Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 1 down vote favorite

A while back something happened to my hard drive that wiped out the partition table and left my data unreadable. I had other uses for the drive, but I didn't want to give up on trying to recover the data, so I used dd to do a block copy of the entire drive to a file. I now have a ~30 GB file with no idea how to view let alone extract any of the data from it. Are there any tools that can peek into this file, or will I just have to do another dd back to another drive of the same size and try some recovery tools?

share|improve this question
You wouldn't need to restore it a drive of the same size, it just needs to be bigger. I would be tempted to play around with try to extract things in a VM. Build a VM, add two virtual hard drives, on the first put a good rescue linux, on the second drive restore your dd backup. – Zoredache Jan 26 '11 at 1:34
What was the original filesystem? – Scott Pack Jan 26 '11 at 1:53
NTFS, which probably contributed to the crash – j.rightly Jan 26 '11 at 3:39

3 Answers

up vote 1 down vote

Assuming you're on Linux, use mount with -o loop like this:

mount -o loop /path/to/image /mnt/mountpoint

share|improve this answer
That would work, if he used dd on the partition, and not the entire drive. If he has the entire drive, he most likely would need to specify an offset. In trashing the partition table he also trashed start of the filesystem, then things may be a lot more difficult. – Zoredache Jan 26 '11 at 3:22
up vote 1 down vote

You can try the software ZAR, Zero Assumption Recovery.

Someone accidentally wiped NTFS partition on a Macintosh computer and the MBR was most likely deleted but not the whole partition, I was able to recover everything, it took few days but it saved my day.

It is inexpensive software: $50 and was better then Ontrack EasyRecovery Professional and many other software which were a waste of time.

share|improve this answer
up vote 1 down vote

testdisk is designed for exactly your use case. Point it at the image file, follow its prompts, and it does an admirable job rebuilding partition tables. http://www.cgsecurity.org/wiki/TestDisk

It's open source, and is a widely recommended tool for partition recovery in digital forensics.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.