On 11/12/2013 12:12 AM, Scott Dwyer wrote:
I would like to point something out that relates to both an
"unfinished" image, and using ddru_ntfsbitmap (something I need to add
to the documentation). In any event, anything less than a 100%
recovery will leave portions on the target image/drive that have not
been written to by ddrescue. If copying to a brand new hard drive,
those areas are (hopefully) likely to be zeros. But in any other case,
those areas will contain whatever data was there previously. For
someone that uses their system for data recovery on a regular basis,
and is using image files or reusing hard drives, those areas could
contain data from a previous recovery! This could be a privacy issue
in some cases, but also could cause an issue with running any other
sort of repair/file recovery tools on the recovered image/drive. The
unrecovered parts could contain "garbage" data that could affect
accurate recovery. In these cases I would recommend using the fill
mode of ddrescue to fill any unfinished/untried areas with zeros.
Example command:
ddrescue --fill-mode=?/*- /dev/zero recovered_image logfile
This would write zeros to any portion of the recovery that was not
successfully read from the source.
I guess I'll have to do this at the end :)
So now to answer your question about an "unfinished" recovery. That
depends on how much and what areas were recovered. You can obviously
only recover what was successfully read. In the case of NTFS, if the
MFT (master file table) is not recovered in full or is damaged, it
makes recovery much more difficult. Which gives me the idea of adding
an option in ddru_ntfsbitmap to create a secondary domain file for
just recovering the MFT first :)
Scott
Would be a good idea :) Any way I can check if the MFT was recovered
successfully now?
Well my drive has now come to approx. 40GB and now refuses to continue
even if I power cycle it. Is it right to use this line here (reverse
copying) :
"ddrescue -R -A -m /tmp/domain_logfile -v /dev/sdb1 /tmp/Image.img
/tmp/Image.log"
I assume this will start to copy data from the end of only the USED part
of the partition right?
Greetings,
Andrej.
_______________________________________________
Bug-ddrescue mailing list
[email protected]
https://lists.gnu.org/mailman/listinfo/bug-ddrescue
