From owner-freebsd-questions@FreeBSD.ORG Mon Oct 4 10:34:16 2010 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 726AD1065679 for ; Mon, 4 Oct 2010 10:34:16 +0000 (UTC) (envelope-from freebsd@edvax.de) Received: from mx02.qsc.de (mx02.qsc.de [213.148.130.14]) by mx1.freebsd.org (Postfix) with ESMTP id 33B448FC1A for ; Mon, 4 Oct 2010 10:34:15 +0000 (UTC) Received: from r55.edvax.de (port-92-195-226-229.dynamic.qsc.de [92.195.226.229]) by mx02.qsc.de (Postfix) with ESMTP id 640AE1E5F1; Mon, 4 Oct 2010 12:34:14 +0200 (CEST) Received: from r55.edvax.de (localhost [127.0.0.1]) by r55.edvax.de (8.14.2/8.14.2) with SMTP id o94AYDc1001535; Mon, 4 Oct 2010 12:34:13 +0200 (CEST) (envelope-from freebsd@edvax.de) Date: Mon, 4 Oct 2010 12:34:13 +0200 From: Polytropon To: Robert Message-Id: <20101004123413.8e7cf859.freebsd@edvax.de> In-Reply-To: <20101003142935.3d751862@asus64> References: <201010031319.o93DJaDE005892@mail.r-bonomi.com> <20101003100051.23e2cc77@asus64> <20101003194045.849d6419.freebsd@edvax.de> <20101003142935.3d751862@asus64> Organization: EDVAX X-Mailer: Sylpheed 2.4.7 (GTK+ 2.12.1; i386-portbld-freebsd7.0) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Cc: freebsd-questions@freebsd.org Subject: Re: OT: fdisk X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Polytropon List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 04 Oct 2010 10:34:16 -0000 On Sun, 3 Oct 2010 14:29:35 -0700, Robert wrote: > Thanks for the info. I successfully did the above and now I have a > 58.6GB file named disk.img on a UFS disk. > > Umm, what should I do now. Sorry for dumb question number 37 this > weekend but I am a bit confused. Can I do just the opposite to another > NTFS drive and end up with all the data looking like it should? I.E. dd > from the file to an NTFS disk. You can now use the file as if it were a disk. To "turn it into a device", simply do % mkdir mnt % sudo mdconfig -a -t vnode -u 10 -f disk.img % mount -o ro /dev/md10 mnt/ This should give you the chance to extract files from it. You can also use fdisk on the /dev/md10 file (or any other unit number given by -u you want to use). I wouldn't dd the file back to the original drive, that might make things worse. For data extraction, I suggest dd'ing the WHOLE disk into an image file and then working with this file, having the original disk not touched anymore until the data is back. See /usr/local/share/doc/sleuthkit/skins_ntfs.txt from TSK (port: sleuthkit) for details about NTFS file recovery. As you did show that you could mount the disk (I think you presented a ls output with typical "Windows" files) this should be possible again after fixing the partition table. I have to admit that I've got NO CLUE about "Windows" file systems as I don't use them, so I sadly can't be more specific. You can also use ddrescue instead of dd, as it allows resuming a dd operation, and it will dynamically adjust read block sizes, so it might run faster. % ddrescue -d -r 3 -n /dev/ad12 ntfs.ddr log.txt If mounting does not work, you can use tools like photorec on the /dev/md10 file which will extract known file types. The tool magicrescue also could work: % magicrescue -r /usr/local/share/magicrescue/recipes -d mr_output /dev/md10 -- Polytropon Magdeburg, Germany Happy FreeBSD user since 4.0 Andra moi ennepe, Mousa, ...