• # Suivi

    Posté par . En réponse au message Récupération données disque NTFS (sous Linux). Évalué à 2.

    Petit suivi :

    Pour image de la partition qui fonctionnait sous Windows ddrescue a mis 4h30m (pour 750 Go) et n'a visiblement pas rencontré de problèmes :

    GNU ddrescue 1.27
Press Ctrl-C to interrupt
 ipos: 731769 MB, non-trimmed: 0 B, current rate: 22420 kB/s
 opos: 731769 MB, non-scraped: 0 B, average rate: 45613 kB/s
non-tried: 0 B, bad-sector: 0 B, error rate: 0 B/s
 rescued: 731769 MB, bad areas: 0, run time: 4h 27m 22s
pct rescued: 100.00%, read errors: 0, remaining time: n/a
 time since last successful read: n/a
Copying non-tried blocks... Pass 1 (forwards)
Finished

    Je l'ai montée sans problème avec mount -t ntfs -o loop,ro /mnt/espace_travail/sdh2-copie_travail.img /mnt/sdh2 et j'ai pu naviguer/lire son contenu : reste à copier les données sur un autre disque NTFS (en préservant les dates si possible) mais ça c'est du détail.

    Pour l'autre partition, celle qui n'apparaissait même plus, ddrescue a mis 4h15m (pour 250 Go) et a visiblement dû employer ses contre-mesures :

    GNU ddrescue 1.27
Press Ctrl-C to interrupt
 ipos: 268435 MB, non-trimmed: 278528 B, current rate: 54919 kB/s
 opos: 268435 MB, non-scraped: 0 B, average rate: 32091 kB/s
non-tried: 21495 kB, bad-sector: 0 B, error rate: 0 B/s
 rescued: 268413 MB, bad areas: 0, run time: 2h 19m 23s
pct rescued: 99.99%, read errors: 8, remaining time: 1s
 time since last successful read: 0s
Copying non-tried blocks... Pass 1 (forwards)
 ipos: 65536 B, non-trimmed: 581632 B, current rate: 6963 B/s
 opos: 65536 B, non-scraped: 0 B, average rate: 31724 kB/s
non-tried: 9306 kB, bad-sector: 0 B, error rate: 6144 B/s
 rescued: 268425 MB, bad areas: 0, run time: 2h 21m 1s
pct rescued: 99.99%, read errors: 14, remaining time: 26s
 time since last successful read: 0s
Copying non-tried blocks... Pass 2 (backwards)
 ipos: 6268 MB, non-trimmed: 733184 B, current rate: 1092 B/s
 opos: 6268 MB, non-scraped: 0 B, average rate: 31535 kB/s
non-tried: 8060 kB, bad-sector: 0 B, error rate: 3276 B/s
 rescued: 268426 MB, bad areas: 0, run time: 2h 21m 52s
pct rescued: 99.99%, read errors: 19, remaining time: 1m 13s
 time since last successful read: 0s
Copying non-tried blocks... Pass 4 (backwards)
 ipos: 6291 MB, non-trimmed: 2068 kB, current rate: 65536 B/s
 opos: 6291 MB, non-scraped: 0 B, average rate: 30507 kB/s
non-tried: 0 B, bad-sector: 0 B, error rate: 0 B/s
 rescued: 268433 MB, bad areas: 0, run time: 2h 26m 39s
pct rescued: 99.99%, read errors: 44, remaining time: 31s
 time since last successful read: 0s
Copying non-tried blocks... Pass 5 (forwards) 
 ipos: 6291 MB, non-trimmed: 0 B, current rate: 14336 B/s
 opos: 6291 MB, non-scraped: 1257 kB, average rate: 29375 kB/s
non-tried: 0 B, bad-sector: 33792 B, error rate: 128 B/s
 rescued: 268434 MB, bad areas: 66, run time: 2h 32m 18s
pct rescued: 99.99%, read errors: 110, remaining time: 6m
 time since last successful read: 0s
Trimming failed blocks... (forwards) 
 ipos: 6291 MB, non-trimmed: 0 B, current rate: 0 B/s
 opos: 6291 MB, non-scraped: 0 B, average rate: 17572 kB/s
non-tried: 0 B, bad-sector: 592896 B, error rate: 0 B/s
 rescued: 268434 MB, bad areas: 95, run time: 4h 14m 35s
pct rescued: 99.99%, read errors: 1202, remaining time: n/a
 time since last successful read: 1m 36s
Scraping failed blocks... (forwards)
Finished

    Un file arrive à dire ce que c'est :

    $ file sdh1-copie_travail.img 
../forensic_space2/travail/sda1-copie_travail.img: DOS/MBR boot sector, code offset 0x52+2, OEM-ID "NTFS ", sectors/cluster 8, Media descriptor 0xf8, sectors/track 63, heads 255, dos < 4.0 BootSector (0x80), FAT (1Y bit by descriptor); NTFS, sectors/track 63, sectors 524287965, $MFT start cluster 3, $MFTMirror start cluster 32767997, bytes/RecordSegment 2^(-1*246), clusters/index block 1, serial number 01d...2a0; contains bootstrap NTLDR

    Mais le mount ne fonctionne pas :

    $ sudo mount -t ntfs -o loop,ro sdh1-copie_travail.img /mnt/recovered_images/sda1
ntfs_mst_post_read_fixup_warn: magic: 0x00000000 size: 1024 usa_ofs: 0 usa_count: 0: Invalid argument
Record 0 has no FILE magic (0x0)
Failed to load $MFT: Input/output error
Failed to mount '/dev/loop2': Input/output error
NTFS is either inconsistent, or there is a hardware fault, or it's a
SoftRAID/FakeRAID hardware. In the first case run chkdsk /f on Windows
then reboot into Windows twice. The usage of the /f parameter is very
important! If the device is a SoftRAID/FakeRAID then first activate
it and mount a different device under the /dev/mapper/ directory, (e.g.
/dev/mapper/nvidia_eahaabcc1). Please see the 'dmraid' documentation
for more details

    Je vais voir avec testdisk et photorec (heureusement c'est la partition la plus petite des 2).