is it possible to recover data from a partially saved disk image

Since the hard drive is toast, you can still try running TestDisk on the image file. Just tell testdisk to examine the image file. On Linux I'd just run this in a terminal

testdisk <image_file>

On Windows you might need to modify the command line, or perhaps run it from a terminal window too. The TestDisk Step By Step page has a brief section on Running TestDisk Executable that mentions using disk images.

Or if there isn't enough filesystem for TestDisk to read or repair, it's more likely PhotoRec might recover at least some files. It's run basically the same way as TestDisk above, (see PhotoRec Step By Step) just tell it to examine the image file

photorec <image_file>

That's only if your images are plain binary copies (or an Encase EWF image) and aren't compressed or formatted in some weird way by R-Drive or HD Clone, I'm not familiar with them.

If your first 150GB image hasn't been completely overwritten yet, you might possibly recover some files by using testdisk on the drive the image was deleted from, in case the image file is un-delete-able. Or run photorec on just the free space of that drive, and it might find some files, or perhaps the image itself.

Note: Recover / copy the found files to another drive. If you tried to recover files to the same drive you're searching, you could overwrite what you're looking for.

In the future, I'd use gddrescue instead, it's quite good at skipping over the very bad sectors of a failing drive, or reading "backwards", etc, but you do need enough space for the whole disk or partition being rescued.

Xen2050

Posted 2019-01-31T12:40:55.983

Reputation: 12 097

Actually, that HDD is unrepairable. I'm trying to find a way to extract data from these (or this, in case I can't recover the 150 Gb image) ISO archives, because they're the only thing left. – dado – 2019-01-31T15:21:17.337

I was talking about running testdisk & photorec on the image files, not the old hard drive itself, but I'll edit the Q to make it a little more explicit. PS did you try the freezer trick to get the old hard drive to maybe read a little bit more? – Xen2050 – 2019-02-01T10:10:00.257

Not yet. This HDD has a very peculiar history that includes the possibility of a misconfigured firmware chip, that has another serial number or, incredibly, its loss. I'll take this Saturday to follow these directions and give a feedback. – dado – 2019-02-02T13:18:45.453

I used Testdisk first and then Photorec to open the 32 Mb image. I had to try a few times, because in some occasions Testdisk didn't work, so I got different results. Basically they showed system files, icons, lots of unreadable word, txt and xml 1 Kb (or a litlle bigger) files. But, as well as their extensions, most of their size doesn't look to be real. As you mentioned, probably they are compressed or formatted in a weird way. – dado – 2019-02-04T12:04:23.193

Trying to recover the 150 Gb image, Testdisk opened 75 directories that contained more than 36k files, just in 3 hours, and it was expected to take more 18 hours, an estimate that kept growing. Inside them, hundreds (or thousands) of RAR, system extensions, gifs, txt, word, etc but, as far as I've seen, nothing related to the dead HDD. It "recovered" lots of files not deleted from this HDD in use and those that were attached to emails. These ones, as well as the system ones, have kept their real names. But loads of the others (mainly the word ones, I'm looking for) have numbers instead. – dado – 2019-02-04T12:09:33.643

Because I didn't know in which drive the deleted image was supposed to be saved, I tried both's free spaces (C and D). That's why this answer is kind of messy. I haven't tried Gddrescue yet. – dado – 2019-02-04T12:11:02.833

Photorec is like that, it doesn't know the original filenames but can sometimes extrapolate a title from the files. You can tell it to only look for a few types of files (MS Office, Word? Possibly even FAT or ext or other filesystem) in the File Opt settings, at least unselect the types you definitely don't want, that should cut down on a lot of the chaff, but there's usually a lot of old deleted file fragments lying around. – Xen2050 – 2019-02-05T10:42:52.313

I selected only text and pdf files and it showed 25 directories with 500 files each in drive C. It froze sometimes scanning drive D and showed 172 files in one directory. One pdf file has more than 17 Gb and there are some with 1,3 Gb and 300 Mb. Most of the word files have less than 10 k, and some of them look to be log files with more than 10 Mb. There´'s something wrong... – dado – 2019-02-06T23:43:08.363

Sounds like it's working, Photorec is a last resort tool (behind TestDisk, or the far superior copy from backups) that doesn't always recover perfect files, just delete the extremely large & tiny & corrupted ones (there's an option to keep corrupt files in it's settings too). For some reason Windows seems to have hundreds or thousands of tiny text files sometimes, sort by size & delete if they're obviously unwanted. Pausing the scan to sort & delete the unwanted files could keep their size a little contained too. – Xen2050 – 2019-02-07T02:59:16.820

I think Testdisk would work nicely if it had this same option to select the wanted files, like Photorec. It looks like most of these recovered files are system logs, or even images or apps converted to unreadable texts. Actually, apart from the "recovered" files that have not been delected, up till now there isn't even a single one from the dead HDD. Anyway, I'll try again. – dado – 2019-02-07T21:49:45.370

Data recovery can be very hit & miss, good luck! PS If my answer's useful or seems best, do accept it / select it as correct, and/or upvote it please

– Xen2050 – 2019-02-10T09:24:07.013

is it possible to recover data from a partially saved disk image

Answers