[Bradford] Recovering "missing" files from NTFS

[John Robert Hudson]

Hi David

That is the beauty of System rescue. Unlike Parted Magic, it does not mount 
anything itself. So the damaged components are not touched other than by a 
specific operator command.

To use ddrescue, all you need to do is to mount the damaged filesystem and the 
destination to which you intend to make the copy (which could be another 
network, another hard drive, a USB flash disk etc.). Nothing else on the 
machine is touched by System rescue.

John
--
On Tuesday 17 Mar 2015 11:25:32 David Spencer wrote:
> Well there are multiple do's and dont's depending on what happened.
> If files have been deleted due to operator error, you'll need to do
> *nothing* to the fs before using something like photorec or some
> undelete thingie.
> If it's a hard error on the disk (smartctl -a) you'll need to run
> ddrescue and work on the image and then identify which files were
> gonged, there's plenty about that online (basically you need to map
> the bad block address into the the ntfs inode, or you can fill the bad
> blocks with something you can grep).
> If it's some kind of ntfs cockup (system crash corrupted the fs, etc)
> then the problem you'll find is that the Linux ntfs implementation
> hasn't got a fully functional fsck and you will get better results
> from running checkdsk in the recovery console.
> In all three cases I would start with making a ddrescue image and take
> it from there...
> 
> This message brought to you by the Virgin Media business broadband
> fault line hold music.
> 
> tarra
> -D.
> 
> _______________________________________________
> Bradford mailing list
> Bradford at mailman.lug.org.uk
> https://mailman.lug.org.uk/mailman/listinfo/bradford