5

I want to recover some deleted files from a healthy NTFS partition on an undamaged hard-disk.

In order to leave the partition undisturbed, i plan to use dd to clone the partition to a raw image file & then attempt recovery from that mounted clone.


Will dd if=/dev/sd<xn> of=/path/to/output.img perform a non-destructive copy ?

Is attempting a restore from a clone using dd the best approach?

[edit, wrt Deltiks answer, i need to be a bit clearer about what i'm asking]
eg: are there some s/w that can do something more with the original sectors ?
eg: if it was a damaged hard-disk i am aware that any kind of read is potentially destructive. but assuming my disk head is not going to suddenly spaz out etc, am i reducing my chances of a successful recovery (at any cost) by using an apparently non-destructive single read of my undamaged hard-disk.

(btw: i am planning on using ntfsundelete & testdisk for recovery)

Improve this question
2
  • Good question, but I'm reluctant to answer it because I don't know for sure. My logic works like this: A professional data recovery service would try to read the data without opening the HDD first. If that fails, the data should still be there because only read operations were performed, so the magnetic data shouldn't have been affected. Then, they'd open it up and go through the challenging task of mapping digital addresses to physical locations. And it's expensive.
    – Deltik
    Jun 29, 2012 at 18:59
  • a damaged HDD can destroy data on a read. it's mechanical. even NAND degrades on reads (read disturb) ;) ~b/l: any usage wears stuff out! ~am still hoping a h/ware expert turns up & tells me, if for military grade data, a single ordinary read (dd or whatever) is the zen way.. for everyday data, i'm fairly sure that it is. ~ BTW, have now retrieved my data a-ok. i ended up using sleuth kit since it is o/s & i needed to restore file-names & sub-directories. ~worked very well indeed. &&BTW: thx for your input ~one of those +1s is from me lol ;)
    – violet313
    Jun 29, 2012 at 22:43

2 Answers 2

Reset to default
9

No, the correct command for a non-destructive copy of a partition is:

dd if=/dev/sdxn of=/path/to/output.img

sdx in sdxn should be replaced with the actual device name.

n in sdxn should be replaced with the partition number of the NTFS partition.

This approach is certainly very safe because when you have a copy made, you can easily multiply that image. If you mess up one image, you still have others. If your HDD happens to fail after the copy, well, you still have the copy.

Because the operation is read-only, deleted files that may still be in there won't be touched.

EDIT (2012/06/28 23:00 UTC): Notice the dd if=/dev/sdxn of=/path/to/output.img, which is the directory containing the devices.

EDIT (2012/06/28 23:03 UTC): After your edit, your command is now correct and will perform a non-destructive copy of a partition.

To help further users, or for "just-in-case" scenarios:

If your partition was actually physically damaged...

Use this command instead:

dd if=/dev/sdxn of=/path/to/output.img conv=noerror

The conv=noerror will make dd skip over any areas that it cannot read. Zeros will be written instead. Note that if the partition is physically damaged, reading it may be extremely slow. As I am writing this answer, I'm holding a 20.0 GB Western Digital Caviar manufactured on 02 June 2000. It failed starting around the 18.2 GiB mark, and dd grinded almost to a halt while trying to read past that point.

EDIT (2012/06/28 23:17 UTC): violet313 brought up a good point in a comment. You might as well read a damaged disk to recover data because you'll have to read the data sooner or later. Hard drive recovery by physically tampering with the insides is costly, like this service here.

If dd fails to recover the data you want, consider trying a more aggressive tool to recover your data: ddrescue.

Improve this answer
5
  • yes, sry for wasting your time,, when i wrote sdx i actually meant sd<*whatever*> ~since i imagine this question to be of more general use than just solving my specific.
    – violet313
    Jun 28, 2012 at 22:57
  • No, I'm sorry for the confusion. I also meant to point out the /dev/ part right after if=. That directory contains the devices, which you had left off in your question.
    – Deltik
    Jun 28, 2012 at 22:59
  • ok,yes good point, i will edit ;)
    – violet313
    Jun 28, 2012 at 23:00
  • cool. so how about the second part of the question ~is cloning the partition using dd & attempting a restore from the clone the best approach? eg: are there some s/w that can do something more with the original sectors ? also before i press ahead, are you absolutely sure about the non-destructive read ? eg if it was a damaged disk any kind of read is potentially destructive..
    – violet313
    Jun 28, 2012 at 23:13
  • sry, to keep hassling you & labouring the point & so on (it's my fault for not being clear enough in my question ~will now re-edit). but i think your 23:17 edit is dubious; if a disk is damaged, there is a very real possibility that getting it to do anything, even an ordinarily non-destructive read may destroy data. -so if the data is worth paying thro the nose for, it's best to stay well clear of it.
    – violet313
    Jun 28, 2012 at 23:47
1

Sorry that I'm 10 years too late (and maybe this option didn't exist then). This thread did show up in my search though. And dd is super intimidating.

Best Answer for 2022: Use ntfsclone.

https://manpages.ubuntu.com/manpages/jammy/man8/ntfsclone.8.html https://manpages.ubuntu.com/manpages/jammy/man8/ntfsresize.8.html https://edoceo.com/dev/ntfsclone-transfer-windows

Example usage:

ntfsclone --save-image --output /mnt/storage/windows.ntfsclone /dev/sda1

ntfsclone --restore-image --overwrite /dev/sda1 /mnt/storage/windows.ntfsclone

Note: ntfsclone does not clone unused sectors and therefore it's not a good tool for recovering deleted files. My use case and solution fits the title of this thread, but not the OP's actual problem.

Improve this answer
3
  • Maybe that's what he wanted, 10 years ago. TLDR. But the subject title is what brings visitors to this ancient thread today, and I think they'll be happy with my solution.
    – p.elsie
    Nov 23, 2022 at 2:18
  • ntfsclone also has a "rescue" option. So, it might be useful for recovering files, albeit probably not "deleted files" like the OP use case. At the bottom of the ntfsclone manpage is a link to the NTFS-3G driver wiki. There might be another tool in the NTFS-3G suite that's perfect for the need of the OP.
    – p.elsie
    Nov 23, 2022 at 2:55
  • 1
    @KamilMaciorowski, I've added a disclaimer as you suggested. Thanks for the feedback!
    – p.elsie
    Nov 23, 2022 at 15:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .