[vox-tech] Rescuing NTFS partition

[Peter Salzman]

Hi all,

A 2GB Hitachi drive holding one NTFS partition got hosed.   The drive
is literally one year old, and my belief is that this is a hardware
failure, not a filesystem hosing.

I see the drive in BIOS, so perhaps not all is lost.  Windows fails to
even acknowledge the drive's existence, so I'm trying to rescue it on
Linux.  I've never rescued an NTFS partition before.

Doing some reading I found ntfsclone, so I figured the best thing to
do would be to make a copy of the drive.   I used:

ntfsclone --force --rescue -o /ftp/storage.img /dev/sdc1

but it's basically stuck at 57.71%:

ntfsclone v2011.4.12AR.4 (libntfs-3g)
NTFS volume version: 3.1
Cluster size       : 4096 bytes
Current volume size: 2000396288000 bytes (2000397 MB)
Current device size: 2000396289024 bytes (2000397 MB)
Scanning volume ...
56.71 percent completed

which generates entries in /var/log/messages along the lines of:


Mar 19 21:49:17 satan kernel: [3492239.910141] sd 10:0:0:0: [sdc]
Sense Key : Hardware Error [current]
Mar 19 21:49:17 satan kernel: [3492239.910146] sd 10:0:0:0: [sdc]
Add. Sense: No additional sense information
Mar 19 21:49:17 satan kernel: [3492239.910151] sd 10:0:0:0: [sdc] CDB:
Read(10): 28 00 00 62 57 a7 00 00 08 00
Mar 19 21:50:39 satan kernel: [3492321.522843] sd 10:0:0:0: [sdc]
Unhandled sense code

It's not even clear whether ntfsclone is actually *reading* the drive.
 Scanning could just be checking FS integrity.  Anyhow, I was curious
about something.

What exactly is the difference between dd (or ddrescue) which is how I
normally rescued partitions in the past and ntfsclone?   Which tool
would be more appropriate for rescuing as many files as possible?

Any words of wisdom from people who been here / done this?

Thanks!
Pete