Working with .img from damaged hard drive

H

Haole Boy

Active Member
Reaction score
190
Aloha fellow Technibblers! Customer called me saying he gets a "can't find boot drive" (or something like that) message. Picked up machine and booted to Mint and ran ddrescue. It took about 36 hours, but it eventually recovered about 25% of the disk to an .img file.

Is there any way to see what (if any) of the customer's data might be in that 25% that got recovered? I normally use osfmount on Windows to view the contents of an .img file, but it fails saying the drive is corrupted (no kidding). I'm hoping there is a Linux based tool that will allow me to view what got recovered.

P.S. Yes, I did determine the drive was in bad shape before running ddrescue and offered the customer to send it to a recovery services. He declined.

Mahalo for your assistance!

Harry Z
 
Haole Boy said:
Aloha fellow Technibblers! Customer called me saying he gets a "can't find boot drive" (or something like that) message. Picked up machine and booted to Mint and ran ddrescue. It took about 36 hours, but it eventually recovered about 25% of the disk to an .img file.

Is there any way to see what (if any) of the customer's data might be in that 25% that got recovered? I normally use osfmount on Windows to view the contents of an .img file, but it fails saying the drive is corrupted (no kidding). I'm hoping there is a Linux based tool that will allow me to view what got recovered.

P.S. Yes, I did determine the drive was in bad shape before running ddrescue and offered the customer to send it to a recovery services. He declined.

Mahalo for your assistance!

Harry Z
Click to expand...

in Linux:

1. To see the partitions on the disk image:
fdisk -u -l imagefile.img
This will show the sector size and a table of partitions with sector offset.
2. Multiply the start sector of the required partition by the sector size (usually 512 bytes) as reported by fdisk. That is the offset in bytes.
3. Mount the partition via the loopback device thus:
mount -o loop, offset=xxx imagefile.img /mnt

http://askubuntu.com/questions/176369/how-do-you-mount-an-hd-image-made-from-ddrescue
 
It's worth trying to mount the image as @glennd suggests.. but with only 25% I doubt much will happen. Hopefully what was recovered was somewhat contiguous and a "whole file" was actually written within that amount recovered.

Photorec the mounted image, it may see something.
 
labtech said:
Just out of curiosity - what quote range from a data recovery specialist did the customer decline?
Click to expand...
My guess, more than a few hundred bucks. Because most of the major labs really work hard at up selling and exaggerating the damage, resellers tend to just default to telling their clients that it will cost thousands. I can't speak for you, but I'd love to get the jobs that are turned down because DriveSavers, Ontrack and the likes quote too much.
 
Larry Sabo said:
@lcoughey, can I suggest that you add Dolphin Data Lab to the Hard Drive Imaging Hardware list, and ReclaiMe to the File system Recovery Software list?
Click to expand...

lcoughey said:
Updated, along with a few other additions.
Click to expand...

Thanks, Luke. I see the ReclaiMe addition but don't see DFL under hard drive imaging hardware, even after flushing browser cache.

Disregard. Now I see it: "Data Extraction (Imaging Module for Dolphin Data Lab"
 
labtech said:
Just out of curiosity - what quote range from a data recovery specialist did the customer decline?
Can install R-Studio for Linux for example.
Click to expand...

I told him $400 minimum ($300 recovery + external drive to put recovered data on + shipping).

I own a license for GetDataBack, will give that a try.

My customers are 99% residential, and are all willing to send drives off for professional recovery until they hear that magic $400 amount. Then, not so interested. Frustrates me as these are the same folks who say they don't need a cloud backup. Arrgh.

lcoughey said:
You could always try some of the data recovery programs listed in the resources.

https://www.technibble.com/forums/resources/professional-data-recovery-resources.5/
Click to expand...

Thank you for reminding me about this listing. Totally slipped my mind that it was there. I'm still getting used to using Mint, so my mindset was use ddrescue and then I'm done. Need to press reset on that thought.


phaZed said:
It's worth trying to mount the image as @glennd suggests.. but with only 25% I doubt much will happen. Hopefully what was recovered was somewhat contiguous and a "whole file" was actually written within that amount recovered.

Photorec the mounted image, it may see something.
Click to expand...

I did not know about Photorec. Do you know if it works better on Linux or Windows?

Mahalo nui loa for all the replies. Much appreciated!

Harry Z
 
Haole Boy said:
I did not know about Photorec. Do you know if it works better on Linux or Windows?
Click to expand...
These things tend to work better from Linux, but in the case of photorec I would say it's about the same when working with an image. If you were working directly on the drive (don't do that) Linux is king.
 
labtech said:
@Haole Boy
Thanks for the reply.
All of us, advanced data recovery professionals, here on the forum will likely get this one done in the $400 range. With the advanced tools we have, the results will likely be much better.
Click to expand...

Mahalo for the reply. Unfortunately with my customer set (residential, mostly over 60 years old) they're in a panic to get their files back, until they hear my quote of $400 minimum. At that point it's "just get me connected to my email and forget everything else". Sigh...
.
phaZed said:
It's worth trying to mount the image as @glennd suggests.. but with only 25% I doubt much will happen. Hopefully what was recovered was somewhat contiguous and a "whole file" was actually written within that amount recovered.

Photorec the mounted image, it may see something.
Click to expand...

Since I own a license for it, I mounted the image in GetDataBack for NTFS. Only found some stuff in the recovery partition. Not too surprised there isn't much there. Is there any reason to believe that Photorec (or any of the other recovery programs mentioned in this thread) would find more from the image file? I'm assuming these other recovery programs might be able to extract more from the hard drive itself, but at this point the customer has his machine back (installed new hard drive, installed Windows and other programs, got him connected to his email. He's "happy" with that...

Mahalo,

Harry Z.
 
Haole Boy said:
Mahalo for the reply. Unfortunately with my customer set (residential, mostly over 60 years old) they're in a panic to get their files back, until they hear my quote of $400 minimum. At that point it's "just get me connected to my email and forget everything else". Sigh...
Click to expand...
Very interesting. Thanks for your feedback. I wonder who these 60+ year old people are emailing? And what is it they email about?
 
You must log in or register to reply here.

Similar threads

H
PC won't power on
Replies
16
Views
1K
frase
frase
H
Fab's Autobackup and OneDrive
Replies
4
Views
959
Haole Boy
H
H
At what point do you give up on ddrescue
Replies
8
Views
4K
Diggs
Diggs
H
Acer Nitro 5 - no bootable device
Replies
10
Views
2K
Haole Boy
H
H
[SOLVED] Move email from Thunderbird to Outlook
Replies
14
Views
2K
Haole Boy
H
Back
Top