Best way to approach recovery of ddrescue image?

Using PhotoRec to recover lost data
Post Reply
Message
Author
User avatar
whoabuddy
Posts: 1
Joined: 11 Oct 2013, 17:17
Location: Las Vegas, NV
Contact:

Best way to approach recovery of ddrescue image?

#1 Post by whoabuddy » 11 Oct 2013, 18:39

Hello All,

I am posting here in relation to a user that I am assisting over at BleepingComputer, and after using ddrescue to create an image file from the failing hard drive, we are now unable to mount it and access the files. Originally the plan was to clone the hard drive to a new one, but the user received a new laptop and now we just want to try and extract his files from the image itself. But there's a twist! Here is a small transcription of what's conspired so far:
  • User suspected a virus due to PC locking up, eventually PC was not booting correctly
  • User ran Boot Repair from Ubuntu Rescue CD, wrong MBR written to disk
    => Syslinux MBR (4.04 and higher) is installed in the MBR of /dev/sdb.
    ...(truncated)...
    sdb1:
    File system: ntfs
    Boot sector type: Windows 7/2008: NTFS
    Boot sector info: The info in the boot sector on the starting sector of the MFT Mirror is wrong.
    Mounting failed: ntfs_attr_pread_i: ntfs_pread failed: Input/output error
    Failed to read $MFTMirr: Input/output error
    Failed to mount '/dev/sdb1': Input/output error
    http://www.bleepingcomputer.com/forums/ ... try3119445
  • We checked drive health in Parted Magic, read errors detected during DST
    http://www.bleepingcomputer.com/forums/ ... try3120175
  • We started recovery with ddrescue to create image file
    http://www.bleepingcomputer.com/forums/ ... try3123369
  • Significant portion of drive recovered according to ddrescue log
    08/06/13 6:03pm, 6gb recovered, 69mb errsize
    08/07/13 7:57pm, 43gb recovered, 72mb errsize
    08/09/13 8:04pm, 88gb recovered, 180mb errsize
    08/10/13 9:01pm, 100gb recovered, 269mb errsize
    08/15/13 6:49am, 225gb recovered, 357mb errsize
    08/15/13 5:47pm, 250gb recovered, 350mb errsize
    08/19/13 9:03am, 250gb recovered, 143mb errsize
    08/23/13 9:02am, 250gb recovered, 137mb errsize
    http://www.bleepingcomputer.com/forums/ ... try3135799
  • We tried to mount the drive several different ways and gather as much info as possible, but no luck
    http://www.bleepingcomputer.com/forums/ ... try3140973
So at this point I was thinking TestDisk or PhotoRec would be a great option for the user, but I am not very familiar with these tools and exactly how they work, especially given the circumstances of this particular recovery. Any advice would be appreciated!

Best Regards,
whoabuddy
Meditate. Elevate. Appreciate. | "Life is a journey, love is the destination, happiness is the path!" | If I am helping you and have not responded within 48 hours, please send me a PM. | Vi Veri Veniversum Vivus Vici

Sponsored links

bartleby
Posts: 10
Joined: 26 Sep 2013, 01:49

Re: Best way to approach recovery of ddrescue image?

#2 Post by bartleby » 14 Oct 2013, 23:55

There are lots of tutorials/how-tos on the web for using the tools including this site. I think you would mount the image as a loopback device in order to extract the data or perhaps rebuild partition tables etc. I found this info helpful (might want to read the comments too): http://www.andremiller.net/content/moun ... sing-linux

Post Reply

Who is online

Users browsing this forum: No registered users and 1 guest