From owner-freebsd-questions@freebsd.org Sat Apr 14 14:47:21 2018 Return-Path: Delivered-To: freebsd-questions@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id CB4A6FA5433 for ; Sat, 14 Apr 2018 14:47:21 +0000 (UTC) (envelope-from luzar722@gmail.com) Received: from mail-it0-x229.google.com (mail-it0-x229.google.com [IPv6:2607:f8b0:4001:c0b::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 60FCD6E5BB for ; Sat, 14 Apr 2018 14:47:21 +0000 (UTC) (envelope-from luzar722@gmail.com) Received: by mail-it0-x229.google.com with SMTP id u62-v6so6534613ita.5 for ; Sat, 14 Apr 2018 07:47:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=message-id:date:from:user-agent:mime-version:to:cc:subject :references:in-reply-to:content-transfer-encoding; bh=zsgbge3Cl21APChzbzi2pD8fpWOIIGiDO7yIyWDxJNw=; b=ZgfbA7CwYpIhapk354TmCrV+env597UpnGJtdObIQmt12sbQodnw0G7A4Qr52sO5p4 kORvyds42vM2GZQBOxxRi6MZpYYgheT0Bwg+yowe/lxnNcorAzp30m1ggt67y7TAgOnb KaFKXvY7C/I3Qs6Xcu0dRmRmZKO1jw/4Lr2G8ahCw7OYrzLK2pf5BEDTrhYl8SxKAwPr wvfkqDxplnIcKQv4EcxWoXbkh4USKAkqjzD5C4xGdBx2CrVHE394DUJbAx3IfXuK6kbz ft+okM/7YTSjeEwFr+Xl5czrfuj4Jhj65RbZTCUWmysFu/OWAxA/MlovPaMFT2GXr3uz DXaw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:message-id:date:from:user-agent:mime-version:to :cc:subject:references:in-reply-to:content-transfer-encoding; bh=zsgbge3Cl21APChzbzi2pD8fpWOIIGiDO7yIyWDxJNw=; b=IZowaZk3rXCwN2hdztqckJbwaKt0U9QHXJgdjEkV3Ob3aKvTKv1fNiqnq5CI/tLBJw KM55bAKFPjGu7eH45gKluO7LSDTY9SRn5RJwRA49jpdh2mUf+2ar7xHlBF3kaLNf0nyP meEej4HfAW5t752B+P04QYY9KEw/uQ5cP1S1pDwpXNTUB6VwWBKTmy3qRfttcF41C/xQ iG/3OpHDITNzG7+U56wOepwqBAc9LoCEsUQMEmPTDsJwIB4oJKuk37dy8UhvhdIJX8FO rkx2g0sZXTQt/wQHwZqy8+O7vp8ZeBZK/Cn3tFDqT2tcY+363HCy9v9DxJgtKEmbiPK1 B+xg== X-Gm-Message-State: ALQs6tArK+/ZMJqM4PwXQaMyPXZ/MIEs+WfmW7ohpscx15GNDaC1a9FT ZDi2fON1mBcHoykxdat3NICNvQ== X-Google-Smtp-Source: AIpwx4+pqn2ZkXxzCCvuc8YOcmH21mvyOKaYdMzUt+KVs7ZWsiyA5lGKcmO9VA1d5aLZDSY9O5+4sQ== X-Received: by 2002:a24:4153:: with SMTP id x80-v6mr9351708ita.14.1523717240760; Sat, 14 Apr 2018 07:47:20 -0700 (PDT) Received: from [10.0.10.7] (cpe-65-25-48-31.neo.res.rr.com. [65.25.48.31]) by smtp.googlemail.com with ESMTPSA id a79-v6sm2346457itc.11.2018.04.14.07.47.19 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Sat, 14 Apr 2018 07:47:19 -0700 (PDT) Message-ID: <5AD21478.4030102@gmail.com> Date: Sat, 14 Apr 2018 10:47:20 -0400 From: Ernie Luzar User-Agent: Thunderbird 2.0.0.24 (Windows/20100228) MIME-Version: 1.0 To: Polytropon CC: "freebsd-questions@freebsd.org" Subject: Re: Recover directory tree with files from win10 HD References: <5ACD536C.5010407@gmail.com> <20180411113740.2b245110.freebsd@edvax.de> In-Reply-To: <20180411113740.2b245110.freebsd@edvax.de> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.25 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 14 Apr 2018 14:47:22 -0000 Well I chose to try ddrescue. It's my understanding it will clone the complete source HD to the target HD. That means the mbr & partition table, and all the data space of the source HD to the target HD. The following is what I did. ada1 is 3tb bad drive from win10 ntfs with 600gb data on it ada2 is 3tb newly purchased empty drive thats never been used. Installed these 2 HD to the PC's motherboard with their sata cables and booted the system. /root >ls /dev | grep ada ada0 ada0s1 ada0s1a ada0s1b ada1 ada2 pkg install fusefs-ntfs pkg install ddrecuse ddrescue -nf /dev/ada1 /dev/ada2 /root/mapfile ipos: 646353 MB, non-trimmed: 0 B, current rate: 15872 B/s0 00 0 opos: 646353 MB, non-scraped: 11143 kB, average rate: 84485 kB/s non-tried: 0 B, bad-sector: 57856 B, error rate: 0 B/s rescued: 3000 GB, bad areas: 113, run time: 9h 51m 55s pct rescued: 99.99%, read errors: 363, remaining time: Finished /root >mount -t ntfs-3g /dev/ada2 /mnt mount: /dev/ada2: Operation not supported by device /root >ntfsinfo -m -v /dev/ada2 NTFS signature is missing. Failed to mount '/dev/ada2': Invalid argument The device '/dev/ada2' doesn't have a valid NTFS. Maybe you selected the wrong device? Or the whole disk instead of a partition (e.g. /dev/hda, not /dev/hda1)? Or the other way around? Failed to open '/dev/ada2'. /root >ntfsfix /dev/ada2 Mounting volume... NTFS signature is missing. FAILED Attempting to correct errors... NTFS signature is missing. FAILED Failed to startup volume: Invalid argument NTFS signature is missing. Trying the alternate boot sector Error reading alternate bootsector: Invalid argument Unrecoverable error Volume is corrupt. You should run chkdsk. /root >fdisk /dev/ada2 ******* Working on device /dev/ada2 ******* parameters extracted from in-core disklabel are: cylinders=5814021 heads=16 sectors/track=63 (1008 blks/cyl) Figures below won't work with BIOS for partitions not in cyl 1 parameters to be used for BIOS calculations are: cylinders=5814021 heads=16 sectors/track=63 (1008 blks/cyl) fdisk: invalid fdisk partition table found Media sector size is 512 Warning: BIOS sector numbering starts with sector 1 Information from DOS bootblock is: The data for partition 1 is: sysid 165 (0xa5),(FreeBSD/NetBSD/386BSD) start 63, size 4294966977 (2097151 Meg), flag 80 (active) beg: cyl 0/ head 1/ sector 1; end: cyl 15/ head 15/ sector 63 The data for partition 2 is: The data for partition 3 is: The data for partition 4 is: ****************************************************************** To me this looks like my mother's pc caught a virus that changed the contents of the HD mbr and partition table to make the HD unusable. The damaged 2tb HD was formated using a XP laptop that was before gpart and usb3. I know it's a ntfs filesystem with mbr. Are there any tools that I can use to repair these problems without loosing the user data? Change the sysid to windows ntfs and fix the mbr.