3

I have a problem with mounting the cloned partition. To clone it, I used as root: ddrescue -f -n /dev/sda3 ./sda3_rescue.img ./rescue.log

The partition which I cloned, was a broken NTFS partition. Broken, because during the resizing of this NTFS partition I had BoD (flash) and after that this partition was marked as a RAW (previously it was NTFS). Because I needed some windows tool, I copied this partition and reinstalled windows (but before I tried to use windows tools to repair this partition - of course without positive results). Now I need to get into this image and restore some important files. I tried to mount this image but mount cannot recognize this image as NTFS file system. Does anyone know how to get files from this kind of image?

wazoox
  • 7,156
dave
  • 303

2 Answers2

1

Linux tools are probably not the best way to fix this. Use something like VBoxManage from VirtualBox to convert that fie you have (which is of type RAW) to a VHD or VHDX, then mount it on a Windows machine and run CHKDSK on it.

longneck
  • 23,272
1

Did you resize the partition in a way that caused the start of it to move? Depending on the exact tool used for resizing and what stage the resizing broke, that could explain why file is unable to detect it.

I would start by trying boot sector recovery from testdisk (Advanced -> Boot -> Rebuild BS). If that doesn't work, try running a partition scan from testdisk to hopefully find whatever is left from the original partition. Make sure you made another backup of the image file before touching any option that could modify your image.

You can also try DMDE - it lets you check if files are recoverable for free but the recovery has some limits until you pay - it managed to help me in a similar situation once (ntfsresize broke my partition because I tried to shrink it too much). There are probably other similar tools as well.

If that doesn't work either, then it's probably impossible to recover the filesystem without some really detailed knowledge about NTFS internals and fixing data strucures by hand.

In the worst case, you can try tools like photorec to try to recover data without looking at the NTFS filesystem at all, but that means all directory structure and heavily fragmented files on the hard disk would be lost.

krzys_h
  • 76
  • 1