Home / server / Questions / 1026103
Accepted
Lucio Crusca
Asked: 2020-07-22 03:05:30 +0800 CST

cloning NTFS disk

  • 772

I need to clone a failing 2TB disk that contains a NTFS partition, using Debian GNU/Linux. The disk has a number of non-relocatable bad sectors, so I know that part of the data is already lost; however I need to clone the the disk in order to try to recover the rest using testdisk.

The command I issued to clone it is:

dd if=/dev/sdc of=/dev/md2 bs=512 conv=noerror status=progress

and it took about 2 days to complete, during which it found bad sectors at about 3GB, 66GB and 88GB. The failing disk is quite old and it isn't Advanced Format, so I know its sectors are 512 bytes each for sure.

The problem is that trying testdisk /dev/sdc it reads the directory (but then fails to recover the files, because of bad sectors), while tryng testdisk /dev/md2 does not even list the directory contents. The disk contains only the NTFS partition, that spans the whole available space. Why the clone is not the same as the original, at least on the sectors that aren't damaged? Am I cloning in a bad way and I should clone it some other way, e.g. different command or options?

linux clone ntfs forensics

1 Answers

  1. Best Answer

    Thanks to Michael Hampton suggestion, I found myrescue, similar to dd_rescue, but better documented (at least that was my impression).

    With myrescue I first cloned the disk reading it in reverse order (from the last sector to the first), then reading the missing sectors again in normal order. All done disabling every read-ahead and caching. As soon as I tried it, it became clear that it was going to take more than 50 days to complete, so I wrote a script to automatically restart myrescue from where it left off, after likely power line blackouts in such a long time period.

    It recovered everything I needed, but be warned: YMMV and a failing disk is no joke for your data, so read the myrescue documentation and think twice before doing anything to your disk, running my script included.

    If you happen to have no other choice (or no other better choice) than running myrescue, here is the script I wrote, just in case anyone is interested:

    #!/bin/bash

SOURCE=/dev/disk/by-id/ata-ST2000DM001-1ER164_Z4Z4Z3EQ
DESTINATION=/dev/disk/by-id/ata-ST2000DM008-2FR102_WFL1GF5H

if [ "$1" == "bgrun" ] ; then
  hdparm -a 0 "$SOURCE"  # read-ahead del kernel a zero
  hdparm -A0 "$SOURCE" # read-ahead del disco disabilitato
  myrescue -b 512 -B /root/myrescue.bitmap -R -f 1 "$SOURCE" "$DESTINATION"
else
  if [ "$1" == "bgdebug" ] ; then
    touch /tmp/startrescuedebugflag.deleteme
  else
    set -x
    RUNNING=$(ps axu | grep myrescue | grep -v -e grep -e SCREEN | wc -l)
    if [ $RUNNING -lt 1 ] ; then
      screen -S bgrescue -d -m $0 bgrun
    else
      screen -S bgdebug -d -m $0 bgdebug
    fi    
  fi
fi
    • 0