1 |
On Tuesday, 18 December 2018 17:49:37 GMT Jack wrote: |
2 |
> On 2018.12.18 12:42, Mick wrote: |
3 |
> [snip...] |
4 |
> |
5 |
> > So, I used losetup with --offset on the failing drive itself over USB |
6 |
> > 2.0 and was able to mount and recover all the NTFS files. |
7 |
> |
8 |
> I definitely need to read up on that one - I totally unfamiliar with it. |
9 |
|
10 |
If you are not able to mount a partition because of a 'device not found ...' |
11 |
type of error use c/f/gdisk et al. to find the sector at which the partition |
12 |
in question starts. Let's say gdisk shows partition 6 starts at sector |
13 |
1,615,872 and the sector size is 512 bytes. The starting offset for losetup |
14 |
should be: |
15 |
|
16 |
1,615,872 x 512 = 827,326,464 |
17 |
|
18 |
Similarly, let's say the size of the partition is shown as being 1,910,121,163 |
19 |
sectors, which gives a size of 977,982,035,456 in bytes: |
20 |
|
21 |
1,910,121,163 x 512 = 977,982,035,456 |
22 |
|
23 |
|
24 |
Then add the above parameters in the losetup command to create a loopback |
25 |
device as follows: |
26 |
|
27 |
losetup -o 827326464 --sizelimit 977982035456 --sector-size 512 -P -r -v /dev/ |
28 |
loop4 /dev/sdb |
29 |
|
30 |
and subsequently try to mount it: |
31 |
|
32 |
mkdir /mnt/recovery |
33 |
|
34 |
mount /dev/loop4 /mnt/recovery |
35 |
|
36 |
|
37 |
> > Over the years I've used clonezilla, ddrescue, testdisk, photorec and |
38 |
> > losetup to recover files. On a couple of times where data on the |
39 |
> > disk had been overwritten by subsequent operations, I was not able to |
40 |
> > recover the affected files. So, if when moving the partition data |
41 |
> > was overwritten I suspect it will be very difficult to recover this |
42 |
> > with conventional software tools. However, it doesn't hurt to try. |
43 |
> > |
44 |
> > :-) |
45 |
> |
46 |
> I should be in good shape there. The partition's new location should |
47 |
> have the first half intact, and since the overwriting was of the first |
48 |
> part of the old location, it's second half should be intact. The files |
49 |
> should all be there - but I imagine I might have to play with any |
50 |
> directories which were successfully move, but not the stuff they point |
51 |
> to. Of course, all of this depends on recovering from the read errors |
52 |
> - so ddrescue needs to finish first. |
53 |
|
54 |
This is what I would try: |
55 |
|
56 |
1. dd the previously moved first half to a new partition/device. |
57 |
|
58 |
2. dd the intact second half from the corresponding second half offset |
59 |
position of the overwritten partition to the new partition/device. Use --seek |
60 |
and --skip in the dd command as appropriate to achieve this. |
61 |
|
62 |
This way you should be able to stitch together the two halves, hoping that no |
63 |
bits/bytes were lost when the move/overwritting occurred back then. If the |
64 |
original filesystem is not recoverable you should be able to recover |
65 |
individual files with photorec. |
66 |
|
67 |
-- |
68 |
Regards, |
69 |
Mick |