Skip site navigation (1)Skip section navigation (2)
Date:      Sat, 14 Apr 2018 10:47:20 -0400
From:      Ernie Luzar <luzar722@gmail.com>
To:        Polytropon <freebsd@edvax.de>
Cc:        "freebsd-questions@freebsd.org" <freebsd-questions@freebsd.org>
Subject:   Re: Recover directory tree with files from win10 HD
Message-ID:  <5AD21478.4030102@gmail.com>
In-Reply-To: <20180411113740.2b245110.freebsd@edvax.de>
References:  <5ACD536C.5010407@gmail.com> <20180411113740.2b245110.freebsd@edvax.de>

Next in thread | Previous in thread | Raw E-Mail | Index | Archive | Help

Well I chose to try ddrescue. It's my understanding it will clone the 
complete source HD to the target HD. That means the mbr & partition 
table, and all the data space of the source HD to the target HD.

The following is what I did.

ada1 is 3tb bad drive from win10 ntfs with 600gb data on it
ada2 is 3tb newly purchased empty drive thats never been used.

Installed these 2 HD to the PC's motherboard with their sata cables and 
booted the system.

/root >ls /dev | grep ada
ada0
ada0s1
ada0s1a
ada0s1b
ada1
ada2

pkg install fusefs-ntfs
pkg install ddrecuse

ddrescue -nf /dev/ada1 /dev/ada2 /root/mapfile

ipos:  646353 MB, non-trimmed:        0 B,  current rate:   15872 B/s0 00 0
opos:  646353 MB, non-scraped:   11143 kB,  average rate:  84485 kB/s
non-tried:        0 B,  bad-sector:    57856 B,    error rate:       0 B/s
rescued:    3000 GB,   bad areas:      113,        run time:  9h 51m 55s
pct rescued:   99.99%, read errors:      363,  remaining time:
Finished

/root >mount -t ntfs-3g /dev/ada2 /mnt
mount: /dev/ada2: Operation not supported by device

/root >ntfsinfo -m -v /dev/ada2
NTFS signature is missing.
Failed to mount '/dev/ada2': Invalid argument
The device '/dev/ada2' doesn't have a valid NTFS.
Maybe you selected the wrong device? Or the whole disk instead of a
partition (e.g. /dev/hda, not /dev/hda1)? Or the other way around?
Failed to open '/dev/ada2'.

/root >ntfsfix /dev/ada2
Mounting volume... NTFS signature is missing.
FAILED
Attempting to correct errors... NTFS signature is missing.
FAILED
Failed to startup volume: Invalid argument
NTFS signature is missing.
Trying the alternate boot sector
Error reading alternate bootsector: Invalid argument
Unrecoverable error
Volume is corrupt. You should run chkdsk.

/root >fdisk /dev/ada2
******* Working on device /dev/ada2 *******
parameters extracted from in-core disklabel are:
cylinders=5814021 heads=16 sectors/track=63 (1008 blks/cyl)

Figures below won't work with BIOS for partitions not in cyl 1
parameters to be used for BIOS calculations are:
cylinders=5814021 heads=16 sectors/track=63 (1008 blks/cyl)

fdisk: invalid fdisk partition table found
Media sector size is 512
Warning: BIOS sector numbering starts with sector 1
Information from DOS bootblock is:
The data for partition 1 is:
sysid 165 (0xa5),(FreeBSD/NetBSD/386BSD)
     start 63, size 4294966977 (2097151 Meg), flag 80 (active)
         beg: cyl 0/ head 1/ sector 1;
         end: cyl 15/ head 15/ sector 63
The data for partition 2 is:
<UNUSED>
The data for partition 3 is:
<UNUSED>
The data for partition 4 is:

******************************************************************

To me this looks like my mother's pc caught a virus that changed the 
contents of the HD mbr and partition table to make the HD unusable.

The damaged 2tb HD was formated using a XP laptop that was before gpart 
and usb3. I know it's a ntfs filesystem with mbr.

Are there any tools that I can use to repair these problems without 
loosing the user data?

Change the sysid to windows ntfs and fix the mbr.





Want to link to this message? Use this URL: <http://docs.FreeBSD.org/cgi/mid.cgi?5AD21478.4030102>