[vox-tech] Rescuing NTFS partition

[Shwaine]

On Mon, 19 Mar 2012, Peter Salzman wrote:

> What exactly is the difference between dd (or ddrescue) which is how I
> normally rescued partitions in the past and ntfsclone?   Which tool
> would be more appropriate for rescuing as many files as possible?
>

dd doesn't care what filesystem is on the device, it just does a binary 
clone of the device to a file. ddrescue works similarly, but it is 
slightly modified in how it handles bad reads from the device.

Essentially, dd will make a brand new file for each time you run the 
command (wiping out whatever the last run recovered), but ddrescue will 
just alter the existing output file each time it is run (writing only the 
data it can read that pass to the appropriate offsets within the file). 
ddrescue will also circle back to bad sectors on each call and attempt 
several more reads before giving up and exiting (there is an option to 
make dd re-read bad sectors too). If you are having random bad reads with 
the device, ddrescue's behavior is very beneficial.

Another big difference with dd and ddrescue is they copy the ENTIRE drive, 
not just the used filesystem space like ntfsclone. That means your 
destination drive has to have enough free space to hold the image file, 
which will be at least as big as the original drive (perhaps slightly 
larger due to block size differences). Since you said the drive was new, 
I'm assuming 2GB was a typo and you actually meant 2TB. Having a 
sufficiently large destination drive for the cloning will be your biggest 
issue using these two tools.