3

I have a problem with mounting the cloned partition. To clone it, I used as root: ddrescue -f -n /dev/sda3 ./sda3_rescue.img ./rescue.log

The partition which I cloned, was a broken NTFS partition. Broken, because during the resizing of this NTFS partition I had BoD (flash) and after that this partition was marked as a RAW (previously it was NTFS). Because I needed some windows tool, I copied this partition and reinstalled windows (but before I tried to use windows tools to repair this partition - of course without positive results). Now I need to get into this image and restore some important files. I tried to mount this image but mount cannot recognize this image as NTFS file system. Does anyone know how to get files from this kind of image?

wazoox
  • 6,782
  • 4
  • 30
  • 62
dave
  • 303
  • 3
  • 16
  • I forgot to add - ddrescue log is empty. – dave Oct 20 '18 at 06:13
  • 1
    You could try to run `testdisk` on that image. If that does not help, try to use [sleuthkit](https://www.sleuthkit.org/sleuthkit/). – Thomas Oct 21 '18 at 11:49
  • Thanks for your reply Thomas. testdisk didn't fix this image. About second tool - i'm not sure how to use it. – dave Oct 24 '18 at 09:40
  • What does `file sda3_rescue.img` say? – kasperd Oct 24 '18 at 10:27
  • `$ file sda3_rescue.img sda3_rescue.img: data ` – dave Oct 24 '18 at 15:17
  • 2
    It's probably broken beyond recognition. Your best bet is probably to use photorec to extract whatever it finds. – wazoox Oct 24 '18 at 17:19
  • @dave That may indicate the file system is broken beyond recognition (at least for `file`). `head -c512 sda3_rescue.img | hexdump -C` may provide some hints, but intimate knowledge of NTFS is needed to make progress. – kasperd Oct 24 '18 at 20:52
  • `head -c512 sda3_rescue.img | hexdump -C 00000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| * 00000200 ` – dave Oct 29 '18 at 06:50
  • 1
    looks filled with zeroes... Not good at all. Did you try *photorec* ? – wazoox Oct 29 '18 at 16:34

2 Answers2

1

Linux tools are probably not the best way to fix this. Use something like VBoxManage from VirtualBox to convert that fie you have (which is of type RAW) to a VHD or VHDX, then mount it on a Windows machine and run CHKDSK on it.

longneck
  • 22,793
  • 4
  • 50
  • 84
  • What makes you think VirtualBox is being used? Allegedly it was an NTFS partition being resized. VirtualBox was not mentioned anywhere. – kasperd Oct 24 '18 at 20:49
  • 2
    I never implied or assumed that VirtualBox was being used. I suggested it as a part of the solution because it contains a convenient utility for converting raw disk images to a VHD or a VHDX. – longneck Oct 25 '18 at 13:02
  • That makes sense. You should clarify what that tool will do to the original. Will it leave the original image unmodified and create a copy in a different format? – kasperd Oct 25 '18 at 13:06
1

Did you resize the partition in a way that caused the start of it to move? Depending on the exact tool used for resizing and what stage the resizing broke, that could explain why file is unable to detect it.

I would start by trying boot sector recovery from testdisk (Advanced -> Boot -> Rebuild BS). If that doesn't work, try running a partition scan from testdisk to hopefully find whatever is left from the original partition. Make sure you made another backup of the image file before touching any option that could modify your image.

You can also try DMDE - it lets you check if files are recoverable for free but the recovery has some limits until you pay - it managed to help me in a similar situation once (ntfsresize broke my partition because I tried to shrink it too much). There are probably other similar tools as well.

If that doesn't work either, then it's probably impossible to recover the filesystem without some really detailed knowledge about NTFS internals and fixing data strucures by hand.

In the worst case, you can try tools like photorec to try to recover data without looking at the NTFS filesystem at all, but that means all directory structure and heavily fragmented files on the hard disk would be lost.

krzys_h
  • 76
  • 1