[TriLUG] Linux tools for partition/file retrieval

[Steve Litt via TriLUG]

On Wed, 25 Dec 2019 20:40:00 -0500
Matthew Glassman via TriLUG <trilug at trilug.org> wrote:

> I have a windows SSD that I am trying to recover partition/data from.
>  The partition and files  may be corrupted. I can not (that is do NOT
> want to) write to the SSD. What tools are out there that would allow
> me to work with the filesystem and partitions to check for
> corruption, correct the issue/undelete  and then pull data off of
> this.

Make yourself a modern System Rescue CD DVD or thumb. Obtain a
formatted USB disk substantially bigger than the SSD. Boot System
Rescue CD, and your very first acts should be:

* mount /dev/sd?? /mnt/usbdisk

* ddrescue -r3 /dev/sda /mnt/usbdisk/sda.img /mnt/usbdisk/sda.log

* chmod a-w /mnt/usbdisk/sda.img

* chattr +i /mnt/usbdisk/sda.img

Note that Joe Mack recommends adding -n (noscrape) to the preceding
ddrescue command. I don't know the ramifications of doing so.

Once you've completed the preceding commands, you have a best-rescue
byte for byte copy of your ssd device. Now you can power down the
computer, and forever work off thesda.img file or a copy thereof.

SteveT

Steve Litt 
December 2019 featured book: Rapid Learning for the 21st Century
http://www.troubleshooters.com/rl21