itz_nsn
February 8th, 2011, 12:57 AM
I was dual booting Ubuntu 10.10 with windows 7 on a Toshiba Satellite L305D laptop - recently ubuntu asked for an automatic update and after i did that, my grub was corrupted and i could not boot - i tried to use the live cd and repair but my partition table was messed up - my friend took a full disk image of my disk and now i have a 230GB ".img" file. I want to recover data from this file - i have been following blogs an reading articles - but very few articles on how to get data out of the .img file
i have the img file in a 1TB external drive
What i have tried till now
1. foremost - sudo foremost -w -i /img-file -o /recovery/foremost
tried to get an audit of the files that i can recover - foremost ran for a while and the output was empty
2. fsck.ext4 -y filename.img
e2fsck 1.41.12
fsck.ext4: Superblock invalid, trying backup blocks...
fsck.ext4: Bad magic number in super-block while trying to open naveenorig.img
The superblock could not be read or does not describe a correct ext2 file system. If the device is valid and it really contains an ext2 file system (and not swap or ufs or something else), then the super block is corrupt, and you might try running e2fsck with an alternate superblock: e2fsck -b 8193 <device>
I tried the alternate superblock and it gives me the same message
3. Sleuthkit mmls
Command : mmls filename.img
Result was "Cannot determine partition type (GPT or DOS at 0)"
Next i tried "mmls -t dos filename.img"
DOS Partition Table
Offset Sector: 0
Units are in 512-byte sectors
Slot Start End Length Description
00: Meta 0000000000 0000000000 0000000001 Primary Table (#0)
01: ----- 0000000000 0000000000 0000000001 Unallocated
02: 00:00 0000000001 4294967295 4294967295 GPT Safety Partition (0xEE)
I did not know what to do further - one tutorial said to multiply the offset by 512 and mount that partition, but i am not able to do that
4. Currently i am trying a file craver called Scalpel
scalpel filename.img -o /output-dir
I think it will run for the whole night
Is there any way to get the data out of the image file of my hard disk? If scalpel fails what should i do?
I have searched for softwares that can extract data from .img files but could not find any - i have started looking at professional softwares - can you suggest one?
Please help
Thank you for your time
i have the img file in a 1TB external drive
What i have tried till now
1. foremost - sudo foremost -w -i /img-file -o /recovery/foremost
tried to get an audit of the files that i can recover - foremost ran for a while and the output was empty
2. fsck.ext4 -y filename.img
e2fsck 1.41.12
fsck.ext4: Superblock invalid, trying backup blocks...
fsck.ext4: Bad magic number in super-block while trying to open naveenorig.img
The superblock could not be read or does not describe a correct ext2 file system. If the device is valid and it really contains an ext2 file system (and not swap or ufs or something else), then the super block is corrupt, and you might try running e2fsck with an alternate superblock: e2fsck -b 8193 <device>
I tried the alternate superblock and it gives me the same message
3. Sleuthkit mmls
Command : mmls filename.img
Result was "Cannot determine partition type (GPT or DOS at 0)"
Next i tried "mmls -t dos filename.img"
DOS Partition Table
Offset Sector: 0
Units are in 512-byte sectors
Slot Start End Length Description
00: Meta 0000000000 0000000000 0000000001 Primary Table (#0)
01: ----- 0000000000 0000000000 0000000001 Unallocated
02: 00:00 0000000001 4294967295 4294967295 GPT Safety Partition (0xEE)
I did not know what to do further - one tutorial said to multiply the offset by 512 and mount that partition, but i am not able to do that
4. Currently i am trying a file craver called Scalpel
scalpel filename.img -o /output-dir
I think it will run for the whole night
Is there any way to get the data out of the image file of my hard disk? If scalpel fails what should i do?
I have searched for softwares that can extract data from .img files but could not find any - i have started looking at professional softwares - can you suggest one?
Please help
Thank you for your time