Hello Antonio Diaz Diaz and all contributors, First of all, thank you for the wonderful work.
I'll try to describe my situation as precisely as possible. TLDR : - SATA 2To HDD with 2 partitions failed - refused to boot - plugged from usb through adapter and booted. Disk is shown as /dev/sde, partitions are displayed sometimes /dev/sde1, /dev/sd2. I only care about /dev/sde2, which is massive (1.8To) - can't mount them - "foremost" failed to extract anything - tried ddrescue twice, not a lot of success (300Gb out of 2To recovered) strange error I can't understand : ddrescue: /dev/sde: Unaligned read error. Is sector size correct? - can't mount the img file - completely lost... Longer version with logs: I have a 2To HDD with 2 NTFS partitions : Disk /dev/sde: 1,82 TiB, 2000398934016 bytes, 3907029168 sectors Disk model: 001-1CH164 Units: sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 4096 bytes I/O size (minimum/optimal): 4096 bytes / 4096 bytes Disklabel type: dos Disk identifier: 0xf0e9674b Device Boot Start End Sectors Size Id Type /dev/sde1 2048 102402047 102400000 48,8G 7 HPFS/NTFS/exFAT /dev/sde2 102402048 3907024895 3804622848 1,8T 7 HPFS/NTFS/exFAT I absolutely don't care about the first partition, all I want comes from the second one. The disk was on a sata port. Last week it failed abruptly and I couldn't boot with the disk plugged in. I bought a SATA -> USB adapter and managed to boot. The disk is shown as /dev/sde but I can't mount it. It only worked once, failed while I tried to copy. Never again. I tried "foremost" since I had a lot of success with previous failed drive. As you guessed, it didn't work. I triest ddrescue twice, here are the outputs : % sudo ddrescue -n -b512 /dev/sde /home/quentin/nfs/data/forensic/ntfs_data.img /home/quentin/ntfs/ddrescue_data GNU ddrescue 1.26 Press Ctrl-C to interrupt ipos: 1996 GB, non-trimmed: 2928 kB, current rate: 0 B/s opos: 1996 GB, non-scraped: 0 B, average rate: 1193 kB/s non-tried: 1984 GB, bad-sector: 0 B, error rate: 771 B/s rescued: 15587 MB, bad areas: 0, run time: 3h 37m 36s pct rescued: 0.77%, read errors: 109, remaining time: 133d 11h time since last successful read: 1m 25s Copying non-tried blocks... Pass 1 (forwards) ipos: 15607 MB, non-trimmed: 7823 kB, current rate: 0 B/s opos: 15607 MB, non-scraped: 0 B, average rate: 1193 kB/s non-tried: 1984 GB, bad-sector: 0 B, error rate: 771 B/s rescued: 15587 MB, bad areas: 0, run time: 3h 37m 36s pct rescued: 0.77%, read errors: 218, remaining time: n/a time since last successful read: 1m 25s Copying non-tried blocks... Pass 2 (backwards) ipos: 25915 MB, non-trimmed: 10327 MB, current rate: 0 B/s opos: 25915 MB, non-scraped: 0 B, average rate: 1193 kB/s non-tried: 0 B, bad-sector: 0 B, error rate: 165 MB/s rescued: 15587 MB, bad areas: 0, run time: 3h 37m 37s pct rescued: 0.77%, read errors: 157788, remaining time: n/a time since last successful read: 1m 26s Copying non-tried blocks... Pass 5 (forwards) ipos: 15587 MB, non-trimmed: 10327 MB, current rate: 0 B/s opos: 15587 MB, non-scraped: 0 B, average rate: 1193 kB/s non-tried: 0 B, bad-sector: 0 B, error rate: 10169 MB/s rescued: 15587 MB, bad areas: 0, run time: 3h 37m 37s pct rescued: 0.77%, read errors: 157788, remaining time: n/a time since last successful read: 1m 26s Trimming failed blocks... (forwards) ddrescue: /dev/sde: Unaligned read error. Is sector size correct? [23:54 quentin@qkzk forensic]% lsa .rw-rw-r--@ 16G root 19 févr. 21:43 ntfs_data.img [9:24 quentin@qkzk forensic]% sudo ddrescue -n -b4096 /dev/sde /home/quentin/nfs/data/forensic/ntfs_data.img /home/quentin/ntfs/ddrescue_data GNU ddrescue 1.26 Press Ctrl-C to interrupt Initial status (read from mapfile) rescued: 15587 MB, tried: 10327 MB, bad-sector: 0 B, bad areas: 0 Current status ipos: 1999 GB, non-trimmed: 10331 MB, current rate: 0 B/s opos: 1999 GB, non-scraped: 0 B, average rate: 1566 kB/s non-tried: 1682 GB, bad-sector: 4096 B, error rate: 762 B/s rescued: 307649 MB, bad areas: 1, run time: 2d 3h 47m pct rescued: 15.37%, read errors: 126, remaining time: 12d 11h 21m time since last successful read: 1m 26s Copying non-tried blocks... Pass 1 (forwards) ipos: 96555 MB, non-trimmed: 10337 MB, current rate: 0 B/s opos: 96555 MB, non-scraped: 0 B, average rate: 1566 kB/s non-tried: 1682 GB, bad-sector: 4096 B, error rate: 762 B/s rescued: 307649 MB, bad areas: 1, run time: 2d 3h 47m pct rescued: 15.37%, read errors: 252, remaining time: n/a time since last successful read: 1m 26s Copying non-tried blocks... Pass 2 (backwards) ipos: 353249 MB, non-trimmed: 45605 MB, current rate: 0 B/s opos: 353249 MB, non-scraped: 0 B, average rate: 1566 kB/s non-tried: 1647 GB, bad-sector: 4096 B, error rate: 5768 MB/s rescued: 307649 MB, bad areas: 1, run time: 2d 3h 47m pct rescued: 15.37%, read errors: 538394, remaining time: n/a time since last successful read: 1m 28s Copying non-tried blocks... Pass 5 (forwards) ddrescue: /dev/sde: Unaligned read error. Is sector size correct? [19:20 quentin@qkzk forensic]% lsa .rw-rw-r--@ 319G root 22 févr. 13:13 ntfs_data.img dmesg gave a lot of errors I'm not sure to understand. Here is a small extract : [264476.032135] blk_update_request: critical target error, dev sde, sector 622305296 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 0 [264481.400606] sd 7:0:0:0: [sde] tag#19 FAILED Result: hostbyte=DID_OK driverbyte=DRIVER_OK cmd_age=5s [264481.400637] sd 7:0:0:0: [sde] tag#19 Sense Key : Illegal Request [current] [264481.400644] sd 7:0:0:0: [sde] tag#19 Add. Sense: Invalid field in cdb [264481.400652] sd 7:0:0:0: [sde] tag#19 CDB: Read(10) 28 00 25 17 a0 10 00 00 08 00 [264481.400657] blk_update_request: critical target error, dev sde, sector 622305296 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [264481.400673] Buffer I/O error on dev sde, logical block 77788162, async page read [264485.351873] sd 7:0:0:0: [sde] tag#16 FAILED Result: hostbyte=DID_OK driverbyte=DRIVER_OK cmd_age=3s [264485.351902] sd 7:0:0:0: [sde] tag#16 Sense Key : Illegal Request [current] [264485.351910] sd 7:0:0:0: [sde] tag#16 Add. Sense: Invalid field in cdb [264485.351917] sd 7:0:0:0: [sde] tag#16 CDB: Read(10) 28 00 25 17 a0 10 00 00 08 00 [264485.351922] blk_update_request: critical target error, dev sde, sector 622305296 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [264485.351937] Buffer I/O error on dev sde, logical block 77788162, async page read As you can guess, there's like 20 screens of similar errors... Since I'm really confused, I tried to mount the .img file, with no success : 19:18 quentin@qkzk forensic]% sudo losetup -P /dev/loop0 /home/quentin/nfs/data/forensic/ntfs_data.img [19:19 quentin@qkzk forensic]% ls /dev/loop* /dev/loop-control /dev/loop0p1 /dev/loop1 /dev/loop3 /dev/loop5 /dev/loop7 /dev/loop0 /dev/loop0p2 /dev/loop2 /dev/loop4 /dev/loop6 [19:19 quentin@qkzk forensic]% sudo mount /dev/loop0p2 /mnt/ntfs_data Failed to read last sector (3804622846): Invalid argument HINTS: Either the volume is a RAID/LDM but it wasn't setup yet, or it was not setup correctly (e.g. by not using mdadm --build ...), or a wrong device is tried to be mounted, or the partition table is corrupt (partition is smaller than NTFS), or the NTFS boot sector is corrupt (NTFS size is not valid). Failed to mount '/dev/loop0p2': Invalid argument The device '/dev/loop0p2' doesn't seem to have a valid NTFS. Maybe the wrong device is used? Or the whole disk instead of a partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around? I tried other ways, no success either. 1. I can't understand the error message ddrescue is giving : ddrescue: /dev/sde: Unaligned read error. Is sector size correct? 2. Has ddrescue finished correctly ? I'm not even sure ! 3. What should I do next ? run ddrescue again ? try to scrap some files from the .img ? (how ?) Sorry for the confusing and long message, I didn't want to bother you with such a question but I'm really lost and strucked. Thanks in advance, Quentin