any way to mount partial raw ntfs images?

Question

I have a raw image from ddrescue which is a partial image of the complete source NTFS partition, simply because the target drive is smaller then the source.

I cant mount this partial image so as to copy over the files.I get this error:

Failed to read last sector (3905654783): Invalid argument
HINTS: Either the volume is a RAID/LDM but it wasn't setup yet,
   or it was not setup correctly (e.g. by not using mdadm --build ...),
   or a wrong device is tried to be mounted,
   or the partition table is corrupt (partition is smaller than NTFS),
   or the NTFS boot sector is corrupt (NTFS size is not valid).
Failed to mount '/dev/loop0': Invalid argument
The device '/dev/loop0' doesn't seem to have a valid NTFS.
Maybe the wrong device is used? Or the whole disk instead of a
partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?

Command that i am using:

sudo mount -t ntfs /image.img /mountpath -o loop

Is there any way by which i can recover data contained in this partial image file?

Answer 1

I was able to mount a partial NTFS image file in a (Windows) VM as a RAW disk, which then allowed me to run data recovery software on it.

1. Based on this comment I used xmount to mount the image with a separate write cache to preserve the rescued data. I used the raw/dd mount.
2. Based on this answer I managed to create a vmdk disk image from the partition image. I created a new disk device in VMware Player using a physical disk (it doesn't matter which, it will be changed). Then I edited the created vmdk file and changed the extent description part like this:

RW 2048 FLAT "parttable.bin" 0
RW 767039487 FLAT "/mnt/NTFSImage.dd" 0

The first line refers to a file we'll create next. The second line points to the partition image, the xmounted version of it. The first number in each line refers to the size of the chunk to read from that file in sectors (a sector is probably 512 bytes).

3. I used dd to create a 1 MB file for the partition table in the VM's directory:

dd if=/dev/zero of=parttable.bin bs=1M count=1

4. I booted up the VM with the virtual disk and created a new primary partition. You can do this either with diskpart or Disk Management. Just make sure the offsets are correct (1 MB or 2048 sectors for the partition), though that's the default.

Do not format the created partition. That would destroy the file information, though only in the cache file. If you had a working filesystem image, it should recognize it right away. I don't know how Windows handles if it can't find the end of the filesystem but in my case I was able to run recovery software to scan for files.

Answer 2

I'm trying to do the same thing, mount partial raw ntfs image or try to rescue files from partial ntfs dump from ddrescue.

List of tools I plan to test (first make a copy of rescued image and play with the copy):

• testdisk [1]
• ntfsfix [1] [2]
• fsck tool

  fsck.ntfs -y image-copy.img

• sleuthkit [3]
• photorec [4]

1. http://ubuntu-rescue-remix.org/node/71#comment-111
2. http://linux.die.net/man/8/ntfsfix
3. http://www.sleuthkit.org/sleuthkit/index.php
4. http://www.plug.org/pipermail/plug/2009-January/019942.html