Re: [gentoo-user] data recovery advice needed

[Mick <michaelkintzios@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 2630 bytes --]

On Tuesday, 18 December 2018 17:49:37 GMT Jack wrote:
> On 2018.12.18 12:42, Mick wrote:
> [snip...]
> 
> > So, I used losetup with --offset on the failing drive itself over USB
> > 2.0 and was able to mount and recover all the NTFS files.
> 
> I definitely need to read up on that one - I totally unfamiliar with it.

If you are not able to mount a partition because of a 'device not found ...' 
type of error use c/f/gdisk et al. to find the sector at which the partition 
in question starts.  Let's say gdisk shows partition 6 starts at sector 
1,615,872 and the sector size is 512 bytes.  The starting offset for losetup 
should be:

1,615,872 x 512 = 827,326,464

Similarly, let's say the size of the partition is shown as being 1,910,121,163 
sectors, which gives a size of 977,982,035,456 in bytes:

1,910,121,163 x 512 = 977,982,035,456


Then add the above parameters in the losetup command to create a loopback 
device as follows:

losetup -o 827326464 --sizelimit 977982035456 --sector-size 512 -P -r -v /dev/
loop4 /dev/sdb

and subsequently try to mount it:

mkdir /mnt/recovery

mount /dev/loop4 /mnt/recovery


> > Over the years I've used clonezilla, ddrescue, testdisk, photorec and
> > losetup to recover files.  On a couple of times where data on the
> > disk had been overwritten by subsequent operations, I was not able to
> > recover the affected files.  So, if when moving the partition data
> > was overwritten I suspect it will be very difficult to recover this
> > with conventional software tools. However, it doesn't hurt to try.
> > 
> > :-)
> 
> I should be in good shape there.  The partition's new location should
> have the first half intact, and since the overwriting was of the first
> part of the old location, it's second half should be intact.  The files
> should all be there - but I imagine I might have to play with any
> directories which were successfully move, but not the stuff they point
> to.  Of course, all of this depends on recovering from the read errors
> - so ddrescue needs to finish first.

This is what I would try:

1. dd the previously moved first half to a new partition/device.

2. dd the intact second half from the corresponding second half offset 
position of the overwritten partition to the new partition/device.  Use --seek 
and --skip in the dd command as appropriate to achieve this.

This way you should be able to stitch together the two halves, hoping that no 
bits/bytes were lost when the move/overwritting occurred back then.  If the 
original filesystem is not recoverable you should be able to recover 
individual files with photorec.

-- 
Regards,
Mick

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 833 bytes --]