OT: fdisk

[Polytropon]

On Sun, 3 Oct 2010 14:29:35 -0700, Robert <traveling08 at cox.net> wrote:
> Thanks for the info. I successfully did the above and now I have a
> 58.6GB file named disk.img on a UFS disk.
> 
> Umm, what should I do now. Sorry for dumb question number 37 this
> weekend but I am a bit confused. Can I do just the opposite to another
> NTFS drive and end up with all the data looking like it should? I.E. dd
> from the file to an NTFS disk.

You can now use the file as if it were a disk. To "turn it into
a device", simply do

	% mkdir mnt
	% sudo mdconfig -a -t vnode -u 10 -f disk.img
	% mount -o ro /dev/md10 mnt/

This should give you the chance to extract files from it. You
can also use fdisk on the /dev/md10 file (or any other unit
number given by -u you want to use).

I wouldn't dd the file back to the original drive, that might
make things worse.

For data extraction, I suggest dd'ing the WHOLE disk into an
image file and then working with this file, having the original
disk not touched anymore until the data is back.

See /usr/local/share/doc/sleuthkit/skins_ntfs.txt from TSK
(port: sleuthkit) for details about NTFS file recovery. As
you did show that you could mount the disk (I think you
presented a ls output with typical "Windows" files) this
should be possible again after fixing the partition table.

I have to admit that I've got NO CLUE about "Windows" file
systems as I don't use them, so I sadly can't be more specific.

You can also use ddrescue instead of dd, as it allows resuming
a dd operation, and it will dynamically adjust read block sizes,
so it might run faster.

	% ddrescue -d -r 3 -n /dev/ad12 ntfs.ddr log.txt

If mounting does not work, you can use tools like photorec on
the /dev/md10 file which will extract known file types. The
tool magicrescue also could work:

	% magicrescue -r /usr/local/share/magicrescue/recipes
		-d mr_output /dev/md10





-- 
Polytropon
Magdeburg, Germany
Happy FreeBSD user since 4.0
Andra moi ennepe, Mousa, ...