0

I have a WD Passport 1TB external hard drive that ddrescue managed to save 95% of before the drive stopped reading at all.

ddrescueview

The recovered data is stored as recovery.img.

$ mmls recovery.img 
DOS Partition Table
Offset Sector: 0
Units are in 512-byte sectors

      Slot      Start        End          Length       Description
000:  Meta      0000000000   0000000000   0000000001   Primary Table (#0)
001:  -------   0000000000   0000002047   0000002048   Unallocated
002:  000:000   0000002048   1953458175   1953456128   NTFS / exFAT (0x07)

However I couldn't mount the image as NTFS:

$ sudo mount -t ntfs recovery.img /mnt
NTFS signature is missing.
Failed to mount '/dev/loop11': Invalid argument
The device '/dev/loop11' doesn't seem to have a valid NTFS.
Maybe the wrong device is used? Or the whole disk instead of a
partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?

$ sudo ntfsfix recovery.img
Mounting volume... NTFS signature is missing.
FAILED
Attempting to correct errors... NTFS signature is missing.
FAILED
Failed to startup volume: Invalid argument
NTFS signature is missing.
Trying the alternate boot sector
Unrecoverable error
Volume is corrupt. You should run chkdsk.

chkdsk recovery.img on my Windows machine said the file name is not valid.

I also tried using an offset (2048 * 512) as described in Ubuntu DataRecovery docs:

$ sudo mount -t ntfs -o loop,force,offset=1048576 recovery.img /mnt
Failed to read last sector (1953456126): Invalid argument
HINTS: Either the volume is a RAID/LDM but it wasn't setup yet,
   or it was not setup correctly (e.g. by not using mdadm --build ...),
   or a wrong device is tried to be mounted,
   or the partition table is corrupt (partition is smaller than NTFS),
   or the NTFS boot sector is corrupt (NTFS size is not valid).
Failed to mount '/dev/loop11': Invalid argument
The device '/dev/loop11' doesn't seem to have a valid NTFS.
Maybe the wrong device is used? Or the whole disk instead of a
partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?

testdisk [ List ] files actually works, so I will try to copy from there. But I would like to mount if possible.

Any ideas for what I should try now?

Edit: result of kpartx, using the instructions listed here:

$ sudo kpartx -l recovery.img
loop11p1 : 0 1953456128 /dev/loop11 2048
$ sudo kpartx -a recovery.img
device-mapper: resume ioctl on loop11p1  failed: Invalid argument
create/reload failed on loop11p1
  • For the most guaranteed result I suggest to try R-Studio. It works even on Wine and can open your recovery.img file. If this image represents whole drive, then it should be mounted per-partition. So you need to use kpartx. – N0rbert Aug 13 '18 at 19:52
  • @N0rbert the R environment? what? – qwr Aug 13 '18 at 19:53
  • No, not RStudio, but R-Studio. Results from PhotoRec are not usually perfect. I have not tried RecuperaBit. Before proceeding with recovery tools try to mount your image with sudo kpartx -a -v recovery.img, then see them in losetup and try to mount. – N0rbert Aug 13 '18 at 20:00
  • @N0rbert seems like teskdisk works showing and copying files (I think photorec doesn't preserve file names?) so clearly the img contents are mostly valid still – qwr Aug 13 '18 at 20:01
  • 1
    Considering the damage is almost at the end of the drive, you will probably be fine with Testdisk. If it doesn't work you might also try RecuperaBit (disclaimer: I am the author). – Andrea Lazzarotto Aug 15 '18 at 13:11
1

I ended up using only testdisk to list and copy the entire contents of the disk image. I was fortunate that it seems all of my files were saved (none were in the bad read area).

  • Thanks for the quick tip on how to easily access the NTFS partition of an entire (Windows) hard drive image. Use testdisk. I had to turn on "Expert Mode" in the options to see the "list" option, I believe. – Hypocritus Oct 20 '19 at 2:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.