[SOLVED] Interrupting ddrescue and mounting partial NTFS image

cozisco · 2021-10-21 05:12:02

I have a failing HDD with hardware issues (a 1 TB drive with ~670 GB of files on it). I've been running ddrescue on it to recover what I can, though ddrescue has gotten really slow. Note that I'm only running ddrescue on one partition, not the whole disk.

It took ~2 days to rescue 85.09% but has slowed way down since then, only increasing 0.06% over the last day (running @ 8000-16000 B/s):

>>> ddrescue -f -n -r 1 -c 32 /dev/sdb2 rescue.img rescue.log
Current status
     ipos:  225249 MB, non-trimmed:    6995 kB,  current rate:   16384 B/s
     opos:  225249 MB, non-scraped:        0 B,  average rate:   13907 B/s
non-tried:  148511 MB,  bad-sector:        0 B,    error rate:       0 B/s
  rescued:  851550 MB,   bad areas:        0,        run time:   3d 1h 30m
pct rescued:   85.14%, read errors:        0,  remaining time:    125d 21h
                              time since last successful read:          0s
Copying non-tried blocks... Pass 2 (backwards)

Is it possible to interrupt ddrescue and mount the partial image to see what's been recovered so far?

If I try to mount this partial image as a loop device I get an I/O error complaining about a corrupted $UpCase file (this partition is NTFS):

>>> mount -t ntfs -o loop,ro rescue.img /mnt/rescue/
Corrupted file $UpCase
Failed to mount '/dev/loop0': Input/output error
NTFS is either inconsistent, or there is a hardware fault, or it's a
SoftRAID/FakeRAID hardware. In the first case run chkdsk /f on Windows
then reboot into Windows twice. The usage of the /f parameter is very
important! If the device is a SoftRAID/FakeRAID then first activate
it and mount a different device under the /dev/mapper/ directory, (e.g.
/dev/mapper/nvidia_eahaabcc1). Please see the 'dmraid' documentation
for more details.

Are there any tools for working with a partial image of a single NTFS partition? Is it worth trying or would file fragmentation be too much of an issue? Similar posts recommend testdisk and kpartx, but I don't think those would help here given that it's an image of a single partition, rather than an image of the whole disk.

Last edited by cozisco (2021-10-22 00:15:11)

seth · 2021-10-21 07:10:39

The filesystem is corrupted for sure (thus the $UpCase error) so you'll first have to fix it.
The suggested way is https://wiki.archlinux.org/title/NTFS-3 … ilesystems ntfsfix or chkdisk on windows.
Without windows, testdisk can "repair" ntfs by juggling the MFTs, but it's not sure this will succeed in this case.
Was the drive (bitlocker) encrypted?

Whatever you do, make a copy of the image to go back to when fixing efforts made the situation worse (to avoid having to dd_rescue again, w/ likely less success)

cozisco · 2021-10-22 00:14:53

Thanks, @seth. chkdsk was able to repair the partial image.

I booted into Windows, mounted the partial image using ImDisk then repaired it using chkdsk (with the \f option). I was then able to mount it in arch as a loop device. I didn't try ntfsfix and just went straight for chkdsk.

Arch Linux

#1 2021-10-21 05:12:02

[SOLVED] Interrupting ddrescue and mounting partial NTFS image

#2 2021-10-21 07:10:39

Re: [SOLVED] Interrupting ddrescue and mounting partial NTFS image

#3 2021-10-22 00:14:53

Re: [SOLVED] Interrupting ddrescue and mounting partial NTFS image

Board footer