0

The hard drive on my laptop has been giving me read errors, so I decided to back up the data on it.

I decided to use ddrescue to recover the data on the main NTFS partition. I first created a partition of a size slightly greater than the one I wanted to recover (about one or two Gb greater). After more than two days of non-stop copying with around 400 read error messages, ddrescue had finished.

When I tried to mount the partition however, I read

mount: wrong fs type, bad option, bad superblock on /dev/sdb1,
       missing codepage or helper program, or other error

I checked dmesg as was advised but could not find anything pertaining to the device besides the point where it was plugged in, only audit messages.

I then ran ntfsfix, with output:

FAILED
Attempting to correct errors... NTFS signature is missing.
FAILED
Failed to startup volume: Invalid argument
NTFS signature is missing.
Trying the alternate boot sector
Unrecoverable error
Volume is corrupt. You should run chkdsk.

I then attempted to run chkdsk on the partition. The output was as follows:

The type of the filesystem is RAW.
CHKDSK is not available for RAW drives.

I thought this would mean the partition is not formatted, which would be odd since the partition it was copied from was. To investigate this, I used cmp on both the device descriptor of the original partition and of the copy, and found they differed in the first byte.

My question is, what should I do to recover the data from my hard drive?

  1. Is there a specific operation I should do on the recovered image?
  2. Should I try to use ddrescue to recover the partition again, or even the whole drive?

And additionally, I would be interested in insight into what caused this issue in the first place.

Improve this question
5
  • Backing up the contents of that partition to a known good drive is a better option than what you're trying to do. But if you insist on it then read this and compare with what you did: technibble.com/guide-using-ddrescue-recover-data
    – ChanganAuto
    Jul 17, 2022 at 23:35
  • Should I use cp or is there a specific command for this purpose? I thought ddrescue was effectively doing that, just with added precautions for failing drives.
    – blevruz
    Jul 17, 2022 at 23:41
  • 1
    Quoting: If there are any, it is possible that the damage could be enough to render Windows unstable when cloned to a new drive, depending on where the damage is. Sometimes running CHKDSK and SFC on the new drive afterwards will take care of it, sometimes not. It’s a judgment call at this point. If the errors are significant, you may be better off proceeding with a fresh Windows install and a data transfer/recovery from the rescued image
    – ChanganAuto
    Jul 17, 2022 at 23:41
  • I see, it is possible that this image is corrupted. I can still access the old drive and boot on it; I will try to copy the data again, as I may have written to a block (something like /dev/sdc1) without -f. This post seems to suggest dd would not be an appropriate choice, so I'll try ddrescue again, but I am open to other options.
    – blevruz
    Jul 18, 2022 at 0:11
  • Using ddrescue again, but this time with -f solved the issue. Thank you for your help!
    – blevruz
    Jul 24, 2022 at 1:02

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy