Yesterday, the old NVME drive in my sister's Windows laptop started to die and corrupted itself. Most stuff was stored in the cloud but a few things weren't, so I wanted to try to recover what I could. Not a big deal if we can't. I did a dd of the drive, but I foolishly did it partition-by-partition (not realising you can just dd the entire device). I now have three partition images: backup-nvme0n1p1.img, backup-nvme0n1p2.img and backup-nvme0n1p3.img. The third one is 237GB and contains the actual data. I have backups of the image files so I can mess with these as necessary.
I would just re-do the imaging properly, except we've now formatted the drive and reinstalled Windows (as an temporary emergency measure so she can use the laptop - we're not relying on the drive to store anything permanent, so long as it can function to run Windows for a couple of days).
I tried to mount the partition image directly in an Ubuntu VM with:
sudo mount -t ntfs -o loop backup-nvme0n1p3.img /mnt/test
...however the filesystem appears to be corrupt (which we already assumed):
ntfs_mst_post_read_fixup_warn: magic: 0xffffffff size: 1024 usa_ofs: 65535 usa_count: 65535: Invalid argument
Record 0 has no FILE magic (0xffffffff)
Failed to load $MFT: Input/output error
Failed to mount '/dev/loop9': Input/output error
NTFS is either inconsistent, or there is a hardware fault, or it's a
SoftRAID/FakeRAID hardware. In the first case run chkdsk /f on Windows
then reboot into Windows twice. The usage of the /f parameter is very
important! If the device is a SoftRAID/FakeRAID then first activate
it and mount a different device under the /dev/mapper/ directory, (e.g.
/dev/mapper/nvidia_eahaabcc1). Please see the 'dmraid' documentation
for more details.
ntfsfix also does not approve:
ntfsfix backup-nvme0n1p3.img
Mounting volume... ntfs_mst_post_read_fixup_warn: magic: 0xffffffff size: 1024 usa_ofs: 65535 usa_count: 65535: Invalid argument
Record 0 has no FILE magic (0xffffffff)
Failed to load $MFT: Input/output error
FAILED
Attempting to correct errors... ntfs_mst_post_read_fixup_warn: magic: 0xffffffff size: 1024 usa_ofs: 65535 usa_count: 65535: Invalid argument
Record 0 has no FILE magic (0xffffffff)
Failed to load $MFT: Input/output error
FAILED
Failed to startup volume: Input/output error
Checking for self-located MFT segment... ntfs_mst_post_read_fixup_warn: magic: 0xffffffff size: 1024 usa_ofs: 65535 usa_count: 65535: Invalid argument
OK
Unrecoverable error
Volume is corrupt. You should run chkdsk.
Ok, so I probably do want to try to mount it in Windows and run chkdsk. If it were an image of the whole drive I assume I could mount it as a virtual disk with something like ImDisk, but I don't know what I can do with three separate partitions.
So my question is this: Is it possible to invent a new partition table and assemble these three partitions into a valid disk image? Or even better, ignore the first two partitions and create a complete disk image with the third?
Turns out I should have just tested ImDisk. It is actually able to mount the NTFS partition images directly. Unfortunately chkdsk is not happy with the corrupted data partition, so it's time to bust out the programming skills and manually parse the NTFS data and compare to the working recovery/whatever partitions! (Actually I've been doing that for a few days now; it's surprisingly not that hard.)