how to extract files from a dd_rescue image

Question

Hi , I have been able to create an image of a disk that had a lot of bad sectors . After few days of dd_rescue i eventually get almost all my data back. My partition is a ntfs filesystem . I have been able to mount the partition under linux ( via mount or loopdev ) but still wondering how to copy the valid files to another disk ( so skipping only the wrong ones ).

Is it possible to run a chkdsk under linux on a image file ?

Can we also identified the missing files from le logfile generated from ddrescue ?

Thx

Answer 1

chkdsk should be windows native. You could try and run forensic or data recovery software. There are some free ones. ( I user a commercial one - EnCase) "The Sleuth Kit" http://www.sleuthkit.org/ (run on linux)

DiskDigger is a recovery software ( not free though )

The logfile of dd only would show which sectors had read errors. You would have to cross-reference this with the forensic tool. Data recovery tools usually do not give you a data view that will allow you to resolve the sector-> file query.

Answer 2

If you can mount the disk under Linux, then all you need to do is use the "cp -r" command to copy all of the files off the corruption partition. Some of the files will copy, some of them won't.

Depending on where the disk corruption is, you may have remaining files that can't be reached through the MFT because portions of the MFT are missing. Those you will need to recover using file carving. Depending on the file types, you can use a tool like photorec or Adroit Photo Recovery. You will then take all of the files recovered through carving and suppress those that were already recovered by mounting the disk.