I would like to point something out that relates to both an "unfinished"
image, and using ddru_ntfsbitmap (something I need to add to the
documentation). In any event, anything less than a 100% recovery will
leave portions on the target image/drive that have not been written to
by ddrescue. If copying to a brand new hard drive, those areas are
(hopefully) likely to be zeros. But in any other case, those areas will
contain whatever data was there previously. For someone that uses their
system for data recovery on a regular basis, and is using image files or
reusing hard drives, those areas could contain data from a previous
recovery! This could be a privacy issue in some cases, but also could
cause an issue with running any other sort of repair/file recovery tools
on the recovered image/drive. The unrecovered parts could contain
"garbage" data that could affect accurate recovery. In these cases I
would recommend using the fill mode of ddrescue to fill any
unfinished/untried areas with zeros. Example command:
ddrescue --fill-mode=?/*- /dev/zero recovered_image logfile
This would write zeros to any portion of the recovery that was not
successfully read from the source.
So now to answer your question about an "unfinished" recovery. That
depends on how much and what areas were recovered. You can obviously
only recover what was successfully read. In the case of NTFS, if the MFT
(master file table) is not recovered in full or is damaged, it makes
recovery much more difficult. Which gives me the idea of adding an
option in ddru_ntfsbitmap to create a secondary domain file for just
recovering the MFT first :)
Scott
On 11/11/2013 12:22 PM, Andrej Trobentar wrote:
On 11/11/2013 06:00 PM, Scott D wrote:
I am at work so I must be brief. I see you are using my very new
utility ddru_ntfsbitmap. I hope it works well for you. What I do see
in your commands is that after a failure, you leave out "-m
/tmp/domain_logfile". Leaving that out will cause ddrescue to read
the whole partition and not just the used part. So your command after
a failure should be more like "ddrescue -A "-m /tmp/domain_logfile -v
/dev/sdb1 /tmp/Image.img /tmp/Image.log", unless you do wish to
recover the whole partition and not just the used part.
First of all thanks for your fast reply!
OK, I'll add the "-m /tmp/domain_logfile" in case of driver failure -
glad I asked first :)
As for mounting, I personally would not try to mount it until the
recovery is finished. And if it were me, if possible I would make a
backup copy of the recovery before attempting any "fixing" or
mounting, especially if there are errors.
Of course I would make a copy of the "unfinished" image and do all the
experiments on the copy, but thanks for pointing that out.
But let's assume that the drive doesn't power up any more. How to
recover from the "unfinished" .img file that we got left? Is this even
possible?
Thanks for your answers and greetings from Slovenia,
Andrej.
_______________________________________________
Bug-ddrescue mailing list
[email protected]
https://lists.gnu.org/mailman/listinfo/bug-ddrescue
_______________________________________________
Bug-ddrescue mailing list
[email protected]
https://lists.gnu.org/mailman/listinfo/bug-ddrescue
