Sanity check and advise on recovery please

Hi
As a new user of both Rescue Remix & linux could you knowledgeable people sanity check my results and see if i'm barking up the wrong tree please.

I have successfully created an image of my non-booting winXP 250G non-partitioned disk onto a second disk, using ddrescue run from the Ubuntu Rescue Remix on CD.

The aim is to retrieve my photos, mp3s, openoffice files, pdfs and so on from it. I’m not sure of all the files and would preferably like to browse and pick the files to copy.

This is the log file when finished:
# Rescue Logfile. Created by GNU ddrescue version 1.11
# current_pos current_status
0x29B7A4FE00 +
# pos size status
0x00000000 0xA27DEE000 +
0xA27DEE000 0x00001000 -
0xA27DEF000 0x12C47DA000 +
0x1CEC5C9000 0x00001000 -
0x1CEC5CA000 0xCCB485000 +
0x29B7A4F000 0x00001000 -
0x29B7A50000 0x107D844400 +

For some reason that doesn’t show the command line, which was:
sudo ddrescue –r 3 /dev/sdb image250 log250

Thinking it would be easiest to access the image in a normal manner hopefully with its directory structure pretty intact, I eventually managed to mount the image, using the commands:
sudo /sbin/losetup –fs image250 –o $((512*63))
sudo mount –t ntfs /dev/loop1 mnt

So now I can delve into the image using a file manager (now running standard Ubuntu as a live CD in order to have a graphical interface). Unfortunately only about 30M of the original 200G filesystem is there, and none of the desired files.

I don't want to resort to data carving tools yet if possible. These may miss files or filetypes I want, and seem to mass dump all jpegs for example in one directory which would take a lot of time to sort through. (Also I did interrupt a quick go with foremost, but the picture files output seemed too small and wouldn't load.)

So my questions are :
1)Is that hex 1000 = only 4096 bytes for each of only 3 problem areas marked minus in the logfile? I take it the image is almost completely good data as a disk, but rubbish as an intact filesystem?

2)Is there any point doing another ddrescue on the source disk to try and improve the image (what commands), or has it overwhelmingly correctly retrieved what's on it?

3)How do I try to repair the filesystem: put the image back onto a new real disk, or work on the mounted image? Will boot repair help see more of the filesystem? Which tools might help? Ntfsprogs (ntfsfix program) and Testdisk (“Restore the Master File Table (MFT) from its backup” but what backup?) look promising, or maybe some windows utility.

Sorry for length of post, Any help much appreciated,
Adam

Hi Adam. I would continue

Hi Adam.

I would continue trying to get the data back from the source. Just run the command again using the same image and same log file. Use r 99 and see what happens.

If there really is nothing more coming out of the source drive, then you can try other options.

File carving with Photorec should be fairly easy. You can specify the file types and your can easily sort the files by type and size afterwards using a few commands.

If you want to repair the image, I would make a copy of it and work on the copy. Ntfsfix won't fix a filesystem like fsck would. Your best bet is to use a Windows tool - I don't run Windows but a Windows boot/repair disk is freely available. Perhaps that would make your missing files available.

Thanks Andrew - Do you think

Thanks Andrew

- Do you think that ddrescue may have faithfully retrieved what is there, and the problem is that although the file data is present the source disk has a rubbish file table and boot sector?

This thought is because I had a go with foremost to find jpegs on the disk image, and encouragingly it recovered over 200,000 of them amounting to 7.1G. I've already got a few desired photos, though going through that lot without crashing Nautilus on a live CD seems to be an issue in itself. Also the problem drive didn't click or show overt hardware issues. Actually it did show SMART status as “Disk Failure Imminent, Reallocated Sector Count 1024 Sectors" seen via the Ubunutu live CD.

I think I'll try again to write the image to another disk and repair it. Obviously I want to get as good a disk image as possible, and will use ddrescue again if appropriate.

The source disk has the

The source disk has the correct "file table and boot sector", but they are not readable. Ddrescue is your best shot at reading them.

You have nothing to lose by continuing to run ddrescue on your image using your log. I would try that first.