any way to mount partial raw ntfs images?

2

I have a raw image from ddrescue which is a partial image of the complete source NTFS partition, simply because the target drive is smaller then the source.

I cant mount this partial image so as to copy over the files.I get this error:

Failed to read last sector (3905654783): Invalid argument
HINTS: Either the volume is a RAID/LDM but it wasn't setup yet,
   or it was not setup correctly (e.g. by not using mdadm --build ...),
   or a wrong device is tried to be mounted,
   or the partition table is corrupt (partition is smaller than NTFS),
   or the NTFS boot sector is corrupt (NTFS size is not valid).
Failed to mount '/dev/loop0': Invalid argument
The device '/dev/loop0' doesn't seem to have a valid NTFS.
Maybe the wrong device is used? Or the whole disk instead of a
partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?

Command that i am using:

sudo mount -t ntfs /image.img /mountpath -o loop

Is there any way by which i can recover data contained in this partial image file?

ashishsony

Posted 2013-03-05T04:37:29.180

Reputation: 652

So I guess you managed to solve your previous problem regarding how to create partial images? You should add the commands you used as an answer there. Regarding the problem at hand, have you tried to fsck the NTFS partition?

– Karan – 2013-03-05T04:46:54.500

@Karan nope.. i couldnt just say ddrescue to only create a valid 500GB image out of the 2TB partition(so thats still unresolved).. just because the target drive size is lesser.. i am going to get an image with max size that ddrescue is going to save on it(backup still going on since yesterday!). Meanwhile i interrupted once (ddrescue can resume operation) to check if i can use the resulting image,which doesnt mount! – ashishsony – 2013-03-05T05:08:15.537

I removed references to ddrescue in title and tags, as DDRescue is really only involved in creating the image - the answer to the question is not dependant on an understanding of DDRescue. – davidgo – 2013-03-05T05:08:44.193

Answers

0

I'm trying to do the same thing, mount partial raw ntfs image or try to rescue files from partial ntfs dump from ddrescue.

List of tools I plan to test (first make a copy of rescued image and play with the copy):

  • testdisk [1]
  • ntfsfix [1] [2]
  • fsck tool
    fsck.ntfs -y image-copy.img
  • sleuthkit [3]
  • photorec [4]
  1. http://ubuntu-rescue-remix.org/node/71#comment-111
  2. http://linux.die.net/man/8/ntfsfix
  3. http://www.sleuthkit.org/sleuthkit/index.php
  4. http://www.plug.org/pipermail/plug/2009-January/019942.html

LukasT

Posted 2013-03-05T04:37:29.180

Reputation: 280

Copying a large filesystem image can be pretty time-consuming. I've come across a tool that allows you to mount an image and redirect any writes to a separate cache file so you can preserve the original image. It's called Xmount, you can find it here

– Gogeta70 – 2017-10-19T21:20:58.797