From owner-freebsd-questions@freebsd.org Wed Apr 11 14:21:17 2018 Return-Path: Delivered-To: freebsd-questions@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 241D0F98306 for ; Wed, 11 Apr 2018 14:21:17 +0000 (UTC) (envelope-from freebsd@edvax.de) Received: from mout.kundenserver.de (mout.kundenserver.de [212.227.126.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "mout.kundenserver.de", Issuer "TeleSec ServerPass DE-2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 879E37FBC9 for ; Wed, 11 Apr 2018 14:21:16 +0000 (UTC) (envelope-from freebsd@edvax.de) Received: from r56.edvax.de ([92.195.30.67]) by mrelayeu.kundenserver.de (mreue002 [212.227.15.167]) with ESMTPA (Nemesis) id 0M0H6r-1eCe6036Jp-00uZBT; Wed, 11 Apr 2018 16:21:13 +0200 Date: Wed, 11 Apr 2018 16:21:13 +0200 From: Polytropon To: Ernie Luzar Cc: "freebsd-questions@freebsd.org" Subject: Re: Recover directory tree with files from win10 HD Message-Id: <20180411162113.e2b96a5a.freebsd@edvax.de> In-Reply-To: <5ACE0543.7030607@gmail.com> References: <5ACD536C.5010407@gmail.com> <20180411113740.2b245110.freebsd@edvax.de> <5ACE0543.7030607@gmail.com> Reply-To: Polytropon Organization: EDVAX X-Mailer: Sylpheed 3.1.1 (GTK+ 2.24.5; i386-portbld-freebsd8.2) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-Provags-ID: V03:K1:jC3oxXJgdTClYggqgA69dw9eUSh3K+aieKQIFu9EVEKwUCa6vJc +aTdI/i5832ztN9B/USkfwDA+JmOv11wxm27YzGK7cqxDrv2Rn8MnTZoGEqSNwgQxNlEmGL l8XFWHhdG2lZVD3mzoyTFrRfYD4AV45Tib7QW1i2wKCcCoGA6G9y0OhO5WX12QjzSHa+m/x Nzbw4Ci53UMp4fDhsbZ3Q== X-UI-Out-Filterresults: notjunk:1;V01:K0:/CiSAKSRLPM=:/4WITodcybtR1SXwXtxjFk yFng8iA/Sqnx4f+dgg8cFzsM30KXa6Z7aWM0x9H/ebuUEfDp/RKl3wTL6uEV9GWu6TzjwT0yy h7jIrQ9dJnO4sNTvVvJwF0C2cHy9k3ptePVMIvCZ2rinrX4KQfCZr3e0CHV/qj3/1XbJbEh1M xJo8H0Mce020NdWvPT+gVmRS9pYgmGcj4IYj15GNoIRQlPYu6laXoUchgl9xncKKYpqoMZSLq RQvvQ7IHKTxmjkFp8PlwUXN7z4fatL69GjN7QsyimGbV2WueerBj3Ld0bNH1ytzlvEe6QeW3P m2RBjWpqF+ZOyrPlnUUsulw929LNLer/hw/wVI0VeCch7aolglCNoVcY4UzRzhfRItD+2dWGp fQz/kbq+ti3tRbmNt6aW8lUtohZNHvAz0uG3jAKulrr2zxax74FOyaBpr/XYh6H/5XKa0Zpld Lg2MJHOmaJCCgO4lcnDktouIex7wqULiRPDbVU7t4wxkUpG405O1kN9kYARuodJ2DDEvAv5/y mrlaph77xGyRLxuVRGS/GHn1S1J2QiQKh+PxjDOY7JYRQdD0CIYYBrL9uuGAPbPiaNVjsuYbc lRUVzCN0W3kYcFZBx20xK6p/imEK38xZL0VtrP8So50UUBGA0p8EbIsyg2rv/tvzfNbQgXXPB 0VBY1v0fZMT7579Y8sCe68lhg4YD7A1ReKaMFx0O6Hc7SeINleTgR2jLNOH8QqFTnnrrGR7Bu AQK1lQauAVnzVjHg6yyfDgtCN/NAxdvejBA+0BufvXYh89PmLTODRBZWU5U= X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.25 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 11 Apr 2018 14:21:17 -0000 On Wed, 11 Apr 2018 08:53:23 -0400, Ernie Luzar wrote: > Polytropon wrote: > > On Tue, 10 Apr 2018 20:14:36 -0400, Ernie Luzar wrote: > >> My mothers win10 pc has external usb 3tb sata drive with 600gb of data > >> that has hardware data problems. It will not mount on win10 pc. > > > > Do not try any further with "Windows", it could do more damage. > > On "Windows 10", they use NTFS or FAT as file systems, and both > > are known to do the "funniest things" when getting into some > > inconsistent state ("silent" data corruption, data loss, no > > access due to damaged hiberfile, etc.). > > > > > > > >> My > >> mother has her whole digital life on the external drive. > > > > Just restore from backup! Sorry, couldn'r resist... ;-) > > > > > > > >> I can not find > >> any win10 software to recover the data from a drive that will not mount. > > > > First of all, use tools that work with a copy of the damaged > > disk (or partition). Create this 1:1 copy first in a read-only > > manner, then work with the image. Do not try to repair the > > data "on-disk", it will probably destroy more data and reduce > > the chances of getting the "whole digital life" back. > > > > Seriously. I'm not making this up - I learned from my own > > faults. Check the mailing list archives for the terrible > > truth. :-) > > > > Do not use "Windows" any further without knowing _exactly_ > > what the problem is. > > > > > > > >> I am thinking about using FreeBSD to recover the directory structure and > >> the files contained in them. Asking anyone if they know of a port that > >> will recover the data with their full file names in their directories? > > > > That depends on the actual damage. This is how you should > > proceed: > > > > 1. Make a 1:1 copy of the disk or partition. Use that copy > > in all further steps. (Two copies are handy, in case you > > mess up one.) > > > > 2. Examine the data. What has happened? Can you use FUSE's > > NTFS mount program to mount it read-only? Can you use > > tools from the ntfs-tools package to repair things like > > the MFT. Or is it a FAT drive? Try mount_msdos instead, > > maybe even fsck_msdosfs. It could be sufficient to copy > > all the data (cp -R). > > > > 3. No luck getting the partition to mount? Assume the data > > is still there. Make yourself familiar with professional > > forensic tools. Start with the easy ones. If they get > > back what you expect to recover, well done. If not, use > > the more complex ones. > > > > On this mailing list, I have published my "famous list of > > data recovery tools" from time to time. Note that in order > > to make use of that list, you'll have to learn (!) about > > lower-level file system design, because you _must_ understand > > what you're doing. > > > > Here is this list. Note that I've added a few comments that > > might help in your specific situation (damaged FAT or NTFS > > drive): > > > > System: > > dd <- for making 1:1 copy > > fsck_ffs > > clri > > fsdb > > fetch -rR > > recoverdisk > > > > Ports: > > ddrescue <- if 1:1 copy is hard > > dd_rescue <- same > > ffs2recov > > magicrescue <- get data back (no structure) > > testdisk > > The Sleuth Kit: > > fls > > dls > > ils > > autopsy > > scan_ffs > > recoverjpeg > > foremost > > photorec > > fatback <- FAT > > ntfs-tools <- NTFS (ntfsfix, ntfsinfo, ntfsmount) > > > > Keep in mind: It will take time. There is no "one size fits > > all" GUI solution where you just click and icon and then have > > all your files (and the directory structure) back. IN worst > > case, what you're searching for has already been overwritten > > by "Windows" attempting to "repair" it. > > > > Your alternative: Take $500-3000 and ship the disk to a > > recovery business. If a "whole digital life" is worth that > > much money, you can give them a change. Note that there is > > absolutely no guarantee that they will succeed. > > > > Good luck! > > > > > Thank you for your post. > > Lets talk about making a copy to work with. > Question is about unused space. Disk is 3TB with 600GB used. > How do I reduce the working copy size to the data only size of 600GB? > Using the dd command I don't see any way to tell it to ignore coping > empty space. If I remember correctly, dd will deal with trailing zeroes just fine. However, it matters how the data is placed on the disk (as contiguous used space - or fragmented across a bigger amount of available storage). > Do I need another 3TB disk to hold the working copy? That would be good, especially because for n bytes to recover, you'll need at least 2*n bytes (1 for the copy to work with, 1 for the recovered data). Having 3*n bytes (additional 1 for a "master copy" in case you messed up your initial copy) is never a bad idea. > Do I dd the bad HD to another HD of same size making a complete image > copy resulting in 2 ntfs hard drives? That is possible, but there is a much easier way: Initialize the new hard disk (for example as a simple UFS volume) and then create the image onto that drive (using a temporary mountpoint). Let's say da0 is the defective disk, da1 is your new disk. Then you can do something like this (possible optimization left aside for now): # newfs da1 # mount -t ufs /dev/da1 /mnt # dd if=/dev/da0s1 of=/mnt/win10.img bs=1m You can vary the bs= parameter to a better value (to saturate what the drive connections provide), maybe 10m or even 100m will work. In this example, da0s1 refers to the first (and probably only) NTFS partition. In case you get reading errors (check console log!), cancel the operation and use dd_rescue (or ddrescue) instead. If you succeeded getting an image file, connect it to a virtual node and try to mount it: # mdconfig -a -t vnode -u 0 /mnt/win10.img # mkdir /try # mount_ntfs -r /dev/md0 /try ... copy data ... # umount /try # mdconfig -d -u 0 Pay attention to try a read-only mount first. > Or should I have the dd command create a single flat file of the bad > disk on the target disk? Exactly that. :-) -- Polytropon Magdeburg, Germany Happy FreeBSD user since 4.0 Andra moi ennepe, Mousa, ...