21

I have a set of files that mostly end with numerical extensions [sda2.000, sda2.001, etc.], which makes me think they are some kind of bulk backup of a drive. I have not been able to find any information about what software created these by searching on the web, using 7zip to open file sda, which showed two files with a .ntfs extension (7zip couldn't do anything with the other files).

What are these files and how do I read them?

that shows the files in a Windows file browser.

  • 2
    Those are data dumps from two partitions, sda1 and sda2. Without knowing the program the dumps are from (likely a recovery or imaging program), the format can't be determined (they could be RAW dumps or data dumped from dd, etc.) – JW0914 Aug 20 '20 at 12:13
  • Someone with more knowledge than I will need to confirm/reject, but you could try using dd [examples] to write those dumps to an image file, then try mounting it [on Linux]. I'm not sure if testdisk would be able to make sense of them or not if they were dumped to an image file and written to USB drive – JW0914 Aug 20 '20 at 12:35
38

These are chunk files. The original file was split into 645 MB chunks so they fit on a CD. They don't make any sense alone. You have to concatenate them in correct order (by ascending extension) to get the original file.

In the *NIX world the splitting could be performed using the split tool (split -b 645M original.file) and original file could be recreated with cat and output redirection (cat original.file.* > original.file).

There's not much one can say about the original file just with the knowledge that it was split, but your folder looks like you're dealing with some kind of disk images created using Linux-based tool (sda = first disk supported with the sd driver, sda1 and sda2 are its first two partitions).

What I think 7-Zip is doing here is it recognizes your chunk files and tries to interpret them concatenated as a whole. Apparently the format is supported (or partially supported) and indeed there's a disk image inside containing a NTFS filesystem.

The "HDD_Look" file has quite a distinctive name, so I've googled it and found this forum thread. Apparently it's a disk image created by PING software, which is an obscure Linux-based disk imaging tool. It's probably using some specialized imaging software under the hood, like partclone or ntfsclone or possibly simply dd. Your file are slightly over 8 GB total and dd would produce an exact byte-for-byte copy of the partition, so I'd expect the image to either be significantly larger or be a multiple of 1 GB +/- 1 MB, so I'd rather guess it's one of the former ones. The file utility on Linux may be able to tell you more.

  • Thanks for the info! I will try these tips later today and respond with what I am able to accomplish. – Mark E. McDermott Aug 20 '20 at 12:50
  • 2
    Well, apparently a long time ago I used PING to backup a drive. According to this blog 8bitmammoth.com/… PING uses partimage as its backend so I will try reading the files using that. I don't have access to a machine right now to perform the read but I am marking this as the answer because after looking through all of the files I think you were right-on about PING. – Mark E. McDermott Aug 20 '20 at 21:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.