Re-do the ntfsbitmap command, but do it on /dev/sdc use the offset argument to tell it where the partition begins, using the numbers from fdisk. If the partition you want starts at sector 1000, that would be (if using the bash shell)
ntfsbitmap -i $((1000 * 512)) /dev/sdc domain_mapfile That will allow you to recover the rest of the partition into your existing image file. It will also ensure that the partition table is recovered, too. On Fri, 30 Jan 2026 at 19:54, Paul L Daniels <[email protected]> wrote: > I don't know what I was thinking but a week ago I started a recovery on > the whole /dev/sdc (NTFS windows partition on /dev/sdc3) ( saved to > 'img' and logged to sdc.log ) > > I've got *most* of the data I want already but today I realised my > mistake and instead built a recovery map using; > > ddru_ntfsbitmap /dev/sdc3 domain_mapfile > > Is there a way of merging what I've already recovered (~95%) in the > large /dev/sdc img+log or am I just better off waiting it out again for > the new NTFS specific mapfile to be recovered? > > I agree, it was a bad oversight. > > > Regards Paul. > > -- > Paul L Daniels - http://pldaniels.com > A.B.N. 19 500 721 806 > > >
