[SOLVED]mounting a faulty raw disk .img

Pines · 2021-08-14 21:02:14

Hello.
I have a this 1TB hard disk that seems to have some problems:
My brother in law was moving some files into it (cuting and pasting on Windows). Both source files and output files are gone.
I decided to put this disk on my computer to check on it using TestDisk, but the power went out for a moment in my house. I leave it alone for a while and made a .img file out of the entire disk onto my external 3TB hard drive using ddrescue.
Now how exactly I mount this file?

I ran:
fdisk -l hd1tb.img

and got:
Disk hd1tb.img: 931.51 GiB, 1000204886016 bytes, 1953525168 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x5e1de370

Device Boot Start End Sectors Size Id Type
hd1tb.img1 2048 1953521663 1953519616 931.5G 7 HPFS/NTFS/exFAT

since the bootstart is at 2048 I assume this command would do:
$sudo mount -o loop,offset=1048576 '/run/media/ineps/ADATA HV320/hd1tb.img' /dev/loop0

but got:
mount: /dev/loop0: failed to setup loop device for /run/media/ineps/ADATA HV320/hd1tb.img.

So how exactly I do this? Is there other way to get more info on how is the state of this img? These files have sentimental value for my wife.
Btw, I dont have other healthy disk to copy on it

EDIT: I got the files back by running photorec directly on disk wich is not recomended!

Last edited by Pines (2021-10-06 16:57:15)

seth · 2021-08-14 22:24:16

losetup -P, see https://wiki.archlinux.org/title/File_r … ntire_disk

Pines · 2021-08-16 02:39:47

Thanks for the answer
I ran after using losetup:
sudo mount /dev/loop0p1 /home/ineps/hd1

and got:
mount: /home/ineps/hd1: wrong fs type, bad option, bad superblock on /dev/loop0p1, missing codepage or helper program, or other error.

I dont quite understand the section Using QEMU to repair NTFS on wiki...

I know this hard disk have a unique partition that is ntfs but it have to cointain a windows instalation?

ugjka · 2021-08-16 04:48:37

Read up on kpartx

seth · 2021-08-16 05:44:28

pacman -Qs ntfs-3g

If that's not it, the superblock might actually be damaged (" but the power went out for a moment in my house"?) or bitlocker encrypted.

Pines · 2021-08-18 04:07:52

ugjka wrote:

Read up on kpartx

tried to use kpartx:
input:
sudo kpartx -av hd1tb.img

output:
dev/mapper/control: open failed: No such device
Failure to communicate with kernel device-mapper driver.
Check that device-mapper is available in the kernel.
Incompatible libdevmapper 1.02.179 (2021-08-11) and kernel driver (unknown version).
device mapper prerequisites not met

(I just updated the system, and mirrorlist, idk what is wrong)

seth wrote:

pacman -Qs ntfs-3g
If that's not it, the superblock might actually be damaged (" but the power went out for a moment in my house"?) or bitlocker encrypted.

I got this:
local/ntfs-3g 2017.3.23-5
NTFS filesystem driver and utilities

in this case the superblock is actually damaged?

seth · 2021-08-18 07:25:47

Possibly.
You can use testdisk to search for filesystems https://wiki.archlinux.org/title/File_r … d_PhotoRec
If you try to repair the superblock, make sure to have a backup of the image. Destructive actions on bogus data always carries the risk to make things worse.

I just updated the system, and mirrorlist, idk what is wrong

You updated the kernel and did not reboot?

Pines · 2021-09-03 01:17:34

I used TestDisk to se the partitions on the actual disk: Can't open filesystem. Filesystem seems damaged.

seth · 2021-09-03 06:41:17

If you manipulated the partition table and didn't create a filesystem, you might have erased the previous filesystem (and didn't create a new one)
Do you expect any data on that disk?
Otherwise just go ahead and actually create a filesystem.

Pines · 2021-09-04 02:10:07

I do expect to have data on disc, but I wont erease all data if I create a new file system?

seth · 2021-09-04 07:10:57

It won't be erased, but if there's still an intact filesystem (referencing the files on the disc) you'd lose that, so DON'T!
Avoid writing to the disc in any fashion.

1. What was on tha drive before you "reformated" it?
2. What were your intentions when "reformating" it?
3. What *exactly* - step by step - did you do to "reformat" it?

Pines · 2021-09-06 02:40:46

seth wrote:

It won't be erased, but if there's still an intact filesystem (referencing the files on the disc) you'd lose that, so DON'T!
Avoid writing to the disc in any fashion.
1. What was on tha drive before you "reformated" it?
2. What were your intentions when "reformating" it?
3. What *exactly* - step by step - did you do to "reformat" it?

1: a NTFS file system with photos, videos and some documents. Idk if where windows instaled on it.
2: I didn't "reformat" (I guess)
3: on the disk, as far I remember I just made the .img file using ddrescue (wich is preatty dity now, so I gave up working on it). So for the clarification an "reset" of this subject, the drive itself is preatty much in the same state as it is when I got it, and also, every time I boot the sistem it seems its trying to read something because it encreased the boot time by almost 3 min.

seth · 2021-09-06 05:13:19

LOL - sorry, in the last two posts I conflated this w/ https://bbs.archlinux.org/viewtopic.php?id=269222
My bad entirely

=> Please just ignore everything between #9 & #12

If testdisk can't find *any* partition, you*re down to data rescue mode (ie. try to reconstruct as many files as possible)
You can also try "chkdisk /f x:" ("x:" for the drive) under windows.

Do you know whether the drive was encrypted w/ bitlocker?

Pines · 2021-09-10 22:31:35

seth wrote:

LOL - sorry, in the last two posts I conflated this w/ https://bbs.archlinux.org/viewtopic.php?id=269222
My bad entirely
=> Please just ignore everything between #9 & #12

haha no problem, man

seth wrote:

If testdisk can't find *any* partition, you*re down to data rescue mode (ie. try to reconstruct as many files as possible)
You can also try "chkdisk /f x:" ("x:" for the drive) under windows.
Do you know whether the drive was encrypted w/ bitlocker?

yea testdisk indeed show the P (primary) partition:

Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63
Partition Start End Size in sectors
>P HPFS - NTFS 0 32 33 121601 25 24 1953519616

but when I hit P: to list files I got:
Can't open filesystem. Filesystem seems damaged.

Soooo... I'll try chkdisk IN Windows(?) because I think Windows don't even show the disk on disk management

Last edited by Pines (2021-09-10 22:33:42)

seth · 2021-09-11 08:39:33

Did you conduct a deep search?
If the filesystem is lost, you're down to photorec.
If the disk was encrypted, you're fucked.

chkdsk is a windows program, https://docs.microsoft.com/en-us/window … nds/chkdsk
Does diskpart show the volume? https://docs.microsoft.com/en-us/window … s/diskpart

Pines · 2021-09-14 23:44:18

seth wrote:

Did you conduct a deep search?
If the filesystem is lost, you're down to photorec.
If the disk was encrypted, you're fucked.
chkdsk is a windows program, https://docs.microsoft.com/en-us/window … nds/chkdsk
Does diskpart show the volume? https://docs.microsoft.com/en-us/window … s/diskpart

I'm pretty sure the disk isn't encrypted

I can see using diskpart, but how I check with chkdsk if I cant see the letter on it:

unknown_disk

DISKPART> list disk

Disk ### Status Size Free Dyn Gpt
-------- ------------- ------- ------- --- ---
Disk 2 Online 931 GB 931 GB

seth · 2021-09-15 07:45:23

You can't - there's no partition table on the drive, it might be formatted as superdisk (ie. a filesystem on the drive, no partition table)
You can try ntfsfix on the drive (/dev/sdc, not "/dev/sdc1" or so) but make sure that you do have a copy of the disk!
https://wiki.archlinux.org/title/NTFS-3 … ilesystems

Pines · 2021-09-15 23:38:32

You saying I must have a copy of the thisk because I'll lost forever any data on it? (i.e. writing zeroes). It will take a long time to make another copy of the disk, AND I would copy as damaged it is. I dont think make another copy of it is a good idea becouse I have serious energy problems in my neigbhour.

seth · 2021-09-16 05:57:59

*ANY* destructive action on a compromised FS (and trying to write a fix is such) bears the risk to make the situation worse - to the point where it only becomes unfixable by that attempt.
You're trying to reconstruct corrupted data - there's no magic wand fix, only informed guessing by the tools you use.
This becomes even more true if the destructive action itself can be compromised by sudden power losses ( https://en.wikipedia.org/wiki/Uninterru … wer_supply ) so you WANT to maintain the original master and only operate on copies, at least until you successfully restored the filesystem.

Fixing the filesystem will not erase the disk (so eg. photorec might still be able to find coherent bits), but you need the filesystem to restore fragmented files.

Pines · 2021-09-21 01:36:28

otput for ntfsfix:
Mounting volume... NTFS signature is missing.
FAILED
Attempting to correct errors... NTFS signature is missing.
FAILED
Failed to startup volume: Invalid argument
NTFS signature is missing.
Trying the alternate boot sector
Unrecoverable error
Volume is corrupt. You should run chkdsk.

Trying to initialize the disk (MBR or GPT):
The request failed due to a fatal device hardware error

With diskpart:
https://i.imgur.com/IY0vcMv.png

The log:
https://i.imgur.com/QETbyIW.png

So... R.I.P.???

Last edited by Pines (2021-09-21 22:11:18)

seth · 2021-09-21 06:54:02

Please replace the oversized images w/ links.

Is this the HW disk? Because it seems to produce IO errors.
In any event, if you cannot reconstruct a filesystem your best chance is photorec (which will try to find coherent files on inodes)
This will not be able to recover all and probably not even most data but perhaps at least some.

Pines · 2021-09-21 23:40:56

sorry for the images
Yes, it is the hard drive itself

Pass 1 - Reading sector 5448/1953519616, 0 files found
Elapsed time 1h15m24s - Estimated time to completion 450608h41m20

well this is sad...

seth · 2021-09-22 06:51:25

Since the drive has known I/O issues and you dd_recue'd from it: why are you using the drive and not the image??

Pines · 2021-10-06 16:53:33

Sorry for the late reply
I was able to recover most of the files I needed directly from disk, I know this is a wrong move and maybe I got lucky, but after a couple minutes of scanning, the estimated time completion decreased so much that I was able to end it in only 4 days.
Even not using the image itself, my primary goal was achieved, so I'll mark as solved.
And Thank you very much!

Arch Linux

#1 2021-08-14 21:02:14

[SOLVED]mounting a faulty raw disk .img

#2 2021-08-14 22:24:16

Re: [SOLVED]mounting a faulty raw disk .img

#3 2021-08-16 02:39:47

Re: [SOLVED]mounting a faulty raw disk .img

#4 2021-08-16 04:48:37

Re: [SOLVED]mounting a faulty raw disk .img

#5 2021-08-16 05:44:28

Re: [SOLVED]mounting a faulty raw disk .img

#6 2021-08-18 04:07:52

Re: [SOLVED]mounting a faulty raw disk .img

#7 2021-08-18 07:25:47

Re: [SOLVED]mounting a faulty raw disk .img

#8 2021-09-03 01:17:34

Re: [SOLVED]mounting a faulty raw disk .img

#9 2021-09-03 06:41:17

Re: [SOLVED]mounting a faulty raw disk .img

#10 2021-09-04 02:10:07

Re: [SOLVED]mounting a faulty raw disk .img

#11 2021-09-04 07:10:57

Re: [SOLVED]mounting a faulty raw disk .img

#12 2021-09-06 02:40:46

Re: [SOLVED]mounting a faulty raw disk .img

#13 2021-09-06 05:13:19

Re: [SOLVED]mounting a faulty raw disk .img

#14 2021-09-10 22:31:35

Re: [SOLVED]mounting a faulty raw disk .img

#15 2021-09-11 08:39:33

Re: [SOLVED]mounting a faulty raw disk .img

#16 2021-09-14 23:44:18

Re: [SOLVED]mounting a faulty raw disk .img

#17 2021-09-15 07:45:23

Re: [SOLVED]mounting a faulty raw disk .img

#18 2021-09-15 23:38:32

Re: [SOLVED]mounting a faulty raw disk .img

#19 2021-09-16 05:57:59

Re: [SOLVED]mounting a faulty raw disk .img

#20 2021-09-21 01:36:28

Re: [SOLVED]mounting a faulty raw disk .img

#21 2021-09-21 06:54:02

Re: [SOLVED]mounting a faulty raw disk .img

#22 2021-09-21 23:40:56

Re: [SOLVED]mounting a faulty raw disk .img

#23 2021-09-22 06:51:25

Re: [SOLVED]mounting a faulty raw disk .img

#24 2021-10-06 16:53:33

Re: [SOLVED]mounting a faulty raw disk .img

Board footer