Yes, I think that is a good point. With the logfile I can find out easily the unread blocks. I am not very experienced in Linux. Do you know a viewer that I can download quickly? I am running it on Linux UBUNTU and KDE desktop.
OK, I managed to find a sector viewer, and am able to compare the original disk and the image. It is quite interesting, some sections that were copied successfully to the image, I cannot read anymore on the original, but there are also large sections on the original that I can still read, and that did not get copied to the image. So I guess there is still something that can be done. I wonder if there is any ddrescue specialist that can help me. Or if there is another tool that can help out, please let me know.
I did a few searches and that model of hard disk is not particularly subject to this kind of failures.
There were - though more limited than the one involving the 7200.11 series - some issues with firmware, particularly on RAID setups and seemingly there are more cases than average of fried PCB/electronics, but nothing about the kind of issue you had.
OK, I managed to find a sector viewer, and am able to compare the original disk and the image. It is quite interesting, some sections that were copied successfully to the image, I cannot read anymore on the original, but there are also large sections on the original that I can still read, and that did not get copied to the image. So I guess there is still something that can be done. I wonder if there is any ddrescue specialist that can help me. Or if there is another tool that can help out, please let me know.
You can try imaging "in reverse" (as opposed to "going forward") see
http//www.forensicfocus.com/Forums/viewtopic/t=10839/
jaclaz
Well, with ddrescue even the -R option is not improving the situation. ddrescue really reads then the sectors from the back to the front, but still no success. Not sure if ddrescue makes a sector for sector approach, but at least it reads in reverse. The ineresting thing, in my HexViewer I can see many of the sectors that are marked in the logfile as faulty. I can see the content, it goes sometimes very slow, seems it needs various attempts to read the data, but I can read it. But in ddrescue I can read not a single byte. Any clue what can be done, or any other tool that can help me getting more data out, I would appreciate.
Well, I gave up on trying to recuperate more sectors of the disk. Have put the drive into the original USB case and I can see the filesystem fine. I have made no further tests that far on how much is really readable. I wonder if anybody can recommend a tool to recuperate in the file structure what is missing with this large numbers of bad blocks. The drive has NTFS file system and I look preferrably for a Windows tool.
It is possible that the different results you are getting are because ddrescue attempts to access the files in larger "chunks" using the cache while the disk editor loads one sector at the time (and/or uses "direct disk access"), but it is also possible that the disk editor gets some "gibberish" and interprets it all the same as valid data.
You should try again ddrescue with either direct disk access or "raw"device
http//
What I personally find an exceptionally good tool for NTFS (but not only) filessytem repair is DMDE, it has an almost fully functional free version, which in most cases is enough to do some fixes/extract a few files
http//dmde.com/
Please understand how - while also having the possibility to do an automated rebuild of the filesystem - DMDE is intended as an "advanced" tool and in order to use most of it's functions you will need a more than "basic" knowledge of the NTFS filesystem structures/ways of working.
Of course X-Ways (at a much steeper price) is a very good tool also for data recovery, besides forensics.
jaclaz