3

I have a suspect ntfs drive with 2 partitions (from a win2k machine that has stopped fully booting except into safe mode). I copied the 2 partitions separately using ddrescue.

The first was successful:

  • this partition is labelled "system"
  • sudo ddrescue /dev/sdd1 /media/chris/WINDOWS/win2k_machine/sdd1/sdd1.img ~/sdd1_rescue.log ran with no errors, no reported bad sectors.
  • sudo mount -o loop /media/chris/WINDOWS/win2k_machine/sdd1/sdd1.img /media/win2ksys/ (having used mkdir to create the mount point first. So my approach seems fine.

The second won't mount:

  • this partition is labelled "data" sudo ddrescue /dev/sdd2 /media/chris/WINDOWS/win2k_machine/sdd2/sdd2.img ~/sdd2_rescue.log ran with no errors, no reported bad sectors. Note that I generated the command by editing the previous one. The output file is the same size as the partition (as checked using gparted)
  • sudo mount -o loop /media/chris/WINDOWS/win2k_machine/sdd1/sdd2.img /media/win2kdata/ (again having used mkdir to create the mount point first, and again producing the command by editing the one from history) failed.

This fails with mount: /media/win2kdata: wrong fs type, bad option, bad superblock on /dev/loop8, missing codepage or helper program, or other error. I'm not sure if there's a real fault in the image, or something is going wrong when I try to mount it. ntfsfix reports

mounting volume... ntfs_mst_post_read_fixup_warn: magic: 0x00000000  size: 1024   usa_ofs: 0  usa_count: 0: Invalid argument
Record 0 has no FILE magic (0x0)
Failed to load $MFT: Input/output error
FAILED
Attempting to correct errors... ntfs_mst_post_read_fixup_warn: magic: 0x00000000  size: 1024   usa_ofs: 0  usa_count: 0: Invalid argument
Record 0 has no FILE magic (0x0)
Failed to load $MFT: Input/output error
FAILED
Failed to startup volume: Input/output error
Checking for self-located MFT segment... ntfs_mst_post_read_fixup_warn: magic: 0x00000000  size: 1024   usa_ofs: 0  usa_count: 0: Invalid argument
OK
Unrecoverable error
Volume is corrupt. You should run chkdsk. 

Is this really a sign of imaging a corrupt drive, or is it an issue with how I'm trying to mount it? I doubt I can run windows chkdsk on the image, and don't want to try running it on the real drive until I can be sure I've got a functioning image.

Jeff Schaller
  • 67,283
  • 35
  • 116
  • 255
Chris H
  • 175

1 Answers1

3

It seems that you have used the same log/state file for two different invocations of ddrescue. This file is used to keep track of the blocks and sectors that have been successfully (or unsucessfully) copied.

The first instance of ddrescue for /dev/sdd1 created and updated the log/state file ~/sdd1_rescue.log. The second instance of ddrescue, this time for /dev/sdd2, unintentionally used the same log/state file. This file had recorded that many of the blocks/sectors had been successfully copied so ddrescue was able to skip those. Unfortunately this meant that data capture from the second block device was largely ignored and the resulting image file was incomplete.

Jeff Schaller
  • 67,283
  • 35
  • 116
  • 255
Chris Davies
  • 116,213
  • 16
  • 160
  • 287