Yesterday, the old NVME drive in my sister's Windows laptop started to die and corrupted itself. Most stuff was stored in the cloud but a few things weren't, so I wanted to try to recover what I could. Not a big deal if we can't. I did a dd of the drive, but I foolishly did it partition-by-partition (not realising you can just dd the entire device). I now have three partition images: backup-nvme0n1p1.img, backup-nvme0n1p2.img and backup-nvme0n1p3.img. The third one is 237GB and contains the actual data. I have backups of the image files so I can mess with these as necessary.
I would just re-do the imaging properly, except we've now formatted the drive and reinstalled Windows (as an temporary emergency measure so she can use the laptop - we're not relying on the drive to store anything permanent, so long as it can function to run Windows for a couple of days).
I tried to mount the partition image directly in an Ubuntu VM with:
sudo mount -t ntfs -o loop backup-nvme0n1p3.img /mnt/test
...however the filesystem appears to be corrupt (which we already assumed):
ntfs_mst_post_read_fixup_warn: magic: 0xffffffff size: 1024 usa_ofs: 65535 usa_count: 65535: Invalid argument
Record 0 has no FILE magic (0xffffffff)
Failed to load $MFT: Input/output error
Failed to mount '/dev/loop9': Input/output error
NTFS is either inconsistent, or there is a hardware fault, or it's a
SoftRAID/FakeRAID hardware. In the first case run chkdsk /f on Windows
then reboot into Windows twice. The usage of the /f parameter is very
important! If the device is a SoftRAID/FakeRAID then first activate
it and mount a different device under the /dev/mapper/ directory, (e.g.
/dev/mapper/nvidia_eahaabcc1). Please see the 'dmraid' documentation
for more details.
ntfsfix also does not approve:
ntfsfix backup-nvme0n1p3.img
Mounting volume... ntfs_mst_post_read_fixup_warn: magic: 0xffffffff size: 1024 usa_ofs: 65535 usa_count: 65535: Invalid argument
Record 0 has no FILE magic (0xffffffff)
Failed to load $MFT: Input/output error
FAILED
Attempting to correct errors... ntfs_mst_post_read_fixup_warn: magic: 0xffffffff size: 1024 usa_ofs: 65535 usa_count: 65535: Invalid argument
Record 0 has no FILE magic (0xffffffff)
Failed to load $MFT: Input/output error
FAILED
Failed to startup volume: Input/output error
Checking for self-located MFT segment... ntfs_mst_post_read_fixup_warn: magic: 0xffffffff size: 1024 usa_ofs: 65535 usa_count: 65535: Invalid argument
OK
Unrecoverable error
Volume is corrupt. You should run chkdsk.
Ok, so I probably do want to try to mount it in Windows and run chkdsk. If it were an image of the whole drive I assume I could mount it as a virtual disk with something like ImDisk, but I don't know what I can do with three separate partitions.
So my question is this: Is it possible to invent a new partition table and assemble these three partitions into a valid disk image? Or even better, ignore the first two partitions and create a complete disk image with the third?
