cgsecurity.org

I am trying to create an image of a 1TB Samsung M3 HD on a 4TB TOSHIBA HD, so to try to understand if I can repair the disk, which has a Boot sector OK, MFT Ok but cannot be opened under Windows and is seen as empty under Ubuntu,

When choosing Image creation in the Advanced section, the program produce an image remarkably smaller than 2TB giving the following message

Image created successfully but read error have occured.

The size of the image is not always the same (from 0 to 285GB, up to now: mostly the process stops when reaching 20-25% of the task) , so I think this could be due to failures in the connection of one of the two HD with the computer on which testdisk is running (but this is just an hypothesis).

My question is therefore: is there any way to let testdisk produce a resumable file, in such way to obtain the final image of the HD by "resuming" the creation of the image from partial image files?

If not, is there any possibility to produce an image of the disk with other programs, may be more stable under perturbation of the connection?

I thank you very much in advance for any help you can give me

aleph wrote: 12 Mar 2024, 04:03 I am trying to create an image of a 1TB Samsung M3 HD on a 4TB TOSHIBA HD, so to try to understand if I can repair the disk, which has a Boot sector OK, MFT Ok but cannot be opened under Windows and is seen as empty under Ubuntu,

When choosing Image creation in the Advanced section, the program produce an image remarkably smaller than 2TB giving the following message

An image or clone of a disk should be exactly as big as its source. Above you describe trying to create an image of a disk with a size of 1 TB, then you complain that the result is "remarkably smaller than 2 TB". Well, honestly, the result should be 1 TB in size. You sound like you expect more. I am afraid, TestDisk will not meet your expectations.

Image created successfully but read error have occured.

The size of the image is not always the same (from 0 to 285GB, up to now: mostly the process stops when reaching 20-25% of the task) , so I think this could be due to failures in the connection of one of the two HD with the computer on which testdisk is running (but this is just an hypothesis).

My question is therefore: is there any way to let testdisk produce a resumable file, in such way to obtain the final image of the HD by "resuming" the creation of the image from partial image files?

You should not use the imaging function of TestDisk for a number of reasons unless you only want to duplicate a partition knowing that the partition has no unreadable sectors.

If not, is there any possibility to produce an image of the disk with other programs, may be more stable under perturbation of the connection?

If you had read the manual or if you had searched this forums for the terms "image" or "duplicate" in this forum you would have found a thousand entries stating that you should use ddrescue as decribed in the manual.

Furthermore, TestDisk will only image a partition and not a complete disk.

The behaviour of your disk that you describe is indicating unreadable sectors. This is exactly what ddrescue was programmed for!

Thank you very much.

An image or clone of a disk should be exactly as big as its source. Above you describe trying to create an image of a disk with a size of 1 TB, then you complain that the result is "remarkably smaller than 2 TB". Well, honestly, the result should be 1 TB in size. You sound like you expect more. I am afraid, TestDisk will not meet your expectations.

Actually, I was not complaining, I was just describing my problem. And of course 2TB is a typo, I apologise

I apologise, I read the manual, but, since I could not find a specific section for Image in the Advanced menu description (there is an entry "copy", p.60 17.1.6), I thought that the manual was not updated and Image was an option equivalent to ddrescue, valid also for HD.
Since, on the ddrescue site, there are a lot of warnings about its use, I was trying to avoid to use it.

(in particular, I was scared by this sentence in the GNU manual of ddrescue :"If you use a device or a partition as destination, any data stored there will be overwritten. " , but I imagine this corresponds to write
ddrescue /dev/sdb /dev/sda sdb.log -i.e. without indication of the name of the image- while ddrescue /dev/sdb /dev/sda/image_sdb.dd sdb.log should be safe).

I am also not so sure if, instead of /dev/sdb and /dev/sda, I can use the denomination /media/User/SAMSUNG and /media/USER/TOSHIBA (that I get using Tab for the locations) as arguments of ddrescue.


A last question I have is the following one: the error type that I get by trying to open the disk on Windows 11 is CRC error.

Is there anything that can be done by using testdisk to correct this kind of error?

The disk has many bad sectors (they can be detected by analysing it with chkdsk, allthough the chkdsk analysis does not reach the end) but it is correctly detected as a SAMSUNG disk, from the computer and from testdisk, and Boot sector so as MFT are ok; moreover, the files are still there, when analysing it with other Windows based softwares (testdisk does not find them, so I did not risk to restore anything up to now).

I wonder if it is not just matter of just "undelete" something.

Thank you again