Re: [Bug-ddrescue] Help rescuing my 500GB disk

[Andrej Trobentar]

On 11/12/2013 12:12 AM, Scott Dwyer wrote:

I would like to point something out that relates to both an "unfinished" image, and using ddru_ntfsbitmap (something I need to add to the documentation). In any event, anything less than a 100% recovery will leave portions on the target image/drive that have not been written to by ddrescue. If copying to a brand new hard drive, those areas are (hopefully) likely to be zeros. But in any other case, those areas will contain whatever data was there previously. For someone that uses their system for data recovery on a regular basis, and is using image files or reusing hard drives, those areas could contain data from a previous recovery! This could be a privacy issue in some cases, but also could cause an issue with running any other sort of repair/file recovery tools on the recovered image/drive. The unrecovered parts could contain "garbage" data that could affect accurate recovery. In these cases I would recommend using the fill mode of ddrescue to fill any unfinished/untried areas with zeros.  Example command:

ddrescue --fill-mode=?/*- /dev/zero recovered_image logfile

This would write zeros to any portion of the recovery that was not successfully read from the source.

I guess I'll have to do this at the end :)

So now to answer your question about an "unfinished" recovery. That depends on how much and what areas were recovered. You can obviously only recover what was successfully read. In the case of NTFS, if the MFT (master file table) is not recovered in full or is damaged, it makes recovery much more difficult. Which gives me the idea of adding an option in ddru_ntfsbitmap to create a secondary domain file for just recovering the MFT first :)

Scott

Would be a good idea :) Any way I can check if the MFT was recovered successfully now?
 

Well my drive has now come to approx. 40GB and now refuses to continue even if I power cycle it. Is it right to use this line here (reverse copying) :

"ddrescue -R -A -m /tmp/domain_logfile -v /dev/sdb1 /tmp/Image.img /tmp/Image.log"

I assume this will start to copy data from the end of only the USED part of the partition right?


Greetings,

        Andrej.