Hello,
When rebuilding my workstation I accidentally formatted an NTFS partition with macrium two reflect images. I had a working backup for the smaller one but there is a larger one over 400gb for which my backup is corrupted. I am trying to recover the .mrimg file with photorec but it does not support the filetype. I have found some instructions (https://www.cgsecurity.org/wiki/Add_you ... o_PhotoRec) and here (https://techglimpse.com/photorec-recove ... file-type/) but this is a bit confusing for me and the guide is using much simpler files such as a .php file.
Would it also be possible to add support for the Macrium reflect image file?
I created a test one of a very tiny FAT32 partition and tried on the photorec online checker and it said: ERROR: PhotoRec doesn't know this format.
https://www.cgsecurity.org/photorec/sca ... ef83d73b0c
Would anyone be able to tell me if what I am doing is possible and be able to help me through the process. It would be very much appreciated.
I am working on Windows 10 and I have the Linux subsystem with Ubuntu installed. I also have a Ubuntu machine I can work from if needed.
Recovery of Macrium reflect .mrimg
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
-
cgrenier
- Site Admin
- Posts: 5432
- Joined: 18 Feb 2012, 15:08
- Location: Le Perreux Sur Marne, France
- Contact:
Re: Recovery of Macrium reflect .mrimg
The small image file you provide looks like a truncated raw image.
I have successfully opened it using TestDisk, Geometry, Cylinders=10 (arbitrary large enough value), Boot, List.
The probability that your 400gb lost file was unfragmented is near 0, so PhotoRec will not work.
As yo are using Ubuntu, you can try the scrounge-ntfs utility. You need to have enough free space on another disk to store the recovered files.
I have successfully opened it using TestDisk, Geometry, Cylinders=10 (arbitrary large enough value), Boot, List.
The probability that your 400gb lost file was unfragmented is near 0, so PhotoRec will not work.
As yo are using Ubuntu, you can try the scrounge-ntfs utility. You need to have enough free space on another disk to store the recovered files.
Re: Recovery of Macrium reflect .mrimg
thanks cgrenier,
I put the drive in my Linux machine and have had some success with with scrounge-ntfs. It has found the .mrimg file OK but seems to be stuck only 3.6gb in. (3,624,064,138 bytes) and not changing. Took dog for walk and still the same. This is with the -c option set to the default of 8. I tried with 4 but it gets stuck a few kb in. (681,984 bytes)
I am recovering it to an external usb HD.
To be more precise it wasn't a reformatted partition. I deleted it by accident when reinstalling Windows 10 so it's a blank space that I am working from.
I put the drive in my Linux machine and have had some success with with scrounge-ntfs. It has found the .mrimg file OK but seems to be stuck only 3.6gb in. (3,624,064,138 bytes) and not changing. Took dog for walk and still the same. This is with the -c option set to the default of 8. I tried with 4 but it gets stuck a few kb in. (681,984 bytes)
I am recovering it to an external usb HD.
To be more precise it wasn't a reformatted partition. I deleted it by accident when reinstalling Windows 10 so it's a blank space that I am working from.