FAQ Search Today's Posts Mark Forums Read
» Video Reviews

» Linux Archive

Linux-archive is a website aiming to archive linux email lists and to make them easily accessible for linux users/developers.


» Sponsor

» Partners

» Sponsor

Go Back   Linux Archive > Debian > Debian User

 
 
LinkBack Thread Tools
 
Old 01-07-2010, 10:21 PM
John Hasler
 
Default Recovering data from NTFS disk

KS writes:
> I connected it in my machine (internal SATA) and just did a ddrescue
> of the disk to a 1.5TB hard disk using a Sysrescue CD. The process
> tells me that there were 37 errors totalling 151kB.

Ok...

> The ISO image generated is about 466GB.

"ISO"? I thought you made an image of a NTFS drive. Where did the ISO
come from?

> However, when I mount the image using mount -o loop -t iso9660
> /path/to/image.iso /path/to/mntpt

Why is that not "-t ntfs"?
--
John Hasler


--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
 
Old 01-07-2010, 10:54 PM
KS
 
Default Recovering data from NTFS disk

John Hasler wrote:
> KS writes:
>> I connected it in my machine (internal SATA) and just did a ddrescue
>> of the disk to a 1.5TB hard disk using a Sysrescue CD. The process
>> tells me that there were 37 errors totalling 151kB.
>
> Ok...
>
>> The ISO image generated is about 466GB.
>
> "ISO"? I thought you made an image of a NTFS drive. Where did the ISO
> come from?
>
>> However, when I mount the image using mount -o loop -t iso9660
>> /path/to/image.iso /path/to/mntpt
>
> Why is that not "-t ntfs"?

I tried -t ntfs (with and without errors=recover) and I also tried to
mount the bad HDD but the system couldn't find ntfs boot sector on either.

**without errors=recover ***
NTFS-fs error (device loop1): ntfs_fill_super(): Not an NTFS volume.
NTFS-fs warning (device loop1): is_boot_sector_ntfs(): Invalid boot
sector checksum.
NTFS-fs error (device loop1): read_ntfs_boot_sector(): Primary boot
sector is invalid.
NTFS-fs error (device loop1): read_ntfs_boot_sector(): Mount option
errors=recover not used. Aborting without trying to recover.

*** with errors=recover***
NTFS-fs error (device loop1): ntfs_fill_super(): Not an NTFS volume.
NTFS-fs warning (device loop1): is_boot_sector_ntfs(): Invalid boot
sector checksum.
NTFS-fs error (device loop1): read_ntfs_boot_sector(): Primary boot
sector is invalid.
NTFS-fs warning (device loop1): is_boot_sector_ntfs(): Invalid boot
sector checksum.
NTFS-fs error (device loop1): read_ntfs_boot_sector(): Could not find a
valid backup boot sector.
NTFS-fs error (device loop1): ntfs_fill_super(): Not an NTFS volume.

***bad hdd***
NTFS-fs warning (device sdb): is_boot_sector_ntfs(): Invalid boot sector
checksum.
NTFS-fs error (device sdb): read_ntfs_boot_sector(): Primary boot sector
is invalid.
NTFS-fs warning (device sdb): is_boot_sector_ntfs(): Invalid boot sector
checksum.
NTFS-fs error (device sdb): read_ntfs_boot_sector(): Could not find a
valid backup boot sector.
NTFS-fs error (device sdb): ntfs_fill_super(): Not an NTFS volume.

*badd hdd partition 1***
NTFS-fs warning (device sdb1): is_boot_sector_ntfs(): Invalid boot
sector checksum.
NTFS-fs error (device sdb1): read_ntfs_boot_sector(): Primary boot
sector is invalid.
NTFS-fs warning (device sdb1): is_boot_sector_ntfs(): Invalid boot
sector checksum.
NTFS-fs error (device sdb1): read_ntfs_boot_sector(): Could not find a
valid backup boot sector.
NTFS-fs error (device sdb1): ntfs_fill_super(): Not an NTFS volume.

I also tried scrounge-ntfs and it tells that the whole disk is a
partition. I think the disk had at least two partitions.

.KS.


--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
 
Old 01-08-2010, 12:12 AM
KS
 
Default Recovering data from NTFS disk

Jochen Schulz wrote:
> KS:
>> root@sysresccd /root % mount -o loop -t iso9660
>
> Why do you mount the dump file from ddrescue as ISO image? Doesn't the
> subject say it should actually contain an NTFS filesystem? I am
> surprised that this actually works.

I tried with ntfs flag too and it doesn't mount anything. Rather gives
errors. See my other reply in the thread.

>> /mnt/windows/rescueData.iso /mnt/cdrom
>> root@sysresccd /root % ls /mnt/cdrom
>> 〰〹 䝎䑒噌慮?湩㬱
>
> Do you expect this kind of characters or is it just "garbage" (from your
> point if view)?

Yes, it is garbage.

>> Any advice on how to proceed from here? Or can someone suggest a better
>> method?
>
> It depends on what you want to achieve. If all you want is to rescue
> personal documents, images and the like, I suggest you to try photorec
> from the testdisk package. It can recover many files of different types
> from otherwise unusable filesystems.
>
> J.

The person has lots of photos, movies, and software backups on the drive.

/KS


--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
 
Old 01-08-2010, 12:30 AM
John Hasler
 
Default Recovering data from NTFS disk

The filesystem on the disk is clearly toast. Mounting it as the wrong
type won't help. Start looking at forensics packages:

magicrescue - recovers files by looking for magic bytes
myrescue - rescue data from damaged harddisks
scrounge-ntfs - Data recovery program for NTFS filesystems
autopsy - graphical interface to SleuthKit
dcfldd - enhanced version of dd for forensics and security
foremost - Forensics application to recover data
guymager - Forensic imaging tool based on Qt
sleuthkit - collection of tools for forensics analysis on volume and
file system data
tct - collection of forensics related utilities

There are, no doubt, others.
--
John Hasler


--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
 

Thread Tools




All times are GMT. The time now is 07:09 AM.

VBulletin, Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO ©2007, Crawlability, Inc.
Copyright 2007 - 2008, www.linux-archive.org