The hard drive on my laptop has been giving me read errors, so I decided to back up the data on it.
I decided to use ddrescue to recover the data on the main NTFS partition. I first created a partition of a size slightly greater than the one I wanted to recover (about one or two Gb greater). After more than two days of non-stop copying with around 400 read error messages, ddrescue had finished.
When I tried to mount the partition however, I read
mount: wrong fs type, bad option, bad superblock on /dev/sdb1,
missing codepage or helper program, or other error
I checked dmesg as was advised but could not find anything pertaining to the device besides the point where it was plugged in, only audit messages.
I then ran ntfsfix, with output:
FAILED
Attempting to correct errors... NTFS signature is missing.
FAILED
Failed to startup volume: Invalid argument
NTFS signature is missing.
Trying the alternate boot sector
Unrecoverable error
Volume is corrupt. You should run chkdsk.
I then attempted to run chkdsk on the partition. The output was as follows:
The type of the filesystem is RAW.
CHKDSK is not available for RAW drives.
I thought this would mean the partition is not formatted, which would be odd since the partition it was copied from was. To investigate this, I used cmp on both the device descriptor of the original partition and of the copy, and found they differed in the first byte.
My question is, what should I do to recover the data from my hard drive?
- Is there a specific operation I should do on the recovered image?
- Should I try to use ddrescue to recover the partition again, or even the whole drive?
And additionally, I would be interested in insight into what caused this issue in the first place.