Unable to recover data from a ddrescue image, help!

[toni_m]

Hello peeps,

I'm having some issues with a ddrescue image cloned from a dying Barracuda 7200.10 ST3160815AS model. The drive was split in 2 partitions (C:\ & D:\). The primary active partition (C:\) contains the Win 7 OS and a few apps and nothing else. No vital data that I need to extract from this partition. However the logical/data partition (D:\) has all my important data that I need to rescue, *desperately*.

I have used a few data recovery software to attempt recovering anything I can from the D: drive. All I see is just the names of my archived folders and files I want but cant be recovered .

It seems that boot sectors and/or partition tables on this clone are most likely corrupt or completely missing and the recovery software is unable to find, obviously. Thus it's showing the names of the folder/files I have on that partition, ONLY.

My question: Is there a way to reconstruct (or find) the partition table and be able to recover those data or is this case hopeless? Any suggestions/idea from an expert here, what to do?

Mind you, I'm not too proficient in HDD recovery, just an hobbyist who happened to have an outdated PC in the office which decided to drop the ball on me. :evil:

 

[pclab]

And what was the result of the image?
Did you get many bad/skipped sectors??

 

[toni_m]

Hey pclab,

According to the log file the bad/skipped sectors were bunched up only in one particular section of the platter, but not that many though.It seems like the surface is scratched somehow, just there. Look at the pic...

FYI, last time (before I had to go through dd-rescuing this drive) I attempted a backup restore of my C:\ partition with acronis true image which did not complete. The system refused to boot that day and I assumed something (a virus) corrupted the boot drive, but indeed it was the HDD giving up on me.I realized it when the restore procedure went half way through and acronis warned me that the restore was unable to complete due to a faulty device or smth. Can't remember, now...

So, my assumption is that the botched recovery attempt may have also contributed to the situation which I no longer have something meaningful to recover but just a bunch of corrupt data.

Q: Is there a way to examine the drive for such an issue and possibly find out what happened to the boot sectors? And where are they now?

Thanks

 

[pclab]

There's not so many errors really.
What software did you used to try to recover?
Try R-studio or Reclaime, or even DMDE and check the results.

 

[toni_m]

Well, I already tried r-studio. What I get from it is a bunch of files with indexed (not the original) names and when opened there is nothing but junk.
The next one I tried is GDB-NTFS (GetDataBack for NTFS). I think this one behaves somewhat more predictable. At least, it's recognizing that the image is split in 2 partitions and I could recognize my files because they have their original names intact. However, when trying to open them I get the warning: "The file is not valid", or for picture files (jpeg) nothing is displayed. "...file appears to be damaged, corrupted..." error.

But, what I see in the details panel of the GDB is smth interesting. The sector end for the 1st partition is at position 183794121 and the sector start for the 2nd partition is at 163842033. Now I'm not sure whether I interpreted these data correctly but if I'm right then the problem is overlapped partitions, which I need to resolve 1st in order to get my data back. That probably will require some *deep* analysis (perhaps hex editing the image or smth...not sure) to shift them back to original position.

If you want to take a look at some specific areas of the image or anything that may help the situation please add a comment.

 

[Amarbir[CDR-Labs]]

Well, I already tried r-studio. What I get from it is a bunch of files with indexed (not the original) names and when opened there is nothing but junk.
The next one I tried is GDB-NTFS (GetDataBack for NTFS). I think this one behaves somewhat more predictable. At least, it's recognizing that the image is split in 2 partitions and I could recognize my files because they have their original names intact. However, when trying to open them I get the warning: "The file is not valid", or for picture files (jpeg) nothing is displayed. "...file appears to be damaged, corrupted..." error.

But, what I see in the details panel of the GDB is smth interesting. The sector end for the 1st partition is at position 183794121 and the sector start for the 2nd partition is at 163842033. Now I'm not sure whether I interpreted these data correctly but if I'm right then the problem is overlapped partitions, which I need to resolve 1st in order to get my data back. That probably will require some *deep* analysis (perhaps hex editing the image or smth...not sure) to shift them back to original position.

If you want to take a look at some specific areas of the image or anything that may help the situation please add a comment.

Hi,
More or less your data is there asi i can see ,Please tell us what find of files you are looking .Secondly whatever tool you use try complete image scan and that should find the files even if the MBR has wrong info and overlapped partitions as you said ,Try Getdataback Simple Ver 5.01 and do a level 4 scan of entire hdd post results