Check out testdisk: http://www.cgsecurity.org/wiki/TestDisk. The fact that you can see the device at all is a pretty good sign. There's a decent chance that testdisk will be able to recreate the partition table and everything will come back. If that doesn't work, PhotoRec (http://www.cgsecurity.org/wiki/PhotoRec) might be able to pull of a good number of files (especially common ones like Word docs and image files), although you will lose the file names and directory structures at that point. As for ddrescue, you probably don't have to worry about it. Using ddrescue allows you to make a complete copy of the drive on another drive. This is most important if a drive is physically failing and reading from it is unreliable. It also gives you a nice safety net in case your recovery efforts accidentally make the situation worse, but if you're careful I don't think that's too likely. Ian On 04/13/2010 09:49 AM, Ryan Coleman wrote: > I have a drive given to me by a family member who needs data recovered. > It was running Windows XP Professional and was his work hard drive > before retirement. > > His employer was able to recover data from it, however conveniently was > unable to recover many GBs of personal data. I'm operating under the > understanding that they just didn't try and/or didn't want to spend > corporate resources on recovering a 25-year employee's personal > documents from his company computer. > > When I try to mount the device with /mount_ntfs /I get the following > message: > [root at server /]# mount /dev/da0s1 /mount/drive1 > /mount: /dev/da0s1 : Invalid argument/ > > fdisk report: > [root at server /]# fdisk /dev/da0 > /******* Working on device /dev/da0 *******/ > /parameters extracted from in-core disklabel are:/ > /cylinders=9729 heads=255 sectors/track=63 (16065 blks/cyl)/ > / > / > /Figures below won't work with BIOS for partitions not in cyl 1/ > /parameters to be used for BIOS calculations are:/ > /cylinders=9729 heads=255 sectors/track=63 (16065 blks/cyl)/ > / > / > /Media sector size is 512/ > /Warning: BIOS sector numbering starts with sector 1/ > /Information from DOS bootblock is:/ > /The data for partition 1 is:/ > /sysid 7 (0x07),(NTFS, OS/2 HPFS, QNX-2 (16 bit) or Advanced UNIX)/ > / start 63, size 156295377 (76316 Meg), flag 0/ > / beg: cyl 0/ head 1/ sector 1;/ > / end: cyl 1023/ head 239/ sector 63/ > /The data for partition 2 is:/ > /<UNUSED>/ > /The data for partition 3 is:/ > /<UNUSED>/ > /The data for partition 4 is:/ > /<UNUSED>/ > > I was given leads to using ddrescue and dd but frankly that is outside > of my realm of knowledge and 9 of the 10 NTFS partitions that refused > to mount in Windows have mounted so far in FreeBSD (I'm running 8.0). > > The drive is presently connected via USB on a SATA sled. > > I know that there's something to be had on there somewhere: > > [root at server /]# more /dev/da0s1 > /<C2>^A<FD>S<A4>s;<E6>D+'<C8><E0>M;<CE>B<B2>uC@<ED><99><EB><C0><9E>N^K<FF><96>#W<E1><DA>^T^X<BB><C3>-^Z<D8>:<87><8D>O<CB><C8>I<AD><FF><AE><BD>v<D8><CA>V^Y^<E6><B2>mK<C2><BE><FA>^M]<C2><A9>"2Xj'j?r<CD>^A<99>~o<E4><85><B5><C7><93><DD><C1><85><D6>^E<D1><AC>|<F8><8C>w<DC><E4>}<E1>kZ<EA>v8<C8><BD>^Wp8<9D>^U"<9B> > <97>`Iz@^F^C<B0>^K^U<A7>~JPs<C7>^^+#<B8><92>}<81><B5>%o<F0>S7<BC>^Y<93>/ > /<F0>Q<A3>J^]^Lt=K+<CE><BB><88>dN<C0><AE>1<9A>qY<D7>^^Xm/ > / > / > Any help would be GREATLY appreciated. I'd like to recover all the > family history files and photos that [corporate conglomerate redacted] > could not do. > > Thanks a million! > > -- > Ryan > > > > _______________________________________________ > TCLUG Mailing List - Minneapolis/St. Paul, Minnesota > tclug-list at mn-linux.org > http://mailman.mn-linux.org/mailman/listinfo/tclug-list -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 302 bytes Desc: OpenPGP digital signature Url : http://mailman.mn-linux.org/pipermail/tclug-list/attachments/20100413/01353d71/attachment.pgp