I have a suspect ntfs drive with 2 partitions (from a win2k machine that has stopped fully booting except into safe mode). I copied the 2 partitions separately using ddrescue.
The first was successful:
- this partition is labelled "system"
sudo ddrescue /dev/sdd1 /media/chris/WINDOWS/win2k_machine/sdd1/sdd1.img ~/sdd1_rescue.log
ran with no errors, no reported bad sectors.sudo mount -o loop /media/chris/WINDOWS/win2k_machine/sdd1/sdd1.img /media/win2ksys/
(having usedmkdir
to create the mount point first. So my approach seems fine.
The second won't mount:
- this partition is labelled "data"
sudo ddrescue /dev/sdd2 /media/chris/WINDOWS/win2k_machine/sdd2/sdd2.img ~/sdd2_rescue.log
ran with no errors, no reported bad sectors. Note that I generated the command by editing the previous one. The output file is the same size as the partition (as checked using gparted) sudo mount -o loop /media/chris/WINDOWS/win2k_machine/sdd1/sdd2.img /media/win2kdata/
(again having usedmkdir
to create the mount point first, and again producing the command by editing the one from history) failed.
This fails with mount: /media/win2kdata: wrong fs type, bad option, bad superblock on /dev/loop8, missing codepage or helper program, or other error.
I'm not sure if there's a real fault in the image, or something is going wrong when I try to mount it. ntfsfix
reports
mounting volume... ntfs_mst_post_read_fixup_warn: magic: 0x00000000 size: 1024 usa_ofs: 0 usa_count: 0: Invalid argument
Record 0 has no FILE magic (0x0)
Failed to load $MFT: Input/output error
FAILED
Attempting to correct errors... ntfs_mst_post_read_fixup_warn: magic: 0x00000000 size: 1024 usa_ofs: 0 usa_count: 0: Invalid argument
Record 0 has no FILE magic (0x0)
Failed to load $MFT: Input/output error
FAILED
Failed to startup volume: Input/output error
Checking for self-located MFT segment... ntfs_mst_post_read_fixup_warn: magic: 0x00000000 size: 1024 usa_ofs: 0 usa_count: 0: Invalid argument
OK
Unrecoverable error
Volume is corrupt. You should run chkdsk.
Is this really a sign of imaging a corrupt drive, or is it an issue with how I'm trying to mount it? I doubt I can run windows chkdsk on the image, and don't want to try running it on the real drive until I can be sure I've got a functioning image.