that partition wasn't read 
from the disk. You could use some ddrescue options to get it to really scrape 
away at that bit.

Try "hd /dev/loop1 | less" and see what's in the first sector of that 
partition. 

You could also try this -
"dd if=/dev/loop0 bs=512 skip=195350399 count=1 | hd | less"
That should be the last sector of your ntfs partition and this is a spare copy 
of your boot sector. (Of course, my maths might be wrong!) You could then use 
dd with some funky skip/seek and notrunc to put the good copy in place of the 
bad one.

However, with so much of the disk missing, you're going to really struggle. I 
have used a couple of tools in the past to work on badly corrupted NTFS disk 
images, and these are "Disk Explorer NTFS" and "Getdataback NTFS" - I recall 
the former will work on a disk image but haven't used the latter much.

Note that these are commercial tools that run on Windows, and that you'll also 
need to use an copy of your precious image. Others may know of free/Linux 
tools.

Good luck!

Ian