Re: [Bug-ddrescue] How to properly repair rescued image?

[Ariel]

On Mon, 11 Jun 2007, James W. Watts wrote:

> Anyways... Let me see if I'm understanding this properly. Given what I have now 
> (an NTFS image
> file on an EXT2 partition), can I first mount that image in Linux to do some 
> quick-n-dirty data
> recovery (i.e. dragging files to a USB drive)? Many of the tutorials that I've 
> read point to this
> possibility. What do you think?

First, please remember to CC the mailing list when replying.

_If_ linux is able to mount the ntfs image then yes! get what you can. 
Make SURE to mount it ro (read only).

It depends on how damaged it is, if it's bad linux might not be able to 
mount it.

> I gather from your response that the partition type of the drive does need to 
> match that of the
> image file. And so does the recovery tool. Though, now that I think about it -- 
> when I write (not
> copy) the rescued NTFS image to a different HD for use in XP, that HD will 
> "become" NTFS by that
> process, right?

The partition type only matters on windows. Linux doesn't care. And no, 
copying the image to a drive will not change the partition type, you need 
to use a partioning tool for that.

And I don't understand what you mean by "write (not copy)".

Please go online and read whatever you can find about partitions and 
filesystems.

After you do that: you can have a filesystem in a partition, or you can 
have it as a (very large) file, sitting inside another filesystem, which 
itself is sitting on a partition. (Only on linux - windows does not 
support filesystem images as files, it can only read them in partitions. 
Maybe there is some tool for windows that can do it, I don't know.)

> Another question. Was it necessary for me to run HDD Regenerator? ddrescue's 
> info file makes
> reference to reading "raw" devices. Don't get me wrong. I feel lucky that HDD 
> Regenerator
> successfully repaired the drive so that it showed up correctly in /etc/fstab. 
> But I feel like this
> was a risky move and could have further damaged the drive.

In general no, I would not have done so. I would just have let ddrescue 
work on the drive directly. However your problem was that the partition 
table was messed up, and the drive just showed up as one big no-partition 
drive, and that could be a problem, so maybe running it just on the first 
sector of the drive (where the partition table is stored) would have been 
a good idea, but not to touch the rest of it.

Instead, first I would run ddrescue to get what I can without writing to 
the damaged disk. Then once I've done that let HDD Regenerator do what it 
can, and have ddrescue get anything extra it can find, since at that 
point you would have nothing to loose.

Also, there are tools on linux that can let you regenerate a partition 
table, so you could have copied the entire disk, and then run those.

        -Ariel

> --- Ariel <address@hidden> wrote:
>
> > On Mon, 11 Jun 2007, James W. Watts wrote:
> >
> > > I used ddrescue v1.3 to copy a crashed Windows XP NTFS partition. The rescued 
> > > NTFS image file
> > is
> > > stored on a hard drive with a single EXT2 partition. Referencing the tutorial in
> > 'ddrescue.info',
> > > I will next copy the image to a different drive for the repair stage.
> > >
> > > The tutorial states, "After the copy is repaired, with e2fsck or some other 
> > > tool appropriate
> > for
> > > the type of partition..." I'm confused. Does this mean that the tool for repair 
> > > needs to match
> > the
> > > file system of the rescued image file (NTFS in my case) or the file system of 
> > > the partition on
> > > which the rescued image file resides (EXT2 in my case)? Please advise.
> > >
> > > If the latter is true, I presume I will be able to run e2fsck against the image 
> > > for repair. If
> > the
> > > former is true, I'm not sure how to repair the image. Would I need to copy the 
> > > image to an
> > > NTFS-formatted hard drive, mount that HD in an XP machine, then run an NTFS 
> > > partition repair
> > tool?
> > > I've looked for such a tool that is Linux-based (e.g. ntfsck), but it does not 
> > > yet exist.
> >
> > You need to create a partition EXACTLY the same size as the old partition
> > was (down to the byte exactly).
> >
> > Then copy the ntfs data to that partition, boot windows and have windows
> > checkdisk (or some other commercial tool) work on it.
> >
> > Unlike linux windows can not open a filesystem that is stored as a regular
> > file, it has to be in a partition (and make sure the partition type is
> > correct).
> >
> > Hmm, actually it's theoretically possible you could use VMware, or other
> > virtualizer, to mount the file as if it was a real partition.
> >
> > When you create the partition you must use a tool that can show you
> > exactly how big it is (in sectors - multiply by 512 to get bytes).
> >
> > You may need to tell the partitioning tool to use a specific number of
> > heads and sectors-per-track (i.e. to use the same number as was used on
> > the original partition), otherwise you will find it impossible to make a
> > partition exactly the same size.
> >
> > Good luck.
> >
> >         -Ariel