Hello everybody,
my computer recently gave up on me. I couldn't get to the login windows screen anymore, but I did manage to create backup files with a recovery DVD I found, but it just made 233 separate .ddimage files. I did some googling and found that this must be some linux based process and frankly I don't understand much about that.
I have downloaded the "Access Data FTK Imager", but I'm hesitant to operate on a trial and error mode, because I really need some of the files that were (hopefully) saved in that backup.
The 233 .ddimage files are on my external storage.
What would be the best way to proceed?
I apologize in advance if that is a stupid question!
Â
Thanks,
Dave
It's not a stupid question.
1. Make copies of the files in question.
2. Open FTK Imager, add the first image file as an evidence item, and view the contents of the image to ensure that everything is loaded.
3. If you need one complete image, you're in a position to create it.
Dave, can you name the actual recovery DVD you used?
How (exactly) are the resulting images named?
Which size are them? I mean, are they all the same size (which size, in bytes) or are they different sizes?
How large in size is the original?
Is the original a disk (the whole thing) or a partition (or volume, i.e. the "whatever gets a drive letter in windows")?
How large in size is your external storage (and which filesystem it uses) and how much free pace do you have available on it?
Reasons for the above questions.
It is not uncommon that dd-like programs produce "split" files, usually because of some limitations on the storage media where they are to be saved, like (not anymore) floppy size (around 1.5 MB), CD size (around 650 MB), etc. or of the filesystem (FAT32 has a file limit around 4 GB).
233x4 GB would be around 1 TB, not an incredible amount of data but enough to easily result in some "tightness" of free work/storage space and take a bit of time to move around.
Â
jaclaz
ÂDave, can you name the actual recovery DVD you used?
- It's a DVD I found. It's from a computer magazine in Germany, which is where I am (Computer Bild Notfall DVD)
How (exactly) are the resulting images named?
- The files are named "ATA ST500LT012.....-466GB-s001.ddimage" up to ...s233.ddimage
Which size are them? I mean, are they all the same size (which size, in bytes) or are they different sizes?
- The sizes vary slightly, but all around 2GB
How large in size is the original?
- I don't know. I assume it's 466GB as in the file name?
Is the original a disk (the whole thing) or a partition (or volume, i.e. the "whatever gets a drive letter in windows")?
- The original was/is the Windows partition I was trying to save
How large in size is your external storage (and which filesystem it uses) and how much free pace do you have available on it?
- It's 1TB and I have 686GB of free space. The file system is FAT32
Â
Â
Ok, from the bottom.
The limit of filesize on FAT 32 i 2^32-1, i.e. 4,294,967,295 or around 4 GB, there is no way you can assemble a 486 GB image on that volume.
You need a NTFS volume with roughly 500 GB free space.
The 233 images x (roughly) 2 GB each do make sense, 233*2=466 which is the 486 GB +/-.
Very likely those are simply "split images".
As such you can re-join them with dd and a script or even more simply with COPY /B.
Open a command prompt, navigate to the directory where the 233 files are, then issue the command:
COPY /B "ATA ST500LT012*.ddimage" Z:\Joined233.dd
where Z:\ is the NTFS volume with 500 GB free space.
Please note how you need to enclose the source file name with double quotes (because the name contains at least one space) while (unless you use a target filename or path with spaces) you do not need that for the target.
If you are not familiar with command prompt, there are freeware GUI file splitters/joiners, most of them would require you to rename your files according to their naming/numbering scheme, one that doesn't need that is this one:Â
https://www.datanumen.com/file-splitter/
jaclaz
Â
Hello @jaclaz,
it took me a while to try your solution. I now have new external storage, formatted it to NTFS and was able to join the files with the datanumen software you suggested. The new file is in .dd format and is 481GB big.
However, I can't open the file because there seems to be no program that can read that sort of format.
I also wasn't able to put it as a partition with the recovery DVD (it says the file is bigger than the original partition, which is only 167GB). Why is the file still so big? And is there any way to view what's on there so I could extract just the files that I need and copy them to the main partition?
Â
Thanks a lot in advance!
Dave
The file is in .dd format (which means it has NO format at all) dd is a program that creates an exact copy of the source, i.e. the file is RAW, or "as raw" as the source was, the .dd is only an extension used by convention, but different program may for exactly the same non-format use .bin, .img, etc.
So the question now could be what the source was (it could have been either the whole disk or only a single volume), i.e. it is possible that you have the whole disk 480 GB even if you wanted to copy only the 167 GB partition/volume on it .
Anyway in both cases you need a software capable of accessing a disk or partition/volume image.
There are mainly three ways to access contents (presuming that the rebuilt file is good):
1) a virtual disk/volume driver, two examples:
a) IMDISK https://www.ltr-data.se/opencode.html/
b) Total Mounter https://www.kernsafe.com/product/totalmounter.aspx
2) a data recovery oriented tool, like DMDE:
https://dmde.com/download.html
3) an archive-like tool, like 7-zip:
https://www.7-zip.org/
The first type are drivers, and as such may be more complex to install and while they offer some advantages (read/write capabilities) if all you need is to access the copied filesystem to extract/copy from it the relevant files, the second option is I believe better, even because - within limits - DMDE can likely workaround some possible data corruption, after all we don't know why your system failed.
Usage of DMDE is not easy/peasy for data recovery, but hopefully in your case it is just a matter of:
1) running the tool
2) open the disk image with it
3) select the volume found
4) open it and explore the contents, then select and export the files you need.
But first thing, try 7-zip
jaclaz