4TB Ntfs hdd, written (dd) 8GB iso image, possible recovery?

TL;DR

The 1st thing you should do (i am not sure if u have) is to find the backup VBR of the NTFS volume, from that backup VBR you will know the parameter of the NTFS volume, sector size, cluster size, location of $MFT, etc. This backup VBR locates at the end of the NTFS volume.

The 2nd thing you can do is to look for $MFT entry, a 1024 byte data structure starts with "FILE0" or "FILE*", however I dont know any tool out there other than EnCase which can look for that and recover the corresponding file.

Good luck.

Posted by: @mansiu

TL;DR

 

The 1st thing you should do (i am not sure if u have) is to find the backup VBR of the NTFS volume, from that backup VBR you will know the parameter of the NTFS volume, sector size, cluster size, location of $MFT, etc. This backup VBR locates at the end of the NTFS volume.

 

The 2nd thing you can do is to look for $MFT entry, a 1024 byte data structure starts with "FILE0" or "FILE*", however I dont know any tool out there other than EnCase which can look for that and recover the corresponding file.

 

Good luck.

 

I am struggling to understand the sense of your post.

You just repeated vaguely some parts of what was already said, without adding anything new or of relevance.

jaclaz