cgsecurity.org

Hello!
I'm trying to learn how to use TestDisk. I have been reading the information in the website and Forums but I haven't found the answer to my question, and yet, it must be pretty simple.

I've been told that I can create a disk image (a .dd file), which will copy my disk's partitions and files, whether they are working or not. I'm trying to do that on my disk.
I've been to the 'advanced' menu where I found the option to create an image, but it seems that I can only do it partition by partition, not for the whole disk at once.
Is it possible to create only one image file, of the whole disk? If I create an image partition by partition, and choose 'append' when creating the new image file, will that result in what I want? Or will it lack some information?

Thank you!

To create a disk image of the whole disk, you can use ddrescue as described in https://www.cgsecurity.org/testdisk.pdf
Another possibility (not the recommended solution) is to force the partition table type to None when testdisk starts and in advanced, choose to create the whole disk image.

Thank you! I hadn't found that file yet, it's very useful! I'll try to use DDRescue then.

But, out of curiosity, some additional questions:
What is the the image of a specific partition useful for, then? If I have a (not phisically) damaged disk, not being able to access any files, if I create an image of a non-damaged partition, will I be able to access the files of that partition? (Using photorec to read .dd files, as I have been reading).
And also, is there any information of the disk structure that wouldn't be collected on a partition by partition imaging?

Image of a filesystem is useful for forensics purpose, when dealing with disk with bad sectors, to experiment with.
If you create an image of a non-damaged FAT/exFAT/NTFS/exf2/3/4 filesystem, testdisk can open this partition and can list its content.
Creating an image doesn't keep information like the sector size (512 bytes or sometime 4096).

Ok, so, just to make sure:
If I had a disk with several partitions, that I couldn't access due to bad sectors somewhere...if my only purpose was to recover some files, and if those files were in a non damaged partition, the best thing to do would be to image that one partition, recover the files, and format the whole disk. There would be no need to recover the damaged sectors on the other partitions. Is this correct?