Recovery of partition within file

shakezilla · 10-20-2008, 01:18 PM

I have a ~250GB file on an ext2 installation of Ubuntu. Within this file is a partition of an ntfs win install. I believe I know the offsets for the partition, I just need to get at it somehow.

So one of two things. I either need a way to split the file into arbitrary sections in place, or I need a way I can use mount on a particular segment of that file.

Any help would be appreciated. Didn't know where to ask this, so if any admin thinks it needs to be somewhere else, please move it.

Besides Ubuntu, I can use whatever you recommend, Knoppix, Slack, etc. Thanks

pixellany · 10-20-2008, 02:56 PM

I don't know what it means to have a partition within a file---unless you mean a partition image. To help us understand the total picture, please post the results of:
fdisk -l
df

shakezilla · 10-20-2008, 03:19 PM

I have a regular file on a 320GB disk. This particular file is itself a straight disk image of a 250GB disk, complete with MBR (corrupted) and 2 partitions.

The thing is I need to mount one of those partitions and retrieve data, but since MBR is corrupt, it isn't as simple as just plugging in and using mount as usual.

I got the MBR off of another machine of the same model, so theoretically, I should know exactly where the desired partition is within this image file. I just need to know how to access that middle chunk of the file.

Thanks and I'll give any more info you need, though I'm not at the machine in question right now.

i92guboj · 10-20-2008, 03:33 PM

If you really know the offsets, I guess you should be able to use dd to dump a image of the partition into a new file, that file should be mountable using a loop device I think.

shakezilla · 10-20-2008, 04:02 PM

Yeah, but I don't have enough scratch space on that drive to write out to a completely new file.

This was my mom's Compaq, and of course they have the dumb "recovery partition" at the end, which should be a bare install of a few gigs. So the target partition is likely around 240 some odd GB. I'd give you exact numbers if I had the data handy.

Maybe I'm not explaining well, but here's a picture:

Code:

  mom's disk (vista, 250GB)              my disk (ubuntu, 320GB)
+------------------------+  ----+      +------------------------+
|     MBR                |      |      |     MBR                |
|------------------------|      |      |------------------------|
|                        |      |      |                        |
|     Main Partition     |      |      |     Main Partition     |
|       (ntfs)           |      |      |       (ext2)           |
|                        |      |      |                        |
|                        |      |      |    Image file(250GB)   |
|                        |      +--->> |   +---------------+    |
|                        |             |   |    MBR        |    |
|                        |  -------->> |   |---------------|    |
|                        |             |   | Main Part     |    |
|                        |  -------->> |   |               |    |
|                        |             |   |               |    |
|                        |  -------->> |   |---------------|    |
|                        |             |   | Recovery Part |    |
|------------------------|    +----->> |   +---------------+    |
|     Recovery Partition |    |        |                        |
|                        |    |        |                        |
+------------------------+  --+        +------------------------+

I need to somehow mount that middle section of the image file, preferably without having to write it out to a new file.

So is there any way to do this without having a >500GB drive to use as scratch space? I have a 640GB, but it's not really convenient to use it, and I really don't wanna have to if there's an easier way.

Thanks

btw, for those who have to deal with vista, beware of the service packs, that's how my mom got into this mess in the first place. That and not backing up. But hey, it's mom, what are you gonna do?

shakezilla · 02-27-2009, 02:38 AM

Replying to let everyone know what I figured out.

I never got mount to get at just a section of the file. So I ended up having to just copy the whole file to the beginning of my other HD. (And there was much backing up to be done. And lo, many dvds were burned.)

As a side note, I ended up having to use getDataBack ntfs to recover. How well did it work?

Well, first, the program must be installed onto a windows install, but it is perfectly capable of running from ubcd4win. Runtime even has a plugin for it, but I just installed it to the B: ramdisk, and it worked fine.

It found a ton of files. And LOTS were dupes, so you have to be careful when restoring. I'd say only around 10% of the files were not corrupted. I can't say if the image in question was just super p0wned, or if this is a deficiency in getDataBack. If all those files really were that corrupted, that means that vista sp1 seriously b0rked my mom's drive.

The software is $80 USD, so if you're considering buying it, I would download their trial first. The trial will let you see what files it finds, you just won't be able to back them up. But if you have to stop and exit your windows live, you can save the found file list so that you don't have to scan the HD over again. Alternatively, you can just buy a license from another machine, then take it to the machine being recovered, as you can register the software at any point during the restore process.

unSpawn · 02-27-2009, 03:15 AM

I don't think you would have needed to buy software. You could have loopmounted the file. If you knew the offsets then you could have loopmounted the partitions because 'losetup' allows you to specify offsets. Without MBR and PT data you could have used 'testdisk' to find out. And while making filesystem contents visible mounting it with ntfs-3g is preferable, even in place carving with 'photorec' or 'foremost' (or pyFLAG or TCT) should work.

shakezilla · 02-27-2009, 04:35 AM

Wish you were here earlier

I'll be looking into testdisk, thanks for the info.

okos · 02-27-2009, 06:51 PM

If I understand you correctly, you made an image of your mom's hdd and copied it on to your hdd. Then tried to access the image on your computer.

The mbr was corrupted on your moms computer so it would no longer boot.

Couldn't you access the files on your mom's computer using a live cd such as knoppix? I believe it has ntfs-3g.

Also, if the mbr is corrupted mounting it as a loop probably would not work either.

Testdisk works rather well to recover files and it is FREE. I used it in the past.

shakezilla · 02-27-2009, 06:59 PM

I originally tried using both knoppix and slax on my mom's machine, but neither could mount the partition, even after restoring the known good MBR. Which I guess means that the file system was too corrupted for mount to handle.

But you're correct, if I had known about testdisk at the time, I could have used it.

okos · 02-27-2009, 09:52 PM

Quote:

Originally Posted by shakezilla

I originally tried using both knoppix and slax on my mom's machine, but neither could mount the partition, even after restoring the known good MBR. Which I guess means that the file system was too corrupted for mount to handle.

But you're correct, if I had known about testdisk at the time, I could have used it.

You probably did not mount it properly.
Did you try the following to mount her drive.

Quote:

fdisk -l #to find the type of device the hdd is
mkdir /vista
#Place the device name found from the fdisk -l results into <moms hdd>
mount /dev/<moms hdd> /vista -t ntfs -r
cd /vista

shakezilla · 03-01-2009, 12:48 AM

Yes, I did:

Code:

mount -t ntfs /dev/sda1 (or whatever number it was) /mnt/mom

Guess it's possible I could have screwed it up, but I'm pretty comfortable with mount.

JulianTosh · 03-01-2009, 04:07 AM

testdisk and several other nifty recovery utilities are included in the "Recovery Is Possible" Linux distro. I've had good results with this iso.