Recovering external harddrive with ntfs

pippet · 05-30-2013, 03:10 AM

Hi,
We have a WD 2TB external harddrive which failed recentely. We decided to make a copy of the failed drive and fix the copy.
We have another 2TB external hdd. The strange thing is that the size of the two - 2TB hardrives are different in the fdisk listing.

Code:

fdisk -l
Disk /dev/sdb: 2000.4 GB, 2000365289472 bytes
255 heads, 63 sectors/track, 243197 cylinders, total 3906963456 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x38d65ad7

   Device Boot      Start         End      Blocks   Id  System
/dev/sdb1              63  3906959804  1953479871    7  HPFS/NTFS/exFAT

Disk /dev/sdc: 1999.7 GB, 1999664930816 bytes
255 heads, 63 sectors/track, 30389 cylinders, total 488199446 sectors
Units = sectors of 1 * 4096 = 4096 bytes
Sector size (logical/physical): 4096 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes
Disk identifier: 0x38d65ad7

   Device Boot      Start         End      Blocks   Id  System
/dev/sdc1              63  3906959804  2742937080    7  HPFS/NTFS/exFAT

/dev/sdb (failed drive) is 2000.4GB and /dev/sdc is (where I want to copy) is only 1999.7 GB. It has a virtual CD in it which I couldn't get rid of.
An image copy of the drive using ddrescue was done.

Code:

ddrescue -f --direct --max-retries=10 /dev/sdb /dev/sdc rescue.log

Naturally, it copied 1999GB and threw an 'out of space error'. Windows couldn't recognise it as a ntfs drive, where in fdisk listing in ubuntu listed it as a NTFS partition. Anyway,when tried to mount, it threw an error that it doesn't contain ntfs.

I was hoping that sectotrs that are not copied could be neglected some way, and a part of data can be recovered from the copy. The plan was to run the chkdsk on the copy drive, without touching the original.

Is it possible in some way?

Thanks,
Pippet

syg00 · 05-30-2013, 05:51 AM

Nope.

ddrescue only worries about the used sectors, but you need to get a device big enough to contain the entire image. NTFS keeps a second copy of the MFT at the end of the partition, and I suspect looks for it to ensure it's a valid filesystem.

These days the "filesystem" flags in the partition table are useless - it's the integrity of the filesystem that's important. You may be able to get some forensic tools for NTFS (for a price) - some posters have mentioned success on threads I've seen here in the past.

jefro · 05-30-2013, 03:19 PM

Kind of depends on what has failed.

In order to not touch the original you may be able to just take an image compressed to a file to some known good storage. Then you might be able to mount it to use tools on the image. Tools like testdisk. Might be able to compress it to a windows format to then try windows tools.

In most cases you need a good copy of a working drive to trust the data.