Hey people, I want to use dd to copy a specific part of the hard drive into a specific partition on another drive.

Here are the details. I have a laptop with multiple partitions with different OS's on them. Sometime ago I managed to destroy the mft record (that is the Master File Table in ntfs partitions) on one of my larger partitions (the backup mft is gone too). Now this partition is full of data but I have no index to know where each file starts and ends.

Anyway, my plan was to copy the first three partitions (boot, the mft-less one and the next) onto another harddrive and try various recovery options on a copy of the data just in case I cause more damage.

The other harddrive has lots of space onto the first partition (probably the second partition if you count the boot) and then there is a debian installation (my main OS) after that. I want to put the first three partitions from the damaged drive in there. So it is something like sda1,2,3,4 to sdb2.

I'm sure dd is the way to go but I don't know how to use it to copy multiple partitions one after the other. I would also like a way to see the names of each partition (sda1 sda2 etc) and their contents before I copy them cause I am not sure which one is 1 and 2.

Also, is there anyway I can specify a particular point up to where dd is going to copy? I mean something like a custom data chunk instead of copying partitions. That would be of help as well. Thanks.

This will probably not answer all of your questions, but maybe you will be able to get a start on what you are wanting to do.

First you will want to mount /dev/sdb2 somwhere. Depending on the partition type of sdb2 it might look something like this:

The below example will create an image of /dev/sda1 and place it on the root of sdb2, the image name is sda1.img.

You can work with the image, you can mount it if you would like.

This is an excellent way of saving partitions. It's also a good if lengthy way of cloning disks. You can specify the number of blocks to copy but with disk partitions this dodgy as windows scatters files all over the partition. I have no idea how you will recover a MFT in such a poor condition though.

Good luck.

Hello Katto,

when you are doing fdisk -l (as a super user), are u able to see ur damaged disk???

"I have no idea how you will recover a MFT in such a poor condition though."

You can use the defragment software first then resize the partition, if you want, and then you can use dd to work with the right size partition.

Once you get a copy you can play with, you may want to try using a recovery tool that is designed to find file scraps on corrupt drives/partitions. I use a program called Restorer2000Pro (windows program). I have frequently used it to recover files from drives that no longer boot. I have never tried it on a drive with a trashed MFT, but according to the documentation it can find files with no file table. I would be interested to know if it actually works like they say it should.m If you don't want to buy the program, send me a copy of the trashed partition and I'll run my copy on it to see if it works. If so, let me know and I'll give you a pointer to an FTP site to copy the partition image.

Thanks for the replies guys. The situation with the MFTs is a bit complicated so I will give out a few more details.

I had a triple boot laptop (vista,xp,ubuntu), with 8 partitions in total. 3 or 4 of these partitions were put there by the manufacturer (hidden recovery partitions and crap like that). At some point I wanted to expand my xp and ubuntu partitions and shrink the vista one (I was using that as storage space). I used Acronis disk director for that. Somehow though, Acronis messed up during the process and destroyed the main MFT of the Vista partition. When I used some recovery program for damaged filesystems it found a damaged MFT (main MFT) and the backup MFT (at the end of the partition) missing.

How am I supposed to recover the MFT? Well, acronis messed up the boundaries between the vista partition and the next one which was a hidden recovery partition of some sort. There is a very good chance that the missing MFT is beyond the new partition boundary, lost but safe.

Thats why I need to clone at least the first 4 partitions and run recovery stuff on the clone. At some point of the 'recovery process' I managed to install a new ntfs system on top of the damaged system by mistake but this still leaves the lost MFT intact (I hope).

lewisforlife: thanks thats almost what I am looking for. Only that I want to make an exact copy of the first disk onto the other. Mounting the clone is good but not ideal.

rayfward: so is there a way to copy say from block 134 to block 35564? This would be great as I would be able to copy the precise part of the disk with the problem. And I would be able to extract the unproblematic partitions off of it. If I manage to save the partition I will post all the juicy details.

Abhishek Kumar Singh: yes thats what I was looking for thanks. I can see the partition and I now know the name (sda3).

fatmystic: I don't think that you can use a defragmenter on an ntfs partition without an mft. The defragmenter would need the mft to know where each file starts and ends to move them around the disk. IF you could do that though you would destroy the underlying data since, without an mft you wouldn't know where anything is. I hate NTFS.

leiphasw: The kind of program you are talking about does recover some stuff, mainly photographs, documents, maybe some mp3s and stuff like that. The problem is that when a partition is fragmented, the program will be able to recognise a specific type of file and where it starts but it will have no way to know where it ends if it is cut in half (fragmentation). So you end up with useless txt files with fragments from html files, .doc files, anything that contains plain text essentially and lots and lots of photos cut in half. That's not just theory, I have already tried a recovery like that. The photographs don't come out bad however, they are mostly ok if they are not above 3 mbs each.

Also, how do you multiquote on this forum?

i think instead of dd you cat will be more usefull in this situation as you need t multiple partitions to one i think cat will be the way to go simply run the following commands assuming sda is the source drive with parts 1,2,3,4 and adb is the target and u need to copy all the partitons on sdb2

cat /dev/sda1 >> /dev/sdb2
cat /dev/sda2 >> /dev/sdb2
cat /dev/sda3 >> /dev/sdb2
cat /dev/sda4 >> /dev/sdb2

though i never got a chace to test it but i think this should work
:-)

Are you sure?

OK, so if you are able to see your partition i think dd can help you at this stage..
I'm telling you few tricks just try it out, and let me know if it works or not...

In this solution we'll first create a empty filesystem which we can later mount to access our files

dd if=/dev/zero of=temp_fs.img bs=1MB count=0 seek=1024

This will create a blank image file with name temp_fs.img of size 1GB (seek represents size of your blank file)
keep seek value 1GB for now. If this trick works then you can increase the seek value to your sda3 size value.

Now, as i understood, your corrupted partition is ntfs..
Now, sudo apt-get install ntfsprogs
this will install mkfs.ntfs, which will allow you to create ntfs filesystem.
then
mkfs.ntfs -F temp_fs.img

This will create a ntfs filesystem on your blank file temp_fs.img

now, mount this filesystem
ntfs-3g temp_fs.img /mnt

then use dd command

dd if=/dev/sda3 of=/mnt

i think this will solve your problem. if not just tell me what did you get after this...
http://ubuntuforums.org/showthread.php?t=847318

i am not sure but cat can be used to clone disks in some cases like your dd can prove extremely distrctive just try it if it doesnt work let me know

First of all, thanks for trying to help, I appreciate it.

I don't think this will work. By mistake I have already installed a new ntfs filesystem on the destroyed partition. It appears blank. The data however are undisturbed underneath, I just need the old mft to access them. A new ntfs system would have a new mft which would be completely blank and the data would remain lost.

What I need is a way to copy the first three partitions of a disk to another disk for further testing. I must use dd for this as it reads the data on the disk directly and doesn't rely on the file system. I' guessing that cat would not work for this but I'm not ruling it out.

I haven't tried anything yet cause after starting this thing I will be left without a computer and I need it for studying. I will start testing stuff (including the cat command) after I have a way to copy the first three partitions.

Many thanks so far guys.

You can use Test Disk to restore partiitons.
http://www.cgsecurity.org/wiki/TestDisk

You can use Photo Rec to find deleted files.
http://www.cgsecurity.org/wiki/PhotoRec

These utilities may be available in your Linux distribution. They are also available in the System Rescue CD distribution.
http://www.sysresccd.org/Main_Page

1 members found this post helpful.

Oh man,

I was just going to say to use photorec..
Just a small story about photorec. I had this client that had been carrying around this old computer for at least 10 years. A friend of his tried to upgrade his Windows ME to W2k and wiped out all his data. I hit the disk with photorec and recovered almost twice the amount of data the drive could hold. I recovered the NTFS stuff, and the FAT32 stuff, even things he had deleted and thought gone for good were returning from the grave. Now the bad news about photorec, all the filenames were changed to letter/number combinations, so deffinately go thru the files in your linux distro.

Snarkster

I've used portable recuva from piriform on a physically deteriorating compactflash card (fat16, afaik). it found all the damaged files with filenames, plus some long before deleted (no filenames, but undamaged).

i didn't read all of this thread thoroughly, but i guess you want to clone the partitions, so you can recover from the clone? (therefore leaving unoriginal "least touched")