Best way to approach recovery of ddrescue image?

Using PhotoRec to recover lost data
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
User avatar
whoabuddy
Posts: 1
Joined: 11 Oct 2013, 17:17
Location: Las Vegas, NV
Contact:
Contact whoabuddy

Best way to approach recovery of ddrescue image?

#1 Post by whoabuddy »

Hello All,

I am posting here in relation to a user that I am assisting over at BleepingComputer, and after using ddrescue to create an image file from the failing hard drive, we are now unable to mount it and access the files. Originally the plan was to clone the hard drive to a new one, but the user received a new laptop and now we just want to try and extract his files from the image itself. But there's a twist! Here is a small transcription of what's conspired so far:
  • User suspected a virus due to PC locking up, eventually PC was not booting correctly
  • User ran Boot Repair from Ubuntu Rescue CD, wrong MBR written to disk
    => Syslinux MBR (4.04 and higher) is installed in the MBR of /dev/sdb.
    ...(truncated)...
    sdb1:
    File system: ntfs
    Boot sector type: Windows 7/2008: NTFS
    Boot sector info: The info in the boot sector on the starting sector of the MFT Mirror is wrong.
    Mounting failed: ntfs_attr_pread_i: ntfs_pread failed: Input/output error
    Failed to read $MFTMirr: Input/output error
    Failed to mount '/dev/sdb1': Input/output error
    http://www.bleepingcomputer.com/forums/ ... try3119445
  • We checked drive health in Parted Magic, read errors detected during DST
    http://www.bleepingcomputer.com/forums/ ... try3120175
  • We started recovery with ddrescue to create image file
    http://www.bleepingcomputer.com/forums/ ... try3123369
  • Significant portion of drive recovered according to ddrescue log
    08/06/13 6:03pm, 6gb recovered, 69mb errsize
    08/07/13 7:57pm, 43gb recovered, 72mb errsize
    08/09/13 8:04pm, 88gb recovered, 180mb errsize
    08/10/13 9:01pm, 100gb recovered, 269mb errsize
    08/15/13 6:49am, 225gb recovered, 357mb errsize
    08/15/13 5:47pm, 250gb recovered, 350mb errsize
    08/19/13 9:03am, 250gb recovered, 143mb errsize
    08/23/13 9:02am, 250gb recovered, 137mb errsize
    http://www.bleepingcomputer.com/forums/ ... try3135799
  • We tried to mount the drive several different ways and gather as much info as possible, but no luck
    http://www.bleepingcomputer.com/forums/ ... try3140973
So at this point I was thinking TestDisk or PhotoRec would be a great option for the user, but I am not very familiar with these tools and exactly how they work, especially given the circumstances of this particular recovery. Any advice would be appreciated!

Best Regards,
whoabuddy
Top
bartleby
Posts: 10
Joined: 26 Sep 2013, 01:49

Re: Best way to approach recovery of ddrescue image?

#2 Post by bartleby »

There are lots of tutorials/how-tos on the web for using the tools including this site. I think you would mount the image as a loopback device in order to extract the data or perhaps rebuild partition tables etc. I found this info helpful (might want to read the comments too): http://www.andremiller.net/content/moun ... sing-linux
Top
Locked

Return to “File recovery”