[EMAIL PROTECTED] (James W. Watts) wrote: > I have successfully created an 80GB image of a damaged drive using > ddrescue. The drive was from an NTFS XP machine. What's the best > way to read/mount this image file for data recovery? I've been > using GetDataBack for NTFS on another machine. No results.
Hi James, You can read it directly on the Linux box. First, you need to find out where the NTFS partition is. (The LBA sector offset on the drive of the NTFS partition.) You can probably just do fdisk on the sick drive: fdisk -lu /dev/hdc Alternately, you can do fdisk on the image file, via a loopback device: losetup -r /dev/loop0 drive.ima fdisk -lu /dev/loop0 The most common starting offset is LBA sector 63. If that is what yours is then mount the NTFS partition like this: # Mount the image copy of /dev/hdc1 via loopback device (use "-r" for read-only): losetup -r /dev/loop1 -o 32256 drive.ima # Note: 32256 is 63 x 512, where '63' is the 'Start' offset shown by 'fdisk -lu' mkdir /mnt/img1 2>/dev/null mount -t ntfs /dev/loop1 /mnt/img1 Now you can access your NTFS partition just like any other file system under Linux, e.g., ls -al /mnt/img1/ When you are done, you can unmount it like this: losetup -d /dev/loop0 umount /mnt/img1 losetup -d /dev/loop1 If, due to too many bad sectors, that fails, then you'll need to let Windows try to fix it. Start by copying the image to a scratch drive which is at least as large as the image file. Then connect the scratch drive to a Windows XP or Windows 200x box, and let Windows chkdsk it. (This might take a while!) Then, when it is done, look for your data. How many unrecovered sectors are there? Be sure that you did at least one "-r 1" data recovery pass using ddrescue's -d (raw) mode. Otherwise you're probably giving up a lot of recoverable data! Here's a typical recovery script for one of my recovery chores: fdisk -lu /dev/hdc >fdisk-lu_out.txt # first try we go for speed: hdparm -d1 /dev/hdc hdparm -a256 /dev/hdc hdparm -A1 /dev/hdc blktool /dev/hdc read-ahead 256 ddrescue -B -n /dev/hdc drive.ima drive.log cp -p drive.log drive.log.1a # second try is similar, but read only 4K at a time: hdparm -a8 /dev/hdc hdparm -A0 /dev/hdc blktool /dev/hdc read-ahead 0 ddrescue -B -c 8 /dev/hdc drive.ima drive.log cp -p drive.log drive.log.2a # third try we only read one sector at a time, and use direct (raw) I/O: hdparm -a0 /dev/hdc hdparm -A0 /dev/hdc hdparm -k1 /dev/hdc hdparm -K1 /dev/hdc ## mknod /dev/raw/raw9 c 162 9 2>/dev/null ## raw /dev/raw/raw9 /dev/hdc # "-d" takes the place of using the raw device (starting w/ ddrescue 1.4): ddrescue -B -c 1 -r 1 -d /dev/hdc drive.ima drive.log cp -p drive.log drive.log.3a # fourth try is with DMA disabled, and five retries: hdparm -d0 /dev/hdc ddrescue -B -c 1 -r 5 -d /dev/hdc drive.ima drive.log cp -p drive.log drive.log.4a ## raw /dev/raw/raw9 0 0 # restore drive parameters: hdparm -a256 /dev/hdc hdparm -A1 /dev/hdc blktool /dev/hdc read-ahead 256 hdparm -d1 /dev/hdc You can also use Microsoft's NFI tool with my ddr2nfi.pl and nficruncher.pl scripts to determine which files are damaged based on ddrescue's .log file. This seems to not be 100% reliable, but it is the best I've been able to come up with. On the Linux box: /rescue/ddr2nfi.pl nficmds.bat - fdisk-lu_out.txt drive.log On the Windows box: First, edit nficmds.bat to fix the drive letter. Then run nficmds.bat, redirecting (capturing) the output into a text file. Then use nficruncher.pl to analyze the captured output. (Get these scripts from ddr2sr.zip on the downloads page of my web site.) I hope this helps. -Dave www.burtonsys.com [EMAIL PROTECTED] (James W. Watts) wrote: > Hello, > > I have successfully created an 80GB image of a damaged drive using ddrescue. > The drive was from an > NTFS XP machine. What's the best way to read/mount this image file for data > recovery? I've been > using GetDataBack for NTFS on another machine. No results. > > Other or better options? > > James _______________________________________________ Bug-ddrescue mailing list [email protected] http://lists.gnu.org/mailman/listinfo/bug-ddrescue
