3

I have a raw image from ddrescue which is a partial image of the complete source NTFS partition, simply because the target drive is smaller then the source.

I cant mount this partial image so as to copy over the files.I get this error:

Failed to read last sector (3905654783): Invalid argument
HINTS: Either the volume is a RAID/LDM but it wasn't setup yet,
   or it was not setup correctly (e.g. by not using mdadm --build ...),
   or a wrong device is tried to be mounted,
   or the partition table is corrupt (partition is smaller than NTFS),
   or the NTFS boot sector is corrupt (NTFS size is not valid).
Failed to mount '/dev/loop0': Invalid argument
The device '/dev/loop0' doesn't seem to have a valid NTFS.
Maybe the wrong device is used? Or the whole disk instead of a
partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?

Command that i am using:

sudo mount -t ntfs /image.img /mountpath -o loop

Is there any way by which i can recover data contained in this partial image file?

3
  • So I guess you managed to solve your previous problem regarding how to create partial images? You should add the commands you used as an answer there. Regarding the problem at hand, have you tried to fsck the NTFS partition?
    – Karan
    Mar 5, 2013 at 4:46
  • @Karan nope.. i couldnt just say ddrescue to only create a valid 500GB image out of the 2TB partition(so thats still unresolved).. just because the target drive size is lesser.. i am going to get an image with max size that ddrescue is going to save on it(backup still going on since yesterday!). Meanwhile i interrupted once (ddrescue can resume operation) to check if i can use the resulting image,which doesnt mount!
    – ashishsony
    Mar 5, 2013 at 5:08
  • I removed references to ddrescue in title and tags, as DDRescue is really only involved in creating the image - the answer to the question is not dependant on an understanding of DDRescue.
    – davidgo
    Mar 5, 2013 at 5:08

2 Answers 2

1

I was able to mount a partial NTFS image file in a (Windows) VM as a RAW disk, which then allowed me to run data recovery software on it.

  1. Based on this comment I used xmount to mount the image with a separate write cache to preserve the rescued data. I used the raw/dd mount.
  2. Based on this answer I managed to create a vmdk disk image from the partition image. I created a new disk device in VMware Player using a physical disk (it doesn't matter which, it will be changed). Then I edited the created vmdk file and changed the extent description part like this:
RW 2048 FLAT "parttable.bin" 0
RW 767039487 FLAT "/mnt/NTFSImage.dd" 0

The first line refers to a file we'll create next. The second line points to the partition image, the xmounted version of it. The first number in each line refers to the size of the chunk to read from that file in sectors (a sector is probably 512 bytes).

  1. I used dd to create a 1 MB file for the partition table in the VM's directory:
dd if=/dev/zero of=parttable.bin bs=1M count=1
  1. I booted up the VM with the virtual disk and created a new primary partition. You can do this either with diskpart or Disk Management. Just make sure the offsets are correct (1 MB or 2048 sectors for the partition), though that's the default.

Do not format the created partition. That would destroy the file information, though only in the cache file. If you had a working filesystem image, it should recognize it right away. I don't know how Windows handles if it can't find the end of the filesystem but in my case I was able to run recovery software to scan for files.

-1

I'm trying to do the same thing, mount partial raw ntfs image or try to rescue files from partial ntfs dump from ddrescue.

List of tools I plan to test (first make a copy of rescued image and play with the copy):

  • testdisk [1]
  • ntfsfix [1] [2]
  • fsck tool
    fsck.ntfs -y image-copy.img
  • sleuthkit [3]
  • photorec [4]
  1. http://ubuntu-rescue-remix.org/node/71#comment-111
  2. http://linux.die.net/man/8/ntfsfix
  3. http://www.sleuthkit.org/sleuthkit/index.php
  4. http://www.plug.org/pipermail/plug/2009-January/019942.html
2
  • 2
    Copying a large filesystem image can be pretty time-consuming. I've come across a tool that allows you to mount an image and redirect any writes to a separate cache file so you can preserve the original image. It's called Xmount, you can find it here
    – Gogeta70
    Oct 19, 2017 at 21:20
  • LukasT, what you present as an answer does not include any proposal to solve the problem.
    – r2d3
    Apr 18, 2021 at 22:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.