Re: [Bug-ddrescue] Recover a single NTFS partition off a damaged disk

[David Burton]

Sanjay,

It sounds like you've already started recovering the drive,
but it is taking too long.  So my guess is that you've already
recovered the primary partiton table (in the MBR).  If so, I
recommend that you stop the recovery, and "split" the ddrescue
logfile into 3 parts using ddrsplit.pl.  Choose split points
such that the first part represents the part of the disk drive
before the desired partition, the second part represents the
portion of of the disk drive containing the desired partition,
and the last part represents the portion of the disk drive
after the desired partition.

Then restart ddrescue using only the "part 2" logfile
(but contining to use the same target image file or the same
new drive that you have been using).  That will cause ddrescue
to concentrate all its attention on the desired partition.

When it is done, you can use ddrcombine.pl to recombine the
3 partial logfiles (the 2nd of which has been updated by
ddrescue) into a single ddrescue logfile which correctly
represents the recovery status of the entire drive.

In the target image file, the unrecovered sectors will be
zero-filled. (If you are recovering to a new disk drive the
unrecovered sectors will be whatever was already there.)

You should be able to just copy the entire image file to
your new drive, and use it, as is, without ever recovering
the contents of the unneeded partitions.

I prefer to use an image file, if I have the disk space for
it, rather than recovering directly to a new drive.  You can
mount the partitions in it by using a loop device, and then
access it just like a regular disk drive under Linux.  But
the important advantage of an image file is that it gives you
freedom to "experiment" with an incompletely recovered drive,
without risk.

For example, you can copy the image file to a new drive,
then attach the drive to a Windows box, to try recovering
data and analyzing it with NFI.  Windows will change
things on the drive, but you won't care!  As you are playing
with the new drive, your Linux box can continue to plug away
trying to recover more data into the image file.  If it
turns out that you can't recover what you need under Windows,
you've not lost anything by trying, because you can always
recover some more date with ddrescue and then re-copy the
image file onto the new drive again and start afresh.

Note #1: I don't know anything about testdisk, but these
days cylinder/sector/head is fiction, and nearly useless.
You need LBA sector numbers.  Display them with the command
"fdisk -lu /dev/hdd" or similar under Linux.

Note #2: because logical partitions are "chained," if the
partition you want is the 2nd (or higher) logical partition,
you'll need to recover the partition table records from the
preceeding logical partitions, too.  That might entail using
5 or 7 spilt points, and runnning ddrescue on all the even-
numbered logfile parts, just to recover the partition table
itself.  (Feel free to write a tool to help, and if you
do then please send it to me!)

Note #3: You can get ddrsplit.pl and ddrcombine.pl from my
web site.  Go to  http://www.burtonsys.com/downloads.html
and download ddr2sr.zip

Note #4: You can use the ddr2nfi.pl and nficruncher.pl
scripts (also from ddr2sr.zip) to assist you in using
Microsoft's NFI utility to identify the damaged files on
a partially-recovered NTFS partition.

I hope this helps.

Regards,
-Dave



address@hidden (Sanjay Rana) wrote:

> Hello,
>
> Is it possible to recover a single NTFS partition as a disk image
> onto a different hard disk using ddrescue?
> If so then what arguments will have to be used to do that and will it
> be possible to retrieve the data from the disk image?
>
> My hard disk has lots of bad sectors in other partitions and I am
> unable to overwrite the partition table. Mirroring the entire disk is
> also taking a lot longer as well.
>
> I know the start and end of the partition in terms of the
> cylinders,head,sector as reported by testdisk. Can this information be useful?
>
> Thanks a lot in advance,
> Sanjay.
>
>    Sanjay Rana | UCL
>    www.ucl.ac.uk/~ucessan/
>
>
>
> _______________________________________________
> Bug-ddrescue mailing list
> address@hidden
> http://lists.gnu.org/mailman/listinfo/bug-ddrescue