I am posting here in relation to a user that I am assisting over at BleepingComputer, and after using ddrescue to create an image file from the failing hard drive, we are now unable to mount it and access the files. Originally the plan was to clone the hard drive to a new one, but the user received a new laptop and now we just want to try and extract his files from the image itself. But there's a twist! Here is a small transcription of what's conspired so far:
- User suspected a virus due to PC locking up, eventually PC was not booting correctly
- User ran Boot Repair from Ubuntu Rescue CD, wrong MBR written to disk
http://www.bleepingcomputer.com/forums/ ... try3119445=> Syslinux MBR (4.04 and higher) is installed in the MBR of /dev/sdb.
...(truncated)...
sdb1:
File system: ntfs
Boot sector type: Windows 7/2008: NTFS
Boot sector info: The info in the boot sector on the starting sector of the MFT Mirror is wrong.
Mounting failed: ntfs_attr_pread_i: ntfs_pread failed: Input/output error
Failed to read $MFTMirr: Input/output error
Failed to mount '/dev/sdb1': Input/output error - We checked drive health in Parted Magic, read errors detected during DST
http://www.bleepingcomputer.com/forums/ ... try3120175 - We started recovery with ddrescue to create image file
http://www.bleepingcomputer.com/forums/ ... try3123369 - Significant portion of drive recovered according to ddrescue log
http://www.bleepingcomputer.com/forums/ ... try313579908/06/13 6:03pm, 6gb recovered, 69mb errsize
08/07/13 7:57pm, 43gb recovered, 72mb errsize
08/09/13 8:04pm, 88gb recovered, 180mb errsize
08/10/13 9:01pm, 100gb recovered, 269mb errsize
08/15/13 6:49am, 225gb recovered, 357mb errsize
08/15/13 5:47pm, 250gb recovered, 350mb errsize
08/19/13 9:03am, 250gb recovered, 143mb errsize
08/23/13 9:02am, 250gb recovered, 137mb errsize - We tried to mount the drive several different ways and gather as much info as possible, but no luck
http://www.bleepingcomputer.com/forums/ ... try3140973
Best Regards,
whoabuddy