Using Testdisk on a ddrescue'd drive that has been inserted in Windows

[Uldy1]

Good day or night, depending on your time zone, also I'm sorry if I made a mistake and posted this in the wrong board,

I've been having a lot of trouble figuring out how to rescue an old Hard Disk that took a bit of a fall a few years back. My question is in the title of the post, but to summarize the events that transpired (link to the original discussion in https://stackoverflow.com/questions/758 ... -raw-data/) :
I've used gddrescue to save data from a defective hard drive onto a newer one of the same size (both are 2TBs Toshiba hard disks). More specifically, I used the command

Code: Select all

sudo ddrescue -f BADDISK GOODDISK logfile.log

to copy the entire thing. It took 5 days due to the only laptop I'm currently able to use being really outdated, with fans keeping both disks and laptop cool. As it was approaching its completion, the BADDISK started emitting uncomfortably loud clicking noise during the parsing for bad sectors phase, which prompted me to stop. As I didn't quite understand the state it would be in once it was done copying stuff, I inserted GOODDISK (pardon the use of these words, but I wasn't able to communicate it properly last time) on a Windows 7 partition to check if it worked right and after noticing that files were still missing I securely unplugged.
At this point I tried using Testdisk on GOODDISK to see if I could recover anything from it, the only information shown though were the same kind of files that I could see on the fileview on both Windows and Linux Mint. As I notified a kind soul that was helping me, I was told that I committed a mistake and should have completed the rescue operation. I tried running it again, this time as

Code: Select all

sudo ddrescue -f -C BADDISK GOODDISK logfile.log

and it completed, though Testdisk still only sees a few files and not the complete thiing (the relevant information should be around 500GBs/2TBs, but I can only access about 25GBs).

Now, what I'd like to know is:
1) How much did I screw up?
2) Testdisk also lets me perform a deeper search, but it also takes quite some time (again, kind of forced due to low resources). Should I bother attempting it on GOODDISK before doing anything else? Will it return a list of candidates of possible files to be saved onto yet another drive?
3) If not, then are there any other steps that I should take on GOODDISK to at least attempt a recovery on the files?

Infinite thanks for your patience and for making tools such as these. Again, sorry if I didn't use proper etiquette.

[Uldy1]

Additionally, the logfile is quite bloated since I tried a few things, but this is the latest part:

Code: Select all

Mon Apr  3 22:54:40 2023
Command line: TestDisk /log /debug

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 4.15.0-142-generic (#146~16.04.1-Ubuntu SMP Tue Apr 13 09:27:15 UTC 2021) x86_64
Compiler: GCC 5.3
ext2fs lib: 1.42.13, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none, curses lib: ncurses 6.0
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size       625142448 sectors
/dev/sda: user_max   625142448 sectors
/dev/sda: native_max 625142448 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 0 sectors, sector size=512
Hard disk list
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512 - WDC WD3200BPVT-80JJ5T0, S/N:WD-WXU1EA1LJZPV, FW:01.01A01
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - TOSHIBA EXTERNAL_USB

Partition table type (auto): Intel
Disk /dev/sdb - 2000 GB / 1863 GiB - TOSHIBA EXTERNAL_USB
Partition table type: Intel

Analyse Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63
Geometry from i386 MBR: head=255 sector=63
BAD_RS LBA=2048 63
NTFS at 0/32/33
Current partition structure:
 1 * HPFS - NTFS              0  32 33 243201  48 31 3907025072

Bad relative sector.
Record 5617 has wrong SeqNo (1 <> 2)

search_part()
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63
NTFS at 0/32/33
filesystem size           3907025072
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 33 243201  48 31 3907025072
     NTFS, blocksize=4096, 2000 GB / 1863 GiB

Results
   * HPFS - NTFS              0  32 33 243201  78 13 3907026944
     NTFS, blocksize=4096, 2000 GB / 1863 GiB

Hint for advanced users. dmsetup may be used if you prefer to avoid to rewrite the partition table for the moment:
echo "0 3907026944 linear /dev/sdb 2048" | dmsetup create test0
ntfs_device_testdisk_io_ioctl() unimplemented
NTFS Volume is dirty.


dir_partition inode=5
   * HPFS - NTFS              0  32 33 243201  78 13 3907026944
     NTFS, blocksize=4096, 2000 GB / 1863 GiB
ntfs_readdir failed for cluster 5: Input/output error
Directory /
       5 dr-xr-xr-x     0      0         0  3-Apr-2023 17:45 .
       5 dr-xr-xr-x     0      0         0  3-Apr-2023 17:45 ..
    4335 dr-xr-xr-x     0      0         0  7-Mar-2016 07:57 $RECYCLE.BIN
  530569 dr-xr-xr-x     0      0         0 29-Mar-2016 16:25 Folder1
  531255 dr-xr-xr-x     0      0         0 26-Feb-2016 16:00 Folder2
  524569 dr-xr-xr-x     0      0         0 26-Feb-2016 15:54 Folder3
 1064063 -r--r--r--     0      0      3538  4-Mar-2016 23:54 list.txt

interface_write()
 1 * HPFS - NTFS              0  32 33 243201  78 13 3907026944
ntfs_mst_post_read_fixup_warn: magic: 0x00000000  size: 1024   usa_ofs: 0  usa_count: 65535: Invalid argument
ntfs_attr_find: Corrupt inode (-1): Input/output error
ntfs_attr_find: Corrupt inode (-1): Input/output error
ntfs_attr_find: Corrupt inode (-1): Input/output error
ntfs_attr_find: Corrupt inode (-1): Input/output error
ntfs_attr_find: Corrupt inode (-1): Input/output error
ntfs_mst_post_read_fixup_warn: magic: 0x00000000  size: 1024   usa_ofs: 0  usa_count: 65535: Invalid argument
ntfs_attr_find: Corrupt inode (-1): Input/output error
ntfs_attr_find: Corrupt inode (-1): Input/output error
ntfs_attr_find: Corrupt inode (-1): Input/output error
ntfs_attr_find: Corrupt inode (-1): Input/output error
ntfs_attr_find: Corrupt inode (-1): Input/output error
ntfs_mst_post_read_fixup_warn: magic: 0x00000000  size: 1024   usa_ofs: 0  usa_count: 65535: Invalid argument
ntfs_attr_find: Corrupt inode (-1): Input/output error
ntfs_attr_find: Corrupt inode (-1): Input/output error
ntfs_attr_find: Corrupt inode (-1): Input/output error
ntfs_attr_find: Corrupt inode (-1): Input/output error
ntfs_attr_find: Corrupt inode (-1): Input/output error
ntfs_mst_post_read_fixup_warn: magic: 0x00000000  size: 1024   usa_ofs: 0  usa_count: 65535: Invalid argument
ntfs_attr_find: Corrupt inode (-1): Input/output error
ntfs_attr_find: Corrupt inode (-1): Input/output error
ntfs_attr_find: Corrupt inode (-1): Input/output error
ntfs_attr_find: Corrupt inode (-1): Input/output error
ntfs_attr_find: Corrupt inode (-1): Input/output error
ntfs_mst_post_read_fixup_warn: magic: 0x00000000  size: 1024   usa_ofs: 0  usa_count: 65535: Invalid argument
ntfs_attr_find: Corrupt inode (-1): Input/output error
ntfs_attr_find: Corrupt inode (-1): Input/output error
ntfs_attr_find: Corrupt inode (-1): Input/output error
ntfs_attr_find: Corrupt inode (-1): Input/output error
ntfs_attr_find: Corrupt inode (-1): Input/output error
ntfs_mst_post_read_fixup_warn: magic: 0x00000000  size: 1024   usa_ofs: 0  usa_count: 65535: Invalid argument
::: several similar lines :::
ntfs_mst_post_read_fixup_warn: magic: 0x00000000  size: 1024   usa_ofs: 0  usa_count: 65535: Invalid argument
ntfs_attr_find: Corrupt inode (-1): Input/output error
ntfs_attr_find: Corrupt inode (-1): Input/output error
ntfs_attr_find: Corrupt inode (-1): Input/output error
ntfs_attr_find: Corrupt inode (-1): Input/output error
ntfs_attr_find: Corrupt inode (-1): Input/output error
ntfs_mst_post_read_fixup_warn: magic: 0x93d9b08c  size: 1024   usa_ofs: 59825  usa_count: 16722: Invalid argument
Using locale 'LC_CTYPE=en_US.UTF-8;LC_NUMERIC=it_IT.UTF-8;LC_TIME=en_US.UTF-8;LC_COLLATE=en_US.UTF-8;LC_MONETARY=it_IT.UTF-8;LC_MESSAGES=en_US.UTF-8;LC_PAPER=it_IT.UTF-8;LC_NAME=it_IT.UTF-8;LC_ADDRESS=it_IT.UTF-8;LC_TELEPHONE=it_IT.UTF-8;LC_MEASUREMENT=it_IT.UTF-8;LC_IDENTIFICATION=it_IT.UTF-8'.

4) Should I attempt another ddrescue operation before trying anything else?
5) I've been told that a sign for a foul'd up hard disk once it has been inserted in Windows (when I shouldn't have) is the existence of a

Code: Select all

found000

folder or any such similar files, but I haven't seen any. Should I consider myself lucky?

[recuperation]

Your posting has been flagged on Stackexchange because your file hoster is spreading executable files instead of clean log files.
I discovered this because I tried to look at your log file that you had not posted yet.

[Uldy1]

I am mortified about this, it never caused me that problem but I'll make sure to avoid that service from now on.

Here are the equivalent files
a.log (log of my previous attempt at creating a partial iso with ddrescue) https://pastebin.com/HaPw7kNR
log1.log (log of the last attempt which rescued the entire disk) https://pastebin.com/mCi0DgEi

[recuperation]

Please upload your log files to this site.

[Uldy1]

Here it is. I named them something more appropriate. Again, sorry for the hiccup.

[Uldy1]

The original question on Stackoverflow appears to have been removed, but I saved an archive of the relevant information over at https://archive.is/j66F9
Additionally, I remade the question on Stackexchange with only the most relevant information https://unix.stackexchange.com/question ... d-testdisk

[recuperation]

There are couple of issues it could comment on, but now I will be waiting what your posting at stackexchange gives.

First you are using a malicious hoster.
Now you are posting your issue simultaneously on at least two locations on the internet:

https://unix.stackexchange.com/question ... d-testdisk

When writing this posting you did not inform the people at unix.stackexchange.com that you already posted your question here. Why not?!
After posting on one subsite of the stackexchange family where your were told to go the specialist (forum at cgsecurity.org), you nevertheless reposted your issue somewhere else.

I think one does not need to read about netiquette and one only requires common sense to understand that such behaviour is questionable.
Will that simultaneous forum carving give a better outcome?
Therefore I postpone my answer for some time because I don't want to reward such sad behaviour.

[Uldy1]

First you are using a malicious hoster.

I mentioned it already, the hoster never gave me any troubles at all when downloading or uploading in the past. However, just to be safer, I omitted all mentions of it on my posts, to ensure it won't happen to someone else again.

When writing this posting you did not inform the people at unix.stackexchange.com that you already posted your question here. Why not?!

I beg you pardon for that, I simply forgot to. I'll update the post on the unix exchange to specify that I've seeked professional help here as well.

Will that simultaneous forum carving give a better outcome?

I don't want to sound like a bad person for saying this, but usually the communities I've browsed to search for information or solutions in the past tend to not overlap at all. I didn't expect this forum to have cross posters with Stackexchange, given that from what I've read in the other threads the tasks and problems are much more specific than the more varied questions on that other site.

Therefore I postpone my answer for some time because I don't want to reward such sad behaviour.

Again, sorry if my posts offended you in any way. As I mentioned on the original question, I'm quite stumped by the problem and it may have made me a bit too hasty when it comes to what to do or write about it.
I hope I'll be able to change your mind somehow. Thanks for your patience this far though.

I've rectified the question on StackExchange to include a link to this thread/forum. Sorry for the delay, had to leave for work.

[Uldy1]

I've completed the second pass for missing bad sectors with ddrescue. Sadly it didn't result in much of anything, the log is pretty much the same as the one previously posting. Testdisk still doesn't show me the original folders and files present on the disk. Should I just bite the bullet and use Photorec?