FAQ SearchLogin
Tuxera Home
View unanswered posts | View active topics It is currently Wed Nov 25, 2020 10:29



Post new topic Reply to topic  [ 21 posts ] 
Cannot mount an previously cloned image 
Author Message

Joined: Fri Jan 09, 2009 10:42
Posts: 10
Post Cannot mount an previously cloned image
I used ntfsclone to make an image about a year ago (probably didn't test it back then), here's the hexdump:
Code:
# dd if=TPx201_boot_ntfs.img | hexdump -C | head -n 10
00000000  00 6e 74 66 73 63 6c 6f  6e 65 2d 69 6d 61 67 65  |.ntfsclone-image|
00000010  0a 00 00 10 00 00 00 00  00 4b 00 00 00 00 ff af  |.........K......|
00000020  04 00 00 00 00 00 5a a9  02 00 00 00 00 00 38 00  |......Z.......8.|
00000030  00 00 00 00 00 00 00 00  01 eb 52 90 4e 54 46 53  |..........R.NTFS|
00000040  20 20 20 20 00 02 08 00  00 00 00 00 00 00 f8 00  |    ............|
00000050  00 3f 00 f0 00 00 08 00  00 00 00 00 00 80 00 80  |.?..............|
00000060  00 ff 7f 25 00 00 00 00  00 00 90 01 00 00 00 00  |...%............|
00000070  00 ff 57 02 00 00 00 00  00 f6 00 00 00 01 00 00  |..W.............|
00000080  00 7a 69 20 e2 a9 20 e2  3c 00 00 00 00 fa 33 c0  |.zi .. .<.....3.|
00000090  8e d0 bc 00 7c fb 68 c0  07 1f 1e 68 66 00 cb 88  |....|.h....hf...|

but now when I try to mount it:
Code:
# mount -o loop -t ntfs-3g TPx201_boot_ntfs.img /mnt/ntfs/
NTFS signature is missing.
Failed to mount '/dev/loop2': Invalid argument
The device '/dev/loop2' doesn't seem to have a valid NTFS.
Maybe the wrong device is used? Or the whole disk instead of a
partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?


Comparing this with an actual NTFS partition that I can mount:
Code:
# dd if=/dev/sda2 | hexdump -C | head
00000000  eb 52 90 4e 54 46 53 20  20 20 20 00 02 08 00 00  |.R.NTFS    .....|
00000010  00 00 00 00 00 f8 00 00  3f 00 f0 00 00 88 25 00  |........?.....%.|
00000020  00 00 00 00 80 00 80 00  98 11 40 06 00 00 00 00  |..........@.....|
00000030  00 00 0c 00 00 00 00 00  19 01 64 00 00 00 00 00  |..........d.....|
00000040  f6 00 00 00 01 00 00 00  c5 92 23 12 d3 23 12 3a  |..........#..#.:|
00000050  00 00 00 00 fa 33 c0 8e  d0 bc 00 7c fb 68 c0 07  |.....3.....|.h..|
00000060  1f 1e 68 66 00 cb 88 16  0e 00 66 81 3e 03 00 4e  |..hf......f.>..N|
00000070  54 46 53 75 15 b4 41 bb  aa 55 cd 13 72 0c 81 fb  |TFSu..A..U..r...|
00000080  55 aa 75 06 f7 c1 01 00  75 03 e9 d2 00 1e 83 ec  |U.u.....u.......|
00000090  18 68 1a 00 b4 48 8a 16  0e 00 8b f4 16 1f cd 13  |.h...H..........|

It seems like I should probably ignore the first 63 bytes or so. Why can't I mount an ntfscloned image?


Mon Feb 06, 2012 09:00
Profile

Joined: Fri Jan 09, 2009 10:42
Posts: 10
Post Re: Cannot mount an previously cloned image
Just realized, I need to restore the image first, which succeeded with a warning:
Code:
# ntfsclone -r -o test.img TPx201_boot_ntfs.img
ntfsclone v2012.1.15 (libntfs-3g)
Ntfsclone image version: 10.0
Cluster size           : 4096 bytes
Image volume size      : 1258287104 bytes (1259 MB)
Image device size      : 1258291200 bytes
Space in use           : 715 MB (56.8%)   
Offset to image data   : 56 (0x38) bytes
Restoring NTFS from image ...
Warning : no alternate boot sector in image
Syncing ...

But the new image still cannot mount
Code:
# mount -o loop,ro -t ntfs-3g test.img /mnt/ntfs/
Failed to read last sector (2457599): Invalid argument
HINTS: Either the volume is a RAID/LDM but it wasn't setup yet,
   or it was not setup correctly (e.g. by not using mdadm --build ...),
   or a wrong device is tried to be mounted,
   or the partition table is corrupt (partition is smaller than NTFS),
   or the NTFS boot sector is corrupt (NTFS size is not valid).
Failed to mount '/dev/loop2': Invalid argument
The device '/dev/loop2' doesn't seem to have a valid NTFS.
Maybe the wrong device is used? Or the whole disk instead of a
partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around


Mon Feb 06, 2012 09:20
Profile
NTFS-3G Lead Developer

Joined: Tue Sep 04, 2007 17:22
Posts: 1286
Post Re: Cannot mount an previously cloned image
Hi,

Quote:
# mount -o loop,ro -t ntfs-3g test.img /mnt/ntfs/
Failed to read last sector (2457599): Invalid argument

This problem is caused by restoring to a file (as opposed to restoring to a device) an old image. Old images did not contain the backup boot sector (hence the warning when you restored with a recent ntfsclone), and the image ended at the last used sector. So when you restore to a file, the last possible sector cannot be read, because the file is too short, hence the mount problem, though this last possible sector contains no useful data.

You would have no problem when restoring to a (large enough) partition.

You can still mount the file by calling ntfs-3g directly :
Code:
ntfs-3g test.img /mnt/ntfs

You can also extend the file to the expected size 2457600*512 = 1258291200 bytes, then mount in loop mode.
Code:
truncate -s 1258291200 test.img


Regards

Jean-Pierre


Mon Feb 06, 2012 10:19
Profile

Joined: Wed Oct 10, 2012 13:34
Posts: 15
Post Re: Cannot mount an previously cloned image
Hi.. this is the closest I got to something similar online.

I myself have an image from april 2010 but have more intrinsic errors it seems.


When I try to do ntfsclone -r [--rescue] -o file.img ntfsclone.img I get a

error in command code or so... from ntfsclone.c I see it means the cmd != {0,1}

and breaks at 6808 MB.

When I do a losetup with offset 57 sectors, then file -s will show up the x86 boot sector... bla bla instead of just warning: file does not fit in 512 bytes. ignoring end of file or so.


by doing a losetup then with the offset of 57, of ntfsclone.img I also get to the start of the .R.NTFS partition.

Now, the dev said here that ntfs-3g mount would work, but it does not in my case, even when I try the offset, or the 6.8 MB dump, and I also get the last sector error.

Tried truncating the output file from dd if=/dev/loop0 of=output.img

where loop0 came from:

losetup -f ntfsclone.img -o $((57*512))

when I do dd if=ntfsclone.img | hexdump -C

data is populated after the 6.8 MB mark so it is this cmd pointer in ntfsclone.c which well , something is wrong with.


Question is... can I somehow skip it or something?

When I do photorec ntfsclone.img I do indeed get back some txt files, java files and pictures but the txt files are mainly inf files or just well irrelevant files to me (re-installable system files mainly it seems.


I just don't get why this would go so wrongly.

I know ntfsclone isn't compatible with oem partitions and hidden sectors are not 63 but 234xxxx or so, so about 112 MB of hidden sectors, so *maybe* it's an image of the whole disk instead of just a windows partition.

Image size is 51 GB with 17 GB of used space. so ye...

at a loss, and have tried everything... the only thing is to re-compile ntfsclone.c .. and just ignore non 0,1 cmd values? and well don't know how to mark the areas or so_

ideas?

the pictures showed some of my personal pictures so indeed it is a backup of some value unfortunately but ye.. I been at it for 3 sessions of 4-5 hrs each time and just can't hack it sigh.


Wed Oct 10, 2012 22:13
Profile
NTFS-3G Lead Developer

Joined: Tue Sep 04, 2007 17:22
Posts: 1286
Post Re: Cannot mount an previously cloned image
Hi,

Quote:
When I try to do ntfsclone -r [--rescue] -o file.img ntfsclone.img I get a
error in command code or so... from ntfsclone.c I see it means the cmd != {0,1}
and breaks at 6808 MB.

This means your saved image (ntfsclone.img) is corrupt (the --rescue option is only meaningful when saving). What does your 6808MB limit mean ? Is it the size of file.img or the location in ntfsclone.img when the restore aborts ? How did you get this value, and what is the % displayed when it aborts ?
Quote:
When I do a losetup with offset 57 sectors, then file -s will show up the x86 boot sector... bla bla instead of just warning: file does not fit in 512 bytes. ignoring end of file or so.
by doing a losetup then with the offset of 57, of ntfsclone.img I also get to the start of the .R.NTFS partition.

This only means the bootsector is located at offset 57 in the image, but of course the image does not have the structure of a file system and you cannot mount it. You have to rebuild a file system image first.
Quote:
Now, the dev said here that ntfs-3g mount would work, but it does not in my case, even when I try the offset

You cannot ever mount an ntfsclone image if you do not restore it first. Again the image does not have the structure of a file system.
Quote:
or the 6.8 MB dump, and I also get the last sector error.

You may try doing a chkdsk on a truncated file system, but this will depend on what is lost after the truncation.
Quote:
data is populated after the 6.8 MB mark so it is this cmd pointer in ntfsclone.c which well , something is wrong with.

Something like that may succeed, through ignoring the corrupted record while doing the restore, but you have to get the records right.
Quote:
When I do photorec ntfsclone.img I do indeed get back some txt files,

This is meaningless, you have to restore the image before using photorec.
Quote:
so *maybe* it's an image of the whole disk instead of just a windows partition.

Not possible, ntfsclone can only save an NTFS partition, and it checks it before saving.

Can you extract the beginning of ntfsclone.img and the data around the corruption (is this 6.8MB or 6808MB ?)
Code:
dd if=ntfsclone.img of=beginning.data bs=512 count=1
gzip beginning.data
dd if=ntfsclone.img of=corruption.data skip=850432 bs=512 count=24
gzip corruption.data

And post the two resulting files beginning.data.gz and corruption.data.gz (only compressed files can be posted to this forum).
Now the skip value 850432 is computed for a corruption located at offset 6808000 : divide the offset by 4096, take one and multiply the integral part by 512 (680800/4096-1 = 1661.109 and 1661*512 = 850432).
If the corruption is at offset 6808*1024, you get 870912, if the corruption is at 6808MB you have to redo the computation with the exact value. As you are able to recompile, you can output the value of "pos" when the abort message is displayed, this is where the corruption occurs.

Regards

Jean-Pierre

***** edit ****

The above formula is wrong, you have to multiply by 8, not by 512, so the correct command to show a corruption at offset 680800 is : (680800/4096-1 = 1661.109 and 1661*8 = 13288)
Code:
dd if=ntfsclone.img of=corruption.data skip=13288 bs=512 count=24
gzip corruption.data


Thu Oct 11, 2012 09:37
Profile

Joined: Wed Oct 10, 2012 13:34
Posts: 15
Post Re: Cannot mount an previously cloned image
Bonjour Jean-Pierre.

je ne peus parler francais bien donc, je continuais dans Anglais. (I presume you know French from your name).

Let me post a bit more verbose.

I have ntfsclone.img called sysdrive1.img (as it is 51 GB it wouldn't seem as the whole disk no.. and since you say that is not possible, then we know the answer). It seems to be a vista drive and not windows 7 and since it is from 2010, I suspect it would be a backup for my landlord's computer.

EDIT**: It is indeed a vista SP1 image of his drive.

Note, I with photorec (and not testdisk which couldn't find any partition), rescued for some reason several vista inf files (irrelevant) but several personal pictures which I know to be his.

so command one:

Code:
# ntfsclone -r -o file.img sysdrive1.img
ntfsclone v2012.1.15 (libntfs-3g)
Ntfsclone image version: 10.0
Cluster size           : 4096 bytes
Image volume size      : 51572109312 bytes (51573 MB)
Image device size      : 51572113408 bytes
Space in use           : 17097 MB (33.2%)   
Offset to image data   : 56 (0x38) bytes
Restoring NTFS from image ...
ERROR: Invalid command code in image


Returns the failed cmd value instantly
Code:
# ls -al file.img;du -BK file.img
-rw------- 1 root root 51572109824 Oct 11 12:22 file.img
6808K   file.img

(so yes, sorry; I meant 6808 kB). This means offset=6971392 bytes.

I will do offset -2 sectors / 512 = 13614 (since we are counting a few sectors and seems ntfsclone control header is less than a sector).

Code:
dd if=sysdrive1.img of=break.data skip=13614 bs=512 count=24
gzip break.data


I see that a Microsoft cabinet file starts at 1024 bytes into the ntfsclone.img
else it's all 0's (sparse file?) before. To find entries before the 0's begin, I had to do something like this:

Code:
dd if=sysdrive1.img of=prezero.data skip=11050 bs=512 count=24
gzip prezero.data

(will add this one too for you).

Quote:
You cannot ever mount an ntfsclone image if you do not restore it first. Again the image does not have the structure of a file system.
Quote:
or the 6.8 MB dump, and I also get the last sector error.

You may try doing a chkdsk on a truncated file system, but this will depend on what is lost after the truncation.


Code:
# dd if=file.img | hexdump -C > file.img.output

Then I edited out most of the output, (there is an entry of a mft mirror at 000024xxx); the first sector and also the last.
Saved as file.img.output.snippet.gz

And finally for yours (the first one is of course redundant but adding it anyway).

Code:
dd if=sysdrive1.img of=beginning.data bs=512 count=1
gzip beginning.data
dd if=sysdrive1.img of=corruption.data skip=13288 bs=512 count=24
gzip corruption.data


Attachments:
beginning.data.gz [490 Bytes]
Downloaded 1322 times
break.data.gz [5.75 KiB]
Downloaded 1376 times
File comment: finding start of zero field (sparse?) which a file starts at 1024 bytes... a cabinet file.
prezero.data.gz [1.58 KiB]
Downloaded 1373 times
Fri Oct 12, 2012 14:02
Profile

Joined: Wed Oct 10, 2012 13:34
Posts: 15
Post Re: Cannot mount an previously cloned image
couldn\t add snippet it seemed...


Attachments:
file.img.output.snippet.gz [1.74 KiB]
Downloaded 1324 times
Fri Oct 12, 2012 15:05
Profile
NTFS-3G Lead Developer

Joined: Tue Sep 04, 2007 17:22
Posts: 1286
Post Re: Cannot mount an previously cloned image
Hi,

Quote:
Code:
# ls -al file.img;du -BK file.img
-rw------- 1 root root 51572109824 Oct 11 12:22 file.img
6808K   file.img

(so yes, sorry; I meant 6808 kB). This means offset=6971392 bytes.

I will do offset -2 sectors / 512 = 13614 (since we are counting a few sectors and seems ntfsclone control header is less than a sector).

This offset is NOT the one I need, it points to the output file, and has no much relation with the location of the corruption. I need the offset of corruption in the corrupted INPUT file (sysdrive1.img), and I indicated how to get the variable "pos".

However, I tend to think you have restored the full partition. You got a target size of 51572109824 bytes, instead of the expected 51572109312, only 512 bytes are missing (which are the backup boot sector, which is redundant and was not saved by older ntfsclone). What happens here is you have restored to a file which appears truncated. If you had saved to a partition, the full size of the partition would have been used.

You probably only have to resize the output by doing :
Code:
truncate -s 51572109312 file.img

(or "ntfsfix file.img" which will restore the backup boot sector).

If this is not ok, please report the location of the corruption in the input file and dump three clusters of 4096 bytes around the corruption.

*** edit ***

Well, according to ntfsclone, you should get 17097MB of used data. If you got only 6808KB (as shown by du), most of it is really missing.

Regards

Jean-Pierre


Fri Oct 12, 2012 15:59
Profile

Joined: Wed Oct 10, 2012 13:34
Posts: 15
Post Re: Cannot mount an previously cloned image
Hi there again.

I appreicate your response but you keep thinking I can't make any deductions from the issue at hand.

Like I say.. during restore it fails instantly.. no progress nada... thus the du -BK size showing the 6808K whereas

ls -al aka du --apparent-size or so, is the full partition size of ~51 GB (minus probably as you say, the last sector or so).

Output of both truncate (which I tried before posting alluding to I had read your proposals to OP) and ntfsfix:

# ntfsfix file.img
Mounting volume... ntfs_mst_post_read_fixup_warn: magic: 0x00000000 size: 1024 usa_ofs: 0 usa_count: 65535: Invalid argument
Record 0 has no FILE magic (0x0)
Failed to load $MFT: Input/output error
FAILED
Attempting to correct errors... ntfs_mst_post_read_fixup_warn: magic: 0x00000000 size: 1024 usa_ofs: 0 usa_count: 65535: Invalid argument
Record 0 has no FILE magic (0x0)
Failed to load $MFT: Input/output error
FAILED
Failed to startup volume: Input/output error
Checking for self-located MFT segment... ntfs_mst_post_read_fixup_warn: magic: 0x00000000 size: 1024 usa_ofs: 0 usa_count: 65535: Invalid argument
OK
ntfs_mst_post_read_fixup_warn: magic: 0x00000000 size: 1024 usa_ofs: 0 usa_count: 65535: Invalid argument
Record 0 has no FILE magic (0x0)
Failed to load $MFT: Input/output error
Volume is corrupt. You should run chkdsk.


In one of the output files however, I saw a MFT mirror entry... could this be useful for me to perhaps rebuild records?

And I did give you the output you desired... I simply added some more verbosity from the output file in case it could help.

I am not a lead developer in ntfs tools, after all.

(PS. Sorry for sounding a bit insulted here, but just had a personal fight).


Sat Oct 13, 2012 01:16
Profile
NTFS-3G Lead Developer

Joined: Tue Sep 04, 2007 17:22
Posts: 1286
Post Re: Cannot mount an previously cloned image
Hi,

Quote:
Like I say.. during restore it fails instantly.. no progress nada... thus the du -BK size showing the 6808K whereas

ls -al aka du --apparent-size or so, is the full partition size of ~51 GB (minus probably as you say, the last sector or so).

The figures are consistent, they just mean you have only filled 6808K (17GB expected) in a 51GB file.
Quote:
Output of both truncate (which I tried before posting alluding to I had read your proposals to OP) and ntfsfix:

Well, wrong guess... Restore did not go far enough to be useful.
Quote:
In one of the output files however, I saw a MFT mirror entry... could this be useful for me to perhaps rebuild records?

This will give you where the MFT is in the restored partition, not useful until you can restore the partition.
Quote:
And I did give you the output you desired... I simply added some more verbosity from the output file in case it could help.

No. I do not even know at which INPUT offset the processing stopped, so I cannot locate the error. You have output 6808K of data, but this does not mean you have input 6808K of data from sysdrive1.img, because of buffering and control codes.
Quote:
I am not a lead developer in ntfs tools, after all.

You were able to diagnose the error from the source code so I did not want to imply you were at a loss displaying the offset of the corruption. Anyway I have attached a patch for that, please apply, and post a segment of input file around the corruption (3 clusters or 24 sectors).

Regards

Jean-Pierre


Attachments:
error-location.patch.gz [278 Bytes]
Downloaded 1377 times
Sat Oct 13, 2012 09:12
Profile
NTFS-3G Lead Developer

Joined: Tue Sep 04, 2007 17:22
Posts: 1286
Post Re: Cannot mount an previously cloned image
Hi,

I have attached a new variant of the patch in order to detect another reported corruption which could be similar to yours.

Please try.

Note : I will not be able to work on it during the coming week.

Regards

Jean-Pierre


Attachments:
error-location.patch.gz [411 Bytes]
Downloaded 1350 times
Sun Oct 14, 2012 11:39
Profile

Joined: Wed Oct 10, 2012 13:34
Posts: 15
Post Re: Cannot mount an previously cloned image
hi again. Ye sorry about that. was a bad day.

And I did try to clone to a device thrice, all same result as restoring to file.

ok, so:

Code:
ntfsclone -r -o file.img ntfsclone.img                           
ntfsclone v2012.1.15 (libntfs-3g)
Ntfsclone image version: 10.0
Cluster size           : 4096 bytes
Image volume size      : 51572109312 bytes (51573 MB)
Image device size      : 51572113408 bytes
Space in use           : 17097 MB (33.2%)   
Offset to image data   : 56 (0x38) bytes
Restoring NTFS from image ...
ERROR: Invalid command code -66 at input offset 0x6a66e7


so offset is 6973159 bytes, like I did before with break.data I think?

Again, it is all zero's down up to at exactly 400, or 1024 bytes a Microsoft cabinet file appears.

here is the requested dump: hope offset is correctly calculated by me (dividing by 512 due to bs=512 and count=24 due to cluster size is 8 times larger).
$((6973159 / 512)) - 8 so a cluster and a bit before and about 2 after:
Code:
# dd if=ntfsclone.img of=corruption.data skip=13609 bs=512 count=24
gzip  corruption.data


Attachments:
corruption.data.gz [3.35 KiB]
Downloaded 1332 times
Sun Oct 14, 2012 13:24
Profile
NTFS-3G Lead Developer

Joined: Tue Sep 04, 2007 17:22
Posts: 1286
Post Re: Cannot mount an previously cloned image
Hi,

Your image is corrupted, and I have not found how to recover it.

The corruption is detected at offset 0x6a66e7, which means offset 0x14e7 in "corruption.data".

The previous block is expected about 4096 bytes before, and there is indeed a byte with value 1 at offset 0x4e6. This means a cluster starting at 0x4e7 and ending at 0x14e6, and another control code at 0x14e7, which is bad. The next block should be around 0x24e8, but this is also bad. Maybe offset 0x4e6 was not the real beginning of a cluster...

There is apparently a CAB file starting at 0xe00, but a file must start at the beginning of a cluster, and there is no control code just before 0xe00. Either this is wrong, or it is coincidence to find a beginning of file there.

What is worse is to find the CAB directory starting at about 0xe50 until at least 0x2fff, which is longer than a cluster without any possible control code being inserted. Very wrong.

Trying to get you out of this, I have written a "quick and dirty" program to try to locate the control codes from your image file (no quality assurance on this program). Just hope this will yield some location from which the image can be recovered.

Good luck.

Regards

Jean-Pierre


Attachments:
resync.gz [1.92 KiB]
Downloaded 1477 times
resync.c.gz [798 Bytes]
Downloaded 1570 times
Sun Oct 14, 2012 18:43
Profile
NTFS-3G Lead Developer

Joined: Tue Sep 04, 2007 17:22
Posts: 1286
Post Re: Cannot mount an previously cloned image
Hi,

Quote:
There is apparently a CAB file starting at 0xe00, but a file must start at the beginning of a cluster, and there is no control code just before 0xe00. Either this is wrong, or it is coincidence to find a beginning of file there.

Well, I have been thinking that the start of the CAB file is at 0x6a6000 in the input file. Is it really a coincidence that this is exactly the start of a cluster in the INPUT file, and at a location which is not bound to land at a beginning of a cluster in the OUTPUT file ? Above all, from this point on, no control code can be found over at least 8968 bytes.

Has a foreign record not been written over the image ?

Regards

Jean-Pierre


Sun Oct 14, 2012 22:14
Profile

Joined: Wed Oct 10, 2012 13:34
Posts: 15
Post Re: Cannot mount an previously cloned image
Hello again Jean-Pierre.

I don't even know how to edit.

Anyway, well it is from 2010 but I am fairly convinced from my methods I wouldn't have done that (written into it) as it was my landlord's system partition.

And yes.. this is why I reacted a bit because even if with control codes (the header seems to be ok of the ntfsclone mage).. it still fails at that offset.

And no, I haven't touched it since I used it. And perhaps there is some precarious situation with that cluster boundary, file bounday which somehow fails to give a proper cmd pointer somehow?

If I try compiling without that whole last else block (and allowing it) to go on as if it is either cmd = 0 or cmd =1 , does that have anything for it.

This image *could* have some private data, and just around then we lost a 1500 GB backup drive which is why I do not want to just throw it away, since he had some files and I saw some of mine. However, apart from that, this is not some high priority data with respect to your time at all although before coming to this thread, I had done all which can be done to recover and yet failed, meaning I felt something either a potential bug in ntfsclone (always useful for devs).. or if it could be pinpointed or confirmed where/what corruption is or has happened. I haven't really done much C ever except a little procedural programming back in 2000 but will see if I can do something with that function.

Thank you for your time and input.. highly appreciated :),

Malina.


Mon Oct 15, 2012 14:10
Profile

Joined: Wed Oct 10, 2012 13:34
Posts: 15
Post Re: Cannot mount an previously cloned image
AGain, I failed to see the post with the programs. Thanks.

I wanted initially to edit the comment on where the MSFC file was in offset.. either way, not important, you have picked up on more than I could.

resync gave an output of all valid sequences.

Code:
cat /root/resync.output | head -n5
Valid sequence from position 0x38
Valid sequence from position 0x1039
Valid sequence from position 0x203a
Valid sequence from position 0x303b
Valid sequence from position 0x303e

...

at /root/resync.output | tail -n5
Valid sequence from position 0x3fb479097
Valid sequence from position 0x3fb47a098
Valid sequence from position 0x3fb47b099
Valid sequence from position 0x3fb47c09a
Valid sequence from position 0x3fb47d09b



I am not sure what to do with these control code offsets though... dd skip them to extract files in the clusters?

ANyway, you have done more than enough.. and like me, you couldn't really figure out a way to recover it as such as a whole image.. and also doing it low level wise.

I couldn't have asked for more.


Mon Oct 15, 2012 16:33
Profile

Joined: Wed Oct 10, 2012 13:34
Posts: 15
Post Re: Cannot mount an previously cloned image
Oh and I forgot, as maybe some of those alternative edits in ntfsclone.c might be updated for further verbosity in other versions..

I don't think a foreign record has been written here but perhaps that is a trademark. I found at least the dump at where it fails odd.

This might help although I am not sure if this was the case during this backup.. but when I create 'oem' partitions for client computers,

I usually add it at the end (as long as bitlocker isn't involved) and I would sometimes with diskpart scripts create the end partition (id 27), as sda1 (partition 1) and the extended partition in front as sda2. This was something I changed but I believe back in 2010 I was doing it that way, as Service packs would, despite microsoft articles, update even if system partition was at end and I preferred the front of disk being available due to perfomance considerations. DOn't know if that could somehow have affected ntfsclone's logic but since you said ntfsclone doesn't image full disks then I don't think this would be relevant.


Mon Oct 15, 2012 17:45
Profile
NTFS-3G Lead Developer

Joined: Tue Sep 04, 2007 17:22
Posts: 1286
Post Re: Cannot mount an previously cloned image
Hi,

Quote:
resync gave an output of all valid sequences.

[code]cat /root/resync.output | head -n5
Valid sequence from position 0x38
Valid sequence from position 0x1039
Valid sequence from position 0x203a
Valid sequence from position 0x303b
Valid sequence from position 0x303e

...

at /root/resync.output | tail -n5
Valid sequence from position 0x3fb479097
Valid sequence from position 0x3fb47a098
Valid sequence from position 0x3fb47b099
Valid sequence from position 0x3fb47c09a
Valid sequence from position 0x3fb47d09b

I am not sure what to do with these control code offsets though... dd skip them to extract files in the clusters?

There is some hope recovering most of the data by skipping the corrupted region, if consecutive clusters are missing, which means control codes with value 1 every 4097 bytes. However for non consecutive clusters this would be value 0 every 4105 bytes, with a count of unused clusters which cannot be guessed.

The beginning is correct, so is the end, but the useful part is around position 0x6a6000. Can you post the valid sequences around this position ?

Regards

Jean-Pierre


Fri Oct 19, 2012 11:23
Profile

Joined: Tue Nov 05, 2013 07:12
Posts: 1
Post Re: Cannot mount an previously cloned image
Actually, I am facing the same problem with my clone image. Nothing described here works for me. I suppose then there is something wrong with the clone image. I really don't understand what went wrong. Anyway, thank you.


Tue Nov 05, 2013 13:59
Profile
NTFS-3G Lead Developer

Joined: Tue Sep 04, 2007 17:22
Posts: 1286
Post Re: Cannot mount an previously cloned image
Hi,
Quote:
Nothing described here works for me. I suppose then there is something wrong with the clone image. I really don't understand what went wrong.

Please provide details : commands used for saving, for restoring, error messages, etc.

Regards

Jean-Pierre


Tue Nov 05, 2013 14:41
Profile

Joined: Wed Oct 10, 2012 13:34
Posts: 15
Post Re: Cannot mount an previously cloned image
Hi again jpa.


I kept forgetting logging in and get back to you all that time ago.

I just wanted to say, I am very sorry I just disappeared when you put so much effort in helping me. So very rude :(

je desolee.

And want(ed) to add, thank you for so much help back then.. very noble.

I finally found which forum this was on as I fecked up a gpt ntfs thingy by ntfsresize but nvm that.

I kept on thinking about getting back to you and for what it;s worth.. thank you very much for all back then. :)


Sun Jan 19, 2014 14:36
Profile
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 21 posts ] 


Who is online

Users browsing this forum: No registered users and 5 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group.
Original forum style by Vjacheslav Trushkin.