Does anyone know of a piece of software that can perform a restartable raw copy of a disk drive?
You are basically describing GNU ddrescue which can be run from a bootable Linux live CD/DVD/USB (I like SystemRescueCD quite a lot).
Cloning the drive
First, you should identify the drives you have connected to your computer with the fdisk -l command. Here is a snippet from my hard drive:
# fdisk -l /dev/sd*Disk /dev/sda: 232,9 GiB, 250059350016 bytes, 488397168 sectorsUnits: sectors of 1 * 512 = 512 bytesSector size (logical/physical): 512 bytes / 512 bytesI/O size (minimum/optimal): 512 bytes / 512 bytesDisklabel type: dosDisk identifier: 0x8185b78cDevice Boot Start End Sectors Size Id Type/dev/sda1 * 2048 499711 497664 243M 83 Linux/dev/sda2 501758 488396799 487895042 232,7G 5 Extended/dev/sda5 501760 488396799 487895040 232,7G 83 Linux
The command shall be run as root (as you can tell from the # sign in the terminal) and I filtered on /dev/sd* to avoid showing ramdisks.
Now, assuming that I want to clone /dev/sda (the failing drive) inside /dev/sdb which is mounted as /media/user/External (the drive holding the image I am going to create), I will issue the following command (as root):
ddrescue /dev/sda /media/user/External/copy.img /media/user/External/status.log
The file /media/user/External/status.log is a log file used by the program to keep track of its progress. This way, you can interrupt the tool if you want to, then continue later.
Generally ddrescue won't be bothered by the failing hard drive. It will simply copy the good parts first, going back to the failing sectors later, trying smaller and smaller chunk sizes. This speeds up the copying process and guarantees better results.
You can use ddrescueview to get a real-time graphical representation of the cloning process.
Recovering files from the NTFS partition
Disclaimer: I am the author of RecuperaBit.
You can recover the contents of NTFS partitions using RecuperaBit. In my opinion, it is better than other open source solutions such as Testdisk and Autopsy because it gives good results even in case of heavy corruption. At least you can recover the files which are still intact and most of the directory structure.
RecuperaBit is a Python program that does not require installation. Once you have downloaded it (either via git or by downloading and extracing the ZIP file) you can run it with the following command line (pypy is suggested):
mkdir /media/user/External/recovered_filescd [full path of recuperabit]pypy main.py /media/user/External/copy.img -o /media/user/External/recovered_files -s /media/user/External/savefile.save
Once the scanning process is over, it will start to determine the geometry of any NTFS partitions it found. After that, you can run the command recoverable to see the partitions and then, to restore e.g. partition #2:
restore 2 5restore 2 -1
Where 5 means the Root directory and -1 means the Lost Files directory.
There are a few caveats you need to be aware of:
- RecuperaBit will try to find any NTFS partition, so it could be slow as there is currently no way to set up a threshold to avoid useless results
- NTFS compression is not supported, hence some files might not be restored
- Any deleted file or ghost file will be restored as well, for now you cannot choose to restore only allocated files
Other programs
There are many commercial (and a few open source) programs (especially for Windows) that can deal with NTFS recovery to various extents. I have listed and compared a bunch of them in my MSc thesis and in the accompanying slides. The following table shows my test results related to the accuracy of NTFS reconstruction with respect to 4 different disk images:
Further explanations and notes are given in my thesis. If you'd rather use a commercial GUI program I would recommend using either Restorer Ultimate or DMDE.