Re: [Bug-ddrescue] Interpreting logfile of restore to get list of corrupted files

[Dave Burton]

Chris, you can get ddrsummarize.pl, ddr2nfi.pl, nficruncher.pl,
ddrlogor.pl, and a lot of other ddrescue-related Perl scripts
by downloading:

  http://www.burtonsys.com/download/ddr2sr.zip


If your hard disk drive is not in NTFS format, then I can't
offer much help.  But if your hard disk drive is in NTFS
format, then here's what I would do if I were you.


1) Copy the entire rescued disk image to a scratch drive.


2) Save a copy of the partition table, like this:
     fdisk -lu drive.ima >fdisk-lu_output.txt
or:
     fdisk -lu /dev/hdd >fdisk-lu_output.txt
(or whatever)


2) Use ddr2nfi.pl (formerly called srddrnfi.pl) to generate a .bat
script of 'nfi' commands from the ddrescue logfile.  Call the .bat
script "nficmds.bat":
  perl -w ddr2nfi.pl nficmds.bat - fdisk-lu_output.txt drive.log

or if you used SpinRite (probably via ddr2sr.pl):
  perl -w ddr2nfi.pl nficmds.bat SPIN_LOG.3 fdisk-lu_output.txt log_before_SR 
log_after_SR


3) Copy the nficmds.bat file to a thumb drive or diskette.

3.1) If you don't already have Microsoft's nfi ("NTFS File
Sector Information Utility") then get it, too:

   
http://www.google.com/search?q=%22NTFS+file+sector+information%22+site%3Amicrosoft.com


4) Attach the scratch drive to a Windows computer as a 2nd
drive ("E:" for this example), and start the computer.

Do NOT let Windows check the drive during startup, because
if you do then you won't get to capture the list of file names
that it mentions when checking the drive.


5) If the drive letter doesn't match the drive letter in
nficmds.bat, then edit nficmds.bat and fix the drive letters.


6) (This step is optional; if you get tired of acknowledging
the pop-up boxes then you can skip steps 6 and 7.)
Run nficmds.bat on the Windows computer, redirecting the
output into a text file:

   nficmds.bat >nfioutput.txt


7) Process nfioutput.txt to produced a "damaged files report,"
and various other reports:

   perl -w nficruncher.pl -f -d -r -i -u nfioutput.txt


8) In a Windows XP or Win2000 command-prompt window do:

   chkdsk /f E: >c:\errors1.log.txt

(c:\errors1.log.txt is effectively another damaged files report.)


9a & 9b) Save the output files produced in steps 6 and 7.  Then
repeat steps 6 and 7.  (Because of the chkdsk you did in step 8
there are less likely to be pop-up messages to acknowledge.)


10) Your (not necessarily complete) list of damaged files is
the combined list of files found in steps 7, 8, and 9b.


11) It is also possible to use the output of nficruncher.pl
to "get smarter" with ddrescue.  For example, it produces a
free-space sector list, in ddrescue logfile format, which you
can merge into the regular ddrescue logfile, to pretend that
those unused sectors were already rescued, so that you don't
waste time trying to rescue them.

BTW, that's why you copied the recovered disk image to a
scratch drive in step 1 -- because Windows changes the drive
when it examines it (and drastically changes it when doing
chkdsk), which prevents you from restarting the rescue process
using ddrescue.  But since you only let Windows touch a
scratch copy, Windows couldn't mess up the original.

To merge the "unimportant.log" file (free-space sector list)
produced by nficruncher.pl, you can use the ddrlogor.pl script
("DDRescue LOGfile logical .OR.").

Note: one trick that I've done is to edit nfioutput.txt before
processing it with nficruncher.pl, to make it look like some
files that I don't care about, e.g., hiberfil.sys and
swapfile.sys, are part of the free-space, too.  Then, after
ddrlogor.pl merges unimportant.log, ddrescue's logfile will
indicate that those other unimportant files are already
recovered, so ddrescue won't waste time trying to recover them.


12 & on)  Then you can resume the ddrescue recovery process,
perhaps just targetting the most important disk areas, before
going back to step 1.


For lots more instructions, see the comments in the various
Perl scripts.

-Dave
dave304 at burtonsys dot com but please no spam

P.S. -- If you know of (or write) the equivalent of 'nfi' for
FAT32 (or other file systems), or to run under Linux instead
of under Windows, then please tell me!!



address@hidden (Chris Witham) wrote:

> I have a hard drive that was failing, and I was referred[1] to
> ddrescue.  It appears to have done a great job, but it reported over
> 1600 errors.  I am trying to find a way to turn the 5kB logfile from
> the restore into a listing of affected files so I know what I need to
> replace.
>
> Searching this list led me to a post[2] on this list that suggested I
> needed 'ddrsummarize.pl' to turn the log into more understandable
> results, but I haven't been able to locate it by Googling.
>
> If my approach is correct, can someone point me to where I can get a
> copy of 'ddrsummarize.pl' ?  If not, how do I determine which files
> were restored without problems and which are almost certainly
> corrupted?
>
> Thanks!
>
>
> [1] http://www.linuxquestions.org/questions/showthread.php?t=485322
> [2] http://www.mail-archive.com/address@hidden/msg00048.html