1

I'm running Ubuntu and have access to Windows 10. I have an image of a disk that I created using GNU ddrescue. I tried using foremost on the image and foremost seems to create a separate folder named after each different file type that it encounters and it stuffs the matching files in there.

This completely destroys the original folder tree and making sense of all the resulting files becomes impossible.

I have a ton of photos on the image file. They are stored in numerous folders with names of where the photos were taken, when they were taken, etc. I really need to preserve the original folder tree.

Can anyone help me with this?

Contents of fdisk -l mybackup.img

Disk backup.img: 424.5 GB, 424541814784 bytes
255 heads, 63 sectors/track, 51614 cylinders, total 829183232 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0xeea5da13

     Device Boot      Start         End      Blocks   Id  System
backup.img1              63   976768064   488384001    7  HPFS/NTFS/exFAT

1 Answers1

0

Disclaimer

My answer applies to the situation when the image taken with ddrescue (or dd) is fully accurate (there were no read errors), underlying partition and filesystem are healthy. It is in fact not "recovery" but "gaining access". For someone with faulty disk or filesystem this may not apply.


Actual answer

Provided fdisk output shows that the image size is too small to hold the partition. I understand the question is related to this one. After you make your full image, you can simply mount the underlying partition:

sudo mount -o ro,offset=$((512*63)) mybackup.img /mnt

Notes:

  • Mount read-only (ro) to avoid accidental modification to the image.
  • Your image contains one partition; 63 is its offset in sector size units (512).
  • The mountpoint is /mnt; of course you can mount elsewhere.

Now you should be able to see your files and directory structure under /mnt/ (or wherever you decided to mount). Use cp -r, mc or another tool to copy.

Cleaning

When you are done, unmount by:

sudo umount /mnt