Re: [Bug-ddrescue] Merging individual partition image in to whole disk image

[Scott Dwyer]

Well dang, Paul, when I saw the title and your name on it, I thought it 
was going to be a tutorial :)

I am going to give the short version of this, you may have to fill in 
some blanks. Also please look carefully at any commands, as I have not 
tried them, only putting them there for reference. The first thing is to 
make a third "merged" image from the other two using ddrescue, and using 
the log (map) files as the domain file. This is easy for the full image, 
but you must use the --output-offset option on the partition image. From 
your output, the offset for that partition will be 52430848 * 512 (the 
start sector of the partition * the sector size in bytes), or 26844594176.

ddrescue --domain log img newimg templog1

ddrescue --domain log-sdc2 --output-offset 26844594176 img-sdc2 newimg 
templog2

Don't use the same log for the two different runs. Technically we don't 
need those logs, but they are nice to have just in case. Now this has 
copied all the data that has been read so far into one image, with the 
partition at the proper offset. This was the easy part.

Merging the logs is more complicated. The original log from the whole 
disk is okay, but the log from the partition copy must be altered (make 
sure to work with a copy of this log and not the original). The best way 
to do this is with a spreadsheet program. You need to get all of the 
lines in the log that follow the current position into the spreadsheet 
into three columns. I will let you figure out how to do that with 
whatever spreadsheet you use. But there is one more thing, spreadsheets 
HATE hexadecimal numbers. So once you figure out how to get the data 
into the sheet, you need to convert the hex numbers into decimal. You 
may have to use the replace function to remove all of the leading 0's 
from the 0x's (I remember having to do this somewhere). Then you need to 
figure out what special formula will extract decimal numbers from the 
hex columns (Google is your friend). Once you have done that, you then 
need to use a formula to add the offset 26844594176 to all the values in 
the position column (don't add them to the size column). Once you have 
done that, you need to export that (or copy and paste if it works) into 
a text file, the columns need to be separated by spaces, or I think tabs 
can work also. You also need to add one line at the top, "0  26844594176 
?". You also need to add a current position line, it would be best to 
copy all of the header data from the original log into the new text 
file. Notice I never mentioned converting back to hex, that is because 
you don't need to, ddrescue will accept decimal numbers in the log just 
fine, if they don't start with "0x" they are considered decimal.

Now that you have a modified partition log, you should be able to create 
a merged log file using the --or-mapfile option of ddrescuelog. This 
will logically "OR" the original log and the modified partition log into 
one log, so that any area that was finished in either log will show as 
finished in the merged log. The only thing is that I think it will loose 
all the data for which blocks are bad and non-trimmed and such, I think 
it will make them all non-tried. I don't think there is a way to keep 
that without manually splicing the logs together :(

ddresucelog --or-mapfile modified-partition-log log > newlog

Hope that helps and is not too confusing, and that I got everything right,

Scott


On 6/29/2017 4:11 AM, Paul Daniels wrote:
> I've got a drive that's being quite difficult.  Initially I started 
> reading the whole device (/dev/sdc) but due to the rapidly failing 
> nature after I had pulled the first lot of data off I decided to try 
> attack /dev/sdc2 directly (which is the Windows partition with the data).
>
> Anyhow, due to changing my mind a bit, I now have two partial images 
> and I wish to merge them and then continue on with reading the *whole* 
> drive again;  the drive now has lost the ability to read the partition 
> table ( don't bother telling me to send it to a cleanroom, I've 
> already been over this with the client, they don't want to spend the 
> $, they just want to see what they can get off with software recovery ).
>
> I have img and log  ( ddrescue -v -f -O -P16 /dev/sdc img log )
> ..and I have  img-sdc2 and log-sdc2  ( ddrescue -v -f -O -P16 
> /dev/sdc2 img-sdc2 log-sdc2 )
>
> There's some degree of overlap; about 50GB of data in the img-sdc2 
> that hasn't been (yet) picked up in 'img'.
>
> Here's the main image.
> Disk /dev/loop0: 698.7 GiB, 750156374016 bytes, 1465149168 sectors
> Units: sectors of 1 * 512 = 512 bytes
> Sector size (logical/physical): 512 bytes / 512 bytes
> I/O size (minimum/optimal): 512 bytes / 512 bytes
> Disklabel type: dos
> Disk identifier: 0xc1735e81
>
> Device       Boot     Start        End   Sectors   Size Id Type
> /dev/loop0p1           2048   52430847  52428800    25G 1c Hidden W95 
> FAT32 (LBA)
> /dev/loop0p2 *     52430848  681576447 629145600   300G  7 
> HPFS/NTFS/exFAT
> /dev/loop0p3      681576448 1465145343 783568896 373.7G  f W95 Ext'd 
> (LBA)
> /dev/loop0p5      681578496 1465145343 783566848 373.6G  7 
> HPFS/NTFS/exFAT
>
>
> So, in summary, how can I merge what is recovered in img-sdc2 in to img ?
>
> Regards, Paul.
>
>
> _______________________________________________
> Bug-ddrescue mailing list
> address@hidden
> https://lists.gnu.org/mailman/listinfo/bug-ddrescue