1

A while back something happened to my hard drive that wiped out the partition table and left my data unreadable. I had other uses for the drive, but I didn't want to give up on trying to recover the data, so I used dd to do a block copy of the entire drive to a file. I now have a ~30 GB file with no idea how to view let alone extract any of the data from it. Are there any tools that can peek into this file, or will I just have to do another dd back to another drive of the same size and try some recovery tools?

  • You wouldn't need to restore it a drive of the same size, it just needs to be bigger. I would be tempted to play around with try to extract things in a VM. Build a VM, add two virtual hard drives, on the first put a good rescue linux, on the second drive restore your dd backup. – Zoredache Jan 26 '11 at 1:34
  • What was the original filesystem? – Scott Pack Jan 26 '11 at 1:53
  • NTFS, which probably contributed to the crash – user65237 Jan 26 '11 at 3:39
1

testdisk is designed for exactly your use case. Point it at the image file, follow its prompts, and it does an admirable job rebuilding partition tables. http://www.cgsecurity.org/wiki/TestDisk

It's open source, and is a widely recommended tool for partition recovery in digital forensics.

0

Assuming you're on Linux, use mount with -o loop like this:

mount -o loop /path/to/image /mnt/mountpoint

  • That would work, if he used dd on the partition, and not the entire drive. If he has the entire drive, he most likely would need to specify an offset. In trashing the partition table he also trashed start of the filesystem, then things may be a lot more difficult. – Zoredache Jan 26 '11 at 3:22
0

You can try the software ZAR, Zero Assumption Recovery.

Someone accidentally wiped NTFS partition on a Macintosh computer and the MBR was most likely deleted but not the whole partition, I was able to recover everything, it took few days but it saved my day.

It is inexpensive software: $50 and was better then Ontrack EasyRecovery Professional and many other software which were a waste of time.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy