Recovering files from a disk image

[Poxer]

Thanks for Recuva:

 

Thanks for a wonderful application which have saved me many times, even if I do proper backups the most important thing is always the one missing.

 

Suggestion:

 

Add the function to search a 1:1 disk image in Recuva, even with other filesystems the files on block level do not look that different do they? Remember that a 1:1 disk image created by DD may or may not have a file extension.

 

Background history:

 

Not long ago I connected a rather new Android device to my computer to backup all pictures and movies. It connected trough the PTP protocoll which did only show certain sound and image files. This combined with my quick delete finger did not make a good combination, I deleted a folder I thought was empty.

 

This was something I discover later when I looked at the device and discovered there were another protocol to use(mode) MTP so I switched and began to see more files, but I could not find my movies. Because both these protocols do not allow the user to access blocks directly I had to root the device and use the DD command to make a 1:1 copy of the disk to my memory card, because of how Recuva works. I honestly don't know how one would recover in another way. The good old UMS (USB Mass Storage) protocol is not available on the newer Android systems which makes recovering a lot harder. That is something which should be discussed with Google though.

 

Anyway now I am sitting here with this 1:1 disk image which to begin with works poorly in a Windows environment because of the filesystems. So even if I mount it using an application such as Alcohol 120% I would not be able to access the partitions because they are according to Windows 'broken' or RAW because Windows does not understand linux filesystems.

[Alan_B]

A Macrium Reflect image of a NTFS partition can be "mounted" and Recuva considers this invalid and refuses to process it.

This is nothing to do with Linux. It MIGHT be due to the fact that Windows permits only read access to the image, and does NOT permit Write access.

Strangely, Defraggler is very happy to ANALYZE the mounted image, even though it cannot shuffle fragments around.

 

Since Recuva has no business writing to a partition with lost files,

it SHOULD require only a simple code change for Recuva to process write protected partitions that are virtual (mounted) and not real (on an HDD).

 

A Macrium Reflect image of a NTFS partition can be "restored" to unallocated space and Recuva can process that.

Perhaps you can do something similar with your DD image,

and then perhaps you may need a new topic requiring Recuva to have the ability to process a Linux partition.