I had a 200 GB external USB formatted under windows xp ntfs go bad on me. It was just used for storage with only 1 partition. I'm new to linux but was able to use knoppix 5.1 and figured out how to get ddrescue 1.6 installed and working. I was able to rescue the entire disk using the following: ddrescue -B -n /dev/sdd /dev/sda2 recused.log. sdd was the usb and sda2 was a new partition on an e-sata drive. The one thing I think I screwed up was that the new partition on sda2 was not exactly the same size as the original. Can I still use what I have rescued or should I start over with a partition that is exactly the same size? The other question I have is is it better to rescue the data as an image vs an exact disk copy? From what I've read online the opinions seem to vary.

Thanks for any help,
Kevin

Speaking from a Forensics point of view I always make images to file. This way it's easier to make a copy of the file (for safekeeping: don't work on your only backup) and do ops on it (like carving for stuff). Obviously you also bypass the probs with partition sizes and that. Also note there's tools called 'dd_rescue' and 'dcfldd'. Last time I used 'dd_rescue' for recovery IIRC. BTW what does "go bad on me" mean in your book? Ticking noises like the HD's heads are wonky or what?

It never made strange noises but I could not read the drive at all in windows or knoppix. It always came up as an unformatted drive but I never did anything to it that should have caused it to be wiped out. It initially had I/O errors and would not get recognized at all using USB. I tried the fire wire port and was able to see it in windows but it said it was not formated. I tried every file recovery program I could find but the only one that worked was Photorec which did retrieve some files but stopped at a certain point probably due to bad sectors or something. ddrescue found 5000+ errors. What is 'dcfldd'?

That would be the kind of valuable information to mention in an original post next time.


All I/O errors? Please don't talk *about* errors but *post* some.


What are them WWW searchengines for?

Hi Matistimo, have your tried NTFS Data Recovery Software. I had success using this utility in recovering my lost data after I had accidentally formatted my partition. You can use the demo version to see whether the software is able to recover your files or not, if you can see the data you are looking for then you can go for the full version. Since you have only one partition I recommend you to download the demo to other healthy system and connect your external hard drive from which you wish to recover the data as a slave. Hope you get back your lost data very soon.

Aylen.

The SW mentioned is commercial, a license starts at USD 99. I'd suggest exhausting all relevant OSS options first.

I'm with unSpawn, however I have to say I've had little success recovering trashed NTFS. I have sufficiently good backups to get me out of holes, but I've been asked to help others; without success.
NTFS is a proprietary can of worms, marketed by a company of ... well, you get the idea.
If a commercial product ultimately does the job, I see no problem paying for it.

It depends on how you approach the case, the state of the filesystem and the tools you use. Using a mix of OSS and proprietary tools, often as a means of validating results for evidentiary purposes, I found some tools to be more equal than others ;-p I have no problems using commercial tools but just because a tool is a commercial product does not per definition mean it is "better" in every aspect compared to OSS counterparts.