Can't mount .img file created with ddrescue from failing NTFS drive

Help Desk General Help
1

After running ddrescue on my drive for who-knows-how-many days, I decided to cancel it. This was the output just before I cancelled:

     ipos:   12096 MB, non-trimmed:    4020 MB,  current rate:       0 B/s
     opos:   12096 MB, non-scraped:        0 B,  average rate:   2498 kB/s
non-tried:  242716 MB,  bad-sector:        0 B,    error rate:       0 B/s
  rescued:  753432 MB,   bad areas:        0,        run time:  3d 11h 45m
pct rescued:   75.33%, read errors:    62266,  remaining time:         n/a
                              time since last successful read:  2d  7h 10m
Copying non-tried blocks... Pass 5 (forwards)^C

After I ran mount, I got this:

$ sudo mount -t ntfs WDPassport-parents.img /mnt
ntfs_mst_post_read_fixup_warn: magic: 0x00000000  size: 1024   usa_ofs: 0  usa_count: 0: Invalid argument
Record 0 has no FILE magic (0x0)
Failed to load $MFT: Input/output error
Failed to mount '/dev/loop63': Input/output error
NTFS is either inconsistent, or there is a hardware fault, or it's a
SoftRAID/FakeRAID hardware. In the first case run chkdsk /f on Windows
then reboot into Windows twice. The usage of the /f parameter is very
important! If the device is a SoftRAID/FakeRAID then first activate
it and mount a different device under the /dev/mapper/ directory, (e.g.
/dev/mapper/nvidia_eahaabcc1). Please see the 'dmraid' documentation
for more details.

Output from fdisk:

$ fdisk -l WDPassport-parents.img
Disk WDPassport-parents.img: 931.5 GiB, 1000169537536 bytes, 1953456128 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x69205244

Device                  Boot      Start        End    Sectors   Size Id Type
WDPassport-parents.img1       218129509 1920119918 1701990410 811.6G 72 unknown
WDPassport-parents.img2       729050177 1273024900  543974724 259.4G 74 unknown
WDPassport-parents.img3       168653938  168653938          0     0B 65 Novell Netware 386
WDPassport-parents.img4      2692939776 2692991410      51635  25.2M  0 Empty

and with parted:

GNU Parted 3.2
Using /home/WDB4T/yamiyukisenpai/BACKUP/WDPassport-parents.img
Welcome to GNU Parted! Type 'help' to view a list of commands.
(parted) print                                                            
Model:  (file)
Disk /home/WDB4T/yamiyukisenpai/BACKUP/WDPassport-parents.img: 1000GB
Sector size (logical/physical): 512B/512B
Partition Table: loop
Disk Flags: 

Number  Start  End     Size    File system  Flags
 1      0.00B  1000GB  1000GB  ntfs

I already tried running Windows’ chkdisk on the drive months ago. Won’t work at all.

When I tried with kpartx:

$ sudo kpartx -av WDPassport-parents.img 
add map loop63p1 (253:0): 0 1701990410 linear 7:63 218129509
add map loop63p2 (253:1): 0 543974724 linear 7:63 729050177
device-mapper: reload ioctl on loop63p4  failed: Invalid argument
create/reload failed on loop63p4
2

Did you try adding the loop option to your mount command (-o loop)? It looks like mount was dealing with it already (/dev/loop[n]) but it’s been a while since I mounted an img (valid or otherwise) so just a thought that you might have to specify it explicitly.

Also, if there’s more than one partition in the disk image I think you have to provide the offset as well or it doesn’t know which partition you want.

3

You should be able to use of the offsets listed in the fdisk output to attempt to mount each partition separately.

Keep in mind, if the superblocks (that identify it as NTFS) are corrupt, it may never work. Give it a try though, as anything is possible.

you need the -o loop,offset=218129509

4

I’m worried that’s the case, I already tried the offset. :cry:

5

I’m really sorry to hear that. I’ve had to leave ddrescue going for a week before, and managed to recover very little data. All depends on the shape of the hardware.

If its really important, companies exist that can retrieve your data for you. It’s not cheap though.

6

thanks for the assist

7

Hi, if you still got that problem. I work in it forensics and am pretty sure I could help you, if you still have the need for it. Feel free to contact me.
Kind regards
Joe