I'm trying to rescue an USB ext HD 2TB using ddrescue on a linux VM, host is win. Everything worked fine, rescued almost all, there are 60MB of errors left to work out.
So I had some problems on the host machine, had to turn it off. Turned off the VM first and the "broken" HD was mounted on windows.....! I'm worried this could have changed data in there, so the data would differ from the image file..?
I launched ddru_ntfsfindbad, to get a list of the file with the data in the damaged sectors and I also already copied all file out of the image made by ddrescue. Now I'm left to decide if finish the rescue of the whole HD or just give it a go with every single file - BTW they are around 20-30, can't remind.
I would stick in finishing the HD, for making it easier but also less stressing on the hardware itself. The only clues I have, as said, is whether mounting it in windows could have changed the data in the HD, and make it differ from the image file. I would say even so, it wouldn't matter, as I know which file I have to go for, and it is very unlikely that windows has changed some data inside those files.
Just need a confirmation please!
Thanks
