hard drive - Creating a data rescue partition

07
2014-07
  • aldorado

    I am trying to recover deleted files from a Windows HDD (320 Gb) with multiple partitions. Have three questions:

    1. Will dd if=/dev/sdb of=~/image_sdb.img bs=4096 create an image of all partitions together?
    2. Will deleted files be included in the image?
    3. Can I use a recovery program like TestDisk directly on that image or are there reasons to prefer the original disk?
    • Answers
  • BenjiWiebe

    I don't know the answer to Question 1.

    Deleted files will be included in a dd copy, since it is a byte-for-byte copy from the disk (not file-by-file).

    If your recovery program can work on disk images, it should work the same as if it was a physical drive, once again because the image should be byte-for-byte the same as the disk.

    EDIT
    It appears that dd can be used to copy all partitions. The linked wiki page suggests using dd like this: dd if=/dev/sda of=/dev/sdb bs=4096 conv=notrunc,noerror,sync, so perhaps you should use dd if=/dev/sdb of=~/image_sdb.img bs=4096 conv=notrunc,noerror,sync.


    • Related Question

    laptop - How to make a partition if I have a partition.img file?
  • DM8

    I have an Acer laptop I've been toying with, at some point I backed up the 'Acer recovery' hidden partition using dd.
    iirc I used a LiveCD and something like:

    dd if=/dev/sda1 of=/mnt/remote/acer.img

    to store the 'partition'. I did not backup the entire drive. The resulting file is:

    5239471104 acer.aspire.5600.recovery.partition.img

    After that, I wiped the partition table and installed Ubuntu Netbook remix.

    Knowing that the .img size is:5239471104 bytes and the recovery partition was a hidden, primary near the start of the disk. What would I need to do, if I wanted to wipe the partition table again and re-create this 'recovery' partition exactly as it was?

    As an extra question, if anyone happens to know:
    Granted that I did not backup the entire disk, and the MBR has since been overwritten, would I be missing the 'recovery' functionality Acer laptops have? I am referring to using alt-F10 during BOOT to switch to Acer's recovery/installation environment.
    ( I'm guessing this is a BIOS function and not a boot-loader function, so if the partition is re-created exactly the way the BIOS recovery loader expects it to be, it should work, but that's just a guess )


    • Related Answers
  • JdeBP

    It's just an "MS Data" (MBR partitioning type 0x0C) volume. So create a primary MS Data volume and restore the image to it.

    Unfortunately, Acer's recovery utility also requires Acer-specific code in the Master Boot Record for the recovery procedure to work exactly as one expects. The Acer MBR boostrap code image is, fortunately however, stored in an rtmbr.bin file in the recovery partition itself, in a tools subdirectory. You should be able to extract the image file from the volume image using something like mtools.

    Restoring the MBR image from that file once extracted is tricky under Linux, because one has to remember to not copy the entire 512 bytes of the image, as the dd command will do by default, because that will overwrite the MBR partition table's four primary partition entries and effectively erase your whole partition table. Restoring the MBR image is a lot easier under Windows by dint of the simple fact that Acer supplies a Windows utility program that can do it. It's mbrwrwin.exe in the very same directory as the rtmbr.bin file, and the command to restore the Acer MBR image is

    mbrwrwin.exe install rtmbr.bin
    (Older versions are mbrwrdos.exe and rtmbrnb.bin.)

    On the gripping hand, one doesn't, strictly speaking, need the Acer MBR. It's there to force the Acer "PQSERVICE" volume to be bootstrapped instead of whatever partition is actually the active partition. One can equally well just bootstrap the Acer partition directly — from within a boot manager, say — and not worry about the Acer MBR bootstrap.

    The bad news is that the Acer restore utility is fussy about what it will restore over, in particular about how many and what types of partitions are in the partition table. But that's properly the subject of another question and answer.