On Tuesday, 18 December 2018 17:49:37 GMT Jack wrote: > On 2018.12.18 12:42, Mick wrote: > [snip...] > > > So, I used losetup with --offset on the failing drive itself over USB > > 2.0 and was able to mount and recover all the NTFS files. > > I definitely need to read up on that one - I totally unfamiliar with it.
If you are not able to mount a partition because of a 'device not found ...' type of error use c/f/gdisk et al. to find the sector at which the partition in question starts. Let's say gdisk shows partition 6 starts at sector 1,615,872 and the sector size is 512 bytes. The starting offset for losetup should be: 1,615,872 x 512 = 827,326,464 Similarly, let's say the size of the partition is shown as being 1,910,121,163 sectors, which gives a size of 977,982,035,456 in bytes: 1,910,121,163 x 512 = 977,982,035,456 Then add the above parameters in the losetup command to create a loopback device as follows: losetup -o 827326464 --sizelimit 977982035456 --sector-size 512 -P -r -v /dev/ loop4 /dev/sdb and subsequently try to mount it: mkdir /mnt/recovery mount /dev/loop4 /mnt/recovery > > Over the years I've used clonezilla, ddrescue, testdisk, photorec and > > losetup to recover files. On a couple of times where data on the > > disk had been overwritten by subsequent operations, I was not able to > > recover the affected files. So, if when moving the partition data > > was overwritten I suspect it will be very difficult to recover this > > with conventional software tools. However, it doesn't hurt to try. > > > > :-) > > I should be in good shape there. The partition's new location should > have the first half intact, and since the overwriting was of the first > part of the old location, it's second half should be intact. The files > should all be there - but I imagine I might have to play with any > directories which were successfully move, but not the stuff they point > to. Of course, all of this depends on recovering from the read errors > - so ddrescue needs to finish first. This is what I would try: 1. dd the previously moved first half to a new partition/device. 2. dd the intact second half from the corresponding second half offset position of the overwritten partition to the new partition/device. Use --seek and --skip in the dd command as appropriate to achieve this. This way you should be able to stitch together the two halves, hoping that no bits/bytes were lost when the move/overwritting occurred back then. If the original filesystem is not recoverable you should be able to recover individual files with photorec. -- Regards, Mick
signature.asc
Description: This is a digitally signed message part.
