2

It was time, after 5 years my 1tb external drive with all of my family photos and all my music crashed. Stupidly enough, i did not have two drives in raid, which i will do in the future.

I successfully rescued the files with dd_rescue to my other 2tb movie drive on my server, however i cannot seem to understand how to mount this .img file.

I am using GNU ddrescue

I really need to get this fixed, otherwise i'm screwed

Here's how i have executed my ddrescue command

sudo ddrescue /dev/sdh1 /media/external/rescue/rescue.img /media/external/rescue/rescuelog

Initial status (read from logfile)
rescued:        1 TB,  errsize:  30944 kB,  errors:     345
Finished

Here are my test commands

file image.img

image.img: x86 boot sector, code offset 0x52, OEM-ID "NTFS    ", sectors/cluster 8, reserved sectors 0, Media descriptor 0xf8, heads 255, hidden sectors 2048, dos < 4.0 BootSector (0x80)

fdisk -l image.img

Disk image.img: 1000.2 GB, 1000203091968 bytes
255 heads, 63 sectors/track, 121601 cylinders, total 1953521664 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x2052474d

This doesn't look like a partition table
Probably you selected the wrong device.

    Device Boot      Start         End      Blocks   Id  System
image.img1   ?     6579571  1924427647   958924038+  70  DiskSecure Multi-Boot
image.img2   ?  1953251627  3771827541   909287957+  43  Unknown
image.img3   ?   225735265   225735274           5   72  Unknown
image.img4      2642411520  2642463409       25945    0  Empty

Partition table entries are not in disk order

I have absolutely no idea why fdisk shows all these wierd partitions such as 'DiskSecure Multi-Boot' and two 'Unknown' partitions, the parted command gave me information that seemed correct though

parted image.img print

WARNING: You are not superuser.  Watch out for permissions.
Model:  (file)
Disk /media/external/Rescue/image.img: 1000GB
Sector size (logical/physical): 512B/512B
Partition Table: loop

Number  Start  End     Size    File system  Flags
 1      0.00B  1000GB  1000GB  ntfs

I am not sure if i have the correct flags and such, but here i'm trying to mount the drive

sudo mount -r -o loop image.img /mnt

ntfs_mst_post_read_fixup_warn: magic: 0x00000000  size: 4096   usa_ofs: 0  usa_count: 65535: Invalid argument
Index buffer (VCN 0x0) of directory inode 0x5 has a size (24) differing from the directory specified size (4096).
ntfs_mst_post_read_fixup_warn: magic: 0x00000000  size: 4096   usa_ofs: 0  usa_count: 65535: Invalid argument
Index buffer (VCN 0x0) of directory inode 0x5 has a size (24) differing from the directory specified size (4096).
ntfs_mst_post_read_fixup_warn: magic: 0x00000000  size: 4096   usa_ofs: 0  usa_count: 65535: Invalid argument
Index buffer (VCN 0x0) of directory inode 0x5 has a size (24) differing from the directory specified size (4096).

Thanks in advance guys!

4
  • 1
    I can only see warnings. You don't seem to get any errors while mounting. Maybe it mounted just fine? Do you see anything if you do a ls /mnt ?
    – MadMike
    Dec 19, 2013 at 14:38
  • ls gives me ls: reading directory /mnt: Input/output error Dec 19, 2013 at 14:39
  • 1
    Ah, right. You've rescued the whole drive and now the image contains multiple partitions. You will only want to mount one partition at the time. Never did this myself, but try this from this article: mount -t ntfs -o loop,offset=1953251627 image.img /mnt if that doesn't work you will need to cut out the partition following this article.
    – MadMike
    Dec 19, 2013 at 14:46
  • It was a single NTFS partition before, are you saying that ddrescue splitted it up? And is it multiple partitions or not? Since fdisk tells me there are 4 partitions while parted info tells me that it is just a single partition, and in that article you linked they use parted info. Your command gives me NTFS signature is missing., and since parted told me that it started at the 0 byte, i also tried offset 0 but it gave me same error as the sudo mount -r -o loop image.img /mnt in the OP but only once instead of for times Dec 19, 2013 at 15:03

1 Answer 1

2

Your partition table is corrupted, you have to use windows and run chkdsk /f on that corrupted image file. Check this Q&A for some instructions.

3
  • I'll install windows 7 on my machine and try to do that. Thanks Dec 19, 2013 at 15:06
  • Sadly, this was not possible. When running chkdsk it gave me the error "Insufficient disk space to fix volume bitmap. CHKDSK aborted.", and according to microsofts website about this error message: "Delete some unneeded files from the NTFS volume, if you can, and then retry the Chkdsk command. If you cannot delete any files, you will have to reformat the NTFS volume and restore data from backup.". Since i'm not able to free space from the image i have no idea what to do. And only 400gb of the 1tb was used anyway, so the error message doesn't make any sense really. Feb 7, 2014 at 17:38
  • @JohanBjäreholt I don't use Windows, and this is a windows problem, you will likely have better answers on superuser.com . But a little googling for that error suggests that chkdsk reports that problem also when there is enough free space, it is basically a sign of a very big, unrecoverable corruption. But as I said, I don't use/know windows, so I can't really help you with that problem.
    – falconer
    Feb 7, 2014 at 17:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .