On 6/5/2014 11:30 PM, Atom Smasher wrote:
on other failing drives i've used the "fill mode" to identify files
that haven't been completely recovered, but this disk is encrypted
(with luks). because the drive is encrypted, filling the un-recovered
parts of the image with a string will NOT put that string in the
files, after the image is decrypted.
before i spend too much time on it, does anyone have any tips or ideas
for identifying which files are missing some of their bits?
I am assuming that you are used to using the find/grep method. Check out
this link for more ideas that may work in your case, assuming the file
system is mountable:
http://tim.purewhite.id.au/2011/04/disk-recovery-which-files-are-damaged/
The one that is likely to work the best in your case would be the one
using MD5 checksums. The idea is to make a list of all the files MD5
checksums, then use the fill mode to change the bad sectors, then make
another list of the checksums and compare the lists. Because the disk is
encrypted you won't be able to find a specific pattern like you say, but
this method looks for differences in the files themselves which won't
care what the pattern is.
I have never personally used that method, but I am sure others have.
Scott
_______________________________________________
Bug-ddrescue mailing list
[email protected]
https://lists.gnu.org/mailman/listinfo/bug-ddrescue
