cgsecurity.org

After running "Repair MFT" in TestDisk I received this message:

If you have cloned your disk using ddrescue as described in the manual, you can try out chkdsk.

I'm on linux so that would be have to fsck, right?

I would use Windows PE running on a pen drive. That brings in chkdsk.

As the disk is using NTFS, can you try on a windows in cmd (Right-click run as administrator) a "chkdsk /f d:' (replace d: by the correct drive letter).
What is the result ?

Sorry I didn't see your reply, yes I will give it a try.


Here is an update, everything in this post was performed on the ddrescue image clone of the hard disk.


I tried fsck: Tried to mount:
dmesg: Attempting ntfsfix: Also tried analyzing with TestDisk:

Next I will try to make a WinPE drive so try using chkdsk.

I'm don't know if it would be worth deleting the current disk image which is of the whole disk and making another to work on that is just a clone of the partition. Maybe it would be easier to mount and work on.

crashtech wrote: 26 Apr 2026, 02:43 Sorry I didn't see your reply, yes I will give it a try.


Here is an update, everything in this post was performed on the ddrescue image clone of the hard disk.


I tried fsck:

Code: Select all

$ sudo fsck.vfat -n -f mybook.img
fsck.fat 4.2 (2021-01-31)
Logical sector size (64543 bytes) is not a multiple of the physical sector size.

That fsck.vfat command has to be applied to a partition/volume although the manual generalizes the argument of the command as "device". mbook.img is a file containing a clone of your disk. You should mount that file as a disk using losetup for instance.

Tried to mount:

Code: Select all

#getting offset:
mybook.img
Welcome to GNU Parted! Type 'help' to view a list of commands.
(parted) unit                                                             
Unit?  [compact]? B                                                       
(parted) print                                                            
Model:  (file)
Disk /media/mybook.img: 4000752599040B
Sector size (logical/physical): 512B/512B
Partition Table: msdos
Disk Flags: 

Number  Start    End            Size           Type     File system  Flags
 1      131072B  500094074879B  500093943808B  primary

(parted)



$ sudo fdisk -lu mybook.img
[sudo] password for : 
Disk mybook.img: 3.64 TiB, 4000752599040 bytes, 7813969920 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0xdb4bf07b

Device      Boot Start       End   Sectors   Size Id Type
mybook.img1        256 976746239 976745984 465.7G  7 HPFS/NTFS/exFAT



Block Size = 512
Start = 256
512 x 256
Offset = 131072




#Attempting to mount:
$ sudo mount -o loop,ro,offset=131072 mybook.img mountpoint
mount: mountpoint: wrong fs type, bad option, bad superblock on /dev/loop0, missing codepage or helper program, or other error.
       dmesg(1) may have more information after failed mount system call.
       
       
       
       
       
$ sudo mount -t auto -o loop,offset=131072  mybook.img mountpoint
mount: mountpoint: wrong fs type, bad option, bad superblock on /dev/loop1, missing codepage or helper program, or other error.
       dmesg(1) may have more information after failed mount system call.       
       

dmesg:

Code: Select all

[46082.587626] loop0: detected capacity change from 0 to 7813969664
[46082.702816] EXT4-fs (loop0): VFS: Can't find ext4 filesystem
[46082.703137] EXT4-fs (loop0): VFS: Can't find ext4 filesystem
[46082.703353] EXT4-fs (loop0): VFS: Can't find ext4 filesystem
[46082.703536] FAT-fs (loop0): invalid media value (0xe5)
[46082.703542] FAT-fs (loop0): Can't find a valid FAT filesystem
[46394.133612] loop0: detected capacity change from 0 to 7813969664
[46394.136419] EXT4-fs (loop0): VFS: Can't find ext4 filesystem
[46394.138073] EXT4-fs (loop0): VFS: Can't find ext4 filesystem
[46394.138195] EXT4-fs (loop0): VFS: Can't find ext4 filesystem
[46394.138308] FAT-fs (loop0): invalid media value (0xe5)
[46394.138313] FAT-fs (loop0): Can't find a valid FAT filesystem
[47196.031456] loop0: detected capacity change from 0 to 7813969894
[47196.074123] EXT4-fs (loop0): VFS: Can't find ext4 filesystem
[47196.074968] EXT4-fs (loop0): VFS: Can't find ext4 filesystem
[47196.075232] EXT4-fs (loop0): VFS: Can't find ext4 filesystem
[47196.075314] FAT-fs (loop0): invalid media value (0xe5)
[47196.075318] FAT-fs (loop0): Can't find a valid FAT filesystem
[48140.290086] loop0: detected capacity change from 0 to 7813969664
[48140.292591] EXT4-fs (loop0): VFS: Can't find ext4 filesystem
[48140.292770] EXT4-fs (loop0): VFS: Can't find ext4 filesystem
[48140.292833] EXT4-fs (loop0): VFS: Can't find ext4 filesystem
[48140.292890] FAT-fs (loop0): invalid media value (0xe5)
[48140.292893] FAT-fs (loop0): Can't find a valid FAT filesystem


[100880.676640] loop0: detected capacity change from 0 to 9199748800
[100881.889521] EXT4-fs (dm-3): warning: mounting fs with errors, running e2fsck is recommended
[100881.926904] EXT4-fs (dm-3): mounted filesystem e6b719a6-6358-4075-b888-594a0028cb14 r/w with ordered data mode. Quota mode: none.
[101194.115952] EXT4-fs (dm-3): error count since last fsck: 1595
[101194.115968] EXT4-fs (dm-3): initial error at time 1760224357: ext4_lookup:1860: inode 37904390
[101194.115979] EXT4-fs (dm-3): last error at time 1777045993: ext4_validate_block_bitmap:423
[101201.580553] EXT4-fs error (device dm-3): ext4_validate_block_bitmap:423: comm ext4lazyinit: bg 31570: bad block bitmap checksum
[102332.964913] loop1: detected capacity change from 0 to 7813969664
[102333.038457] EXT4-fs (loop1): VFS: Can't find ext4 filesystem
[102333.038727] EXT4-fs (loop1): VFS: Can't find ext4 filesystem
[102333.038862] EXT4-fs (loop1): VFS: Can't find ext4 filesystem
[102333.038985] FAT-fs (loop1): invalid media value (0xe5)
[102333.038992] FAT-fs (loop1): Can't find a valid FAT filesystem

Attempting ntfsfix:

Code: Select all

$ sudo ntfsfix mybook.img
Mounting volume... NTFS signature is missing.
FAILED
Attempting to correct errors... NTFS signature is missing.
FAILED
Failed to startup volume: Invalid argument
NTFS signature is missing.
Trying the alternate boot sector
Unrecoverable error
Volume is corrupt. You should run chkdsk.

Same mistake as above: You are trying to operate ntfsfix on a disk instead of a partition/volume.

Also tried analyzing with TestDisk:

Next I will try to make a WinPE drive so try using chkdsk.

I'm don't know if it would be worth deleting the current disk image which is of the whole disk and making another to work on that is just a clone of the partition. Maybe it would be easier to mount and work on.

You can keep the disk image by creating a virtual device pointing to the image.

Keep in mind that your "Mybook" has a sector size of 4096 if you keep it in hits enclosure. This is additional information regarding your clone file.