Arch Linux

armoredkitten

Member

Registered: 2019-10-31

Posts: 15

Retrieving NTFS image from ddrescue

Hi everyone,

I had an external hard drive start giving me I/O errors and then refuse to mount on me, so I used ddrescue to save an image of the whole drive. The drive only has a single partition, but I saved the image of the whole drive instead of just that partition (i.e., /dev/sdd instead of /dev/sdd1). The file system was set up as NTFS.

So here's my issue. I have this image, but I can't seem to actually mount it in order to do anything with it. Mounting it directly produces this:

$ sudo mount -t ntfs -o ro,loop hdimage /mnt
NTFS signature is missing.
Failed to mount '/dev/loop0': Invalid argument
The device '/dev/loop0' doesn't seem to have a valid NTFS.
Maybe the wrong device is used? Or the whole disk instead of a
partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?

After some searching I saw suggestions to set the offset to grab only the partition. So I ran fdisk to grab the details:

$ fdisk -l hdimage
Disk hdimage: 2.75 TiB, 3000592977920 bytes, 5860533160 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x74c15f13

Device     Boot Start       End   Sectors   Size Id Type
hdimage1         2048 732565503 732563456 349.3G  7 HPFS/NTFS/exFAT

From that I calculated the start of the partition at 2048 * 512 = 1048576, then tried mounting with the offset in a couple ways:

$ sudo mount -t ntfs -o ro,loop,offset=1048576 hdimage /mnt

$ sudo losetup -o 1048576 /dev/loop0 hdimage
$ sudo mount -t ntfs /dev/loop0 /mnt

Both of which end up resulting in the same error as above. The losetup seems to work, but I don't seem to be able to do anything with it after that. I did try running ntfsfix as well:

$ sudo ntfsfix /dev/loop0
Mounting volume... NTFS signature is missing.
FAILED
Attempting to correct errors... NTFS signature is missing.
FAILED
Failed to startup volume: Invalid argument
NTFS signature is missing.
Trying the alternate boot sector
Unrecoverable error
Volume is corrupt. You should run chkdsk.

(As a side note, I also tried a whole thing, using losetup to create a loop device on the whole drive, then using kpartx to create a map of all the (one) partitions. But trying to mount /dev/mapper/loop0p1 still results in the same error.)

So at this point, I can't find a way to actually recover the data from this image. But I honestly don't really know what I'm doing, so it's entirely possible that I am missing something very obvious. Any help?

frostschutz

Member

Registered: 2013-11-15

Posts: 1,653

Re: Retrieving NTFS image from ddrescue

losetup has --partscan and then you can use e.g. /dev/loop0p3 (for partition 3)

losetup --find --show --partscan --read-only some-full-disk.img

w/o read only you should be aware that loop devices are writeable and anything you do will damage the image, unless you made another copy of it

if you have no room to create image copies (or doing so takes up too much time) you can use copy on write overlays https://raid.wiki.kernel.org/index.php/ … erlay_file

for fixing ntfs in general, windows has much better tools for it. in linux you can try your luck with a filescraper like photorec

paulkerry

Member

From: Sheffield, UK

Registered: 2014-10-02

Posts: 611

Re: Retrieving NTFS image from ddrescue

Just wondering if ntfs-3g.probe would give you more info?

man ntfs-3g.probe

armoredkitten

Member

Registered: 2019-10-31

Posts: 15

Re: Retrieving NTFS image from ddrescue

Thanks for your suggestions. frostschutz, I tried including --partscan as you suggested, and ended up with the same error as before:

NTFS signature is missing.
Failed to mount '/dev/loop0p1': Invalid argument
The device '/dev/loop0p1' doesn't seem to have a valid NTFS.
Maybe the wrong device is used? Or the whole disk instead of a
partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?

Using ntfs-3g.probe also came back with:

NTFS signature is missing.

I tried ntfs-3g.probe on both the image and the loop device -- same result.

At any rate, I dual boot with Windows, and had already been planning to use chkdsk on the actual disk itself, to see what that results in. This drive was being used to backup my system, so I'm currently already creating a new system backup on a new hard drive. So it's not too upsetting if I can't recover the data in the image. I was mostly just hoping to save myself some time. Thanks for your help!