Sanity check and advise on recovery please
As a new user of both Rescue Remix & linux could you knowledgeable people sanity check my results and see if i'm barking up the wrong tree please.
I have successfully created an image of my non-booting winXP 250G non-partitioned disk onto a second disk, using ddrescue run from the Ubuntu Rescue Remix on CD.
The aim is to retrieve my photos, mp3s, openoffice files, pdfs and so on from it. I’m not sure of all the files and would preferably like to browse and pick the files to copy.
This is the log file when finished:
# Rescue Logfile. Created by GNU ddrescue version 1.11
# current_pos current_status
# pos size status
0x00000000 0xA27DEE000 +
0xA27DEE000 0x00001000 -
0xA27DEF000 0x12C47DA000 +
0x1CEC5C9000 0x00001000 -
0x1CEC5CA000 0xCCB485000 +
0x29B7A4F000 0x00001000 -
0x29B7A50000 0x107D844400 +
For some reason that doesn’t show the command line, which was:
sudo ddrescue –r 3 /dev/sdb image250 log250
Thinking it would be easiest to access the image in a normal manner hopefully with its directory structure pretty intact, I eventually managed to mount the image, using the commands:
sudo /sbin/losetup –fs image250 –o $((512*63))
sudo mount –t ntfs /dev/loop1 mnt
So now I can delve into the image using a file manager (now running standard Ubuntu as a live CD in order to have a graphical interface). Unfortunately only about 30M of the original 200G filesystem is there, and none of the desired files.
I don't want to resort to data carving tools yet if possible. These may miss files or filetypes I want, and seem to mass dump all jpegs for example in one directory which would take a lot of time to sort through. (Also I did interrupt a quick go with foremost, but the picture files output seemed too small and wouldn't load.)
So my questions are :
1)Is that hex 1000 = only 4096 bytes for each of only 3 problem areas marked minus in the logfile? I take it the image is almost completely good data as a disk, but rubbish as an intact filesystem?
2)Is there any point doing another ddrescue on the source disk to try and improve the image (what commands), or has it overwhelmingly correctly retrieved what's on it?
3)How do I try to repair the filesystem: put the image back onto a new real disk, or work on the mounted image? Will boot repair help see more of the filesystem? Which tools might help? Ntfsprogs (ntfsfix program) and Testdisk (“Restore the Master File Table (MFT) from its backup” but what backup?) look promising, or maybe some windows utility.
Sorry for length of post, Any help much appreciated,