I want to recover some deleted files from a healthy NTFS partition on an undamaged hard-disk.
In order to leave the partition undisturbed, i plan to use
dd to clone the partition to a raw image file & then attempt recovery from that mounted clone.
dd if=/dev/sd<xn> of=/path/to/output.img perform a non-destructive copy ?
Is attempting a restore from a clone using
dd the best approach?
[edit, wrt Deltiks answer, i need to be a bit clearer about what i'm asking]
eg: are there some s/w that can do something more with the original sectors ?
eg: if it was a damaged hard-disk i am aware that any kind of read is potentially destructive. but assuming my disk head is not going to suddenly spaz out etc, am i reducing my chances of a successful recovery (at any cost) by using an apparently non-destructive single read of my undamaged hard-disk.
(btw: i am planning on using
testdisk for recovery)