hello

is there any hope rescuing a damaged image (damaged while sending over SMB)

ntfsclone -r -O /dev/disk230/temp1 sda2.img
ntfsclone v2015.3.14AR.1 (libntfs-3g)
Ntfsclone image version: 10.1
Cluster size : 4096 bytes
Image volume size : 48015339520 bytes (48016 MB)
Image device size : 48015343616 bytes
Space in use : 35275 MB (73,5%)
Offset to image data : 56 (0x38) bytes
Restoring NTFS from image ...
ERROR: Bad offset at input location 0xeef705eb

i looked at the portion of file , contains zeroed bytes

i want to restore data wgich is intact, the restore stops at 11%

thank you very much

Mike

the attachment is from

dd if=sda2.img bs=4096 skip=978795 count=396 > chunk.data

Hi,


There is a valid cluster image at offset 0x35e9 followed by a damaged one starting at offset 0x45ea. The next valid cluster image starts at offset 0x17575b...

The lucky situation is that 0x17575b-0x45ea = 0x171171 and 0x171171 is a multiple of 4097. So there must exist a sequence of 369 consecutive clusters damaged in between.

Try to fill the gap from 0x45ea to 0x17575b with all bytes set to 0x01 (after making a backup of your original file...). Add 0xeef6b000 to get the offsets in your original file.

Regards

Jean-Pierre

thank you very much ! it worked !

i used following python code to repair it