0

I recently used ddrescue in Ubuntu to attempt recovering data from a failing HDD (details here). The process completed successfully with the following:

GNU ddrescue 1.19
Press Ctrl-C to interrupt
Initial status (read from logfile)
rescued:   499912 MB,  errsize:    195 MB,  errors:   13918

Current status
rescued:   499942 MB,  errsize:    165 MB,  current rate:        0 B/s
   ipos:   221551 MB,   errors:   15631,    average rate:      133 B/s
   opos:   221551 MB, run time:    2.56 d,  successful read:    3.65 m ago
Finished

I now have an external USB HDD with the recovered contents of the failing drive. I am unsure about the correct next steps though. The USB HDD drive shows up in Ubuntu as unallocated space with no partitions. I read through questions on this forum that suggested chkdsk /f in Windows but the disk is seen as unallocated space there.

What process should I follow to get the partitions and data readable? The disk was an NTFS volume made in Windows 10.

Kyle Ingraham
  • 55

1 Answers1

1

The first step with a data recovery is, as you have figured out, imaging the data onto solid hardware. Thats what DDRescue excels at.

Now that you have the image, in a perfect world, you would archive a copy of the image, as a master, and restore it to another disk for recovery purposes. Many recovery options can be destructive (like chkdsk potentially), and the source disk is often too damaged to reimage if you break your copy. This of course requires extra storage that may not be available. This need is exacerbated, because you can never recover files to the same disk you are recovering from, or you will overwrite the next file while recovering the current one. .

After you have the image restored on solid hardware, you can begin data recovery operations. I recommend starting with a partition level recovery tools like Testdisk, and see if it can recover the partition and filesystem intact. This is optimal as no information about file naming or directory location is lost. Remember, you must recover to another disk of equal or greater size, and preferably an empty one, so that writing your new partition won't break the partition table on the destination disk.

If partition level recovery won't work, then you are left with File Carving utilities like PhotoRec, Recuva, Easus, etc. These utilties may or may not fit the bill for you though, depending on the filesystem type, the degree of damaage to its filesystem metadata, etc. You may lose all your directories and file names, leaving you with a bunch of files with random names all in one directory.

Frank Thomas
  • 37,476