I have a drive given to me by a family member who needs data recovered. It was running Windows XP Professional and was his work hard drive before retirement. His employer was able to recover data from it, however conveniently was unable to recover many GBs of personal data. I'm operating under the understanding that they just didn't try and/or didn't want to spend corporate resources on recovering a 25-year employee's personal documents from his company computer. When I try to mount the device with mount_ntfs I get the following message: [root at server /]# mount /dev/da0s1 /mount/drive1 mount: /dev/da0s1 : Invalid argument fdisk report: [root at server /]# fdisk /dev/da0 ******* Working on device /dev/da0 ******* parameters extracted from in-core disklabel are: cylinders=9729 heads=255 sectors/track=63 (16065 blks/cyl) Figures below won't work with BIOS for partitions not in cyl 1 parameters to be used for BIOS calculations are: cylinders=9729 heads=255 sectors/track=63 (16065 blks/cyl) Media sector size is 512 Warning: BIOS sector numbering starts with sector 1 Information from DOS bootblock is: The data for partition 1 is: sysid 7 (0x07),(NTFS, OS/2 HPFS, QNX-2 (16 bit) or Advanced UNIX) start 63, size 156295377 (76316 Meg), flag 0 beg: cyl 0/ head 1/ sector 1; end: cyl 1023/ head 239/ sector 63 The data for partition 2 is: <UNUSED> The data for partition 3 is: <UNUSED> The data for partition 4 is: <UNUSED> I was given leads to using ddrescue and dd but frankly that is outside of my realm of knowledge and 9 of the 10 NTFS partitions that refused to mount in Windows have mounted so far in FreeBSD (I'm running 8.0). The drive is presently connected via USB on a SATA sled. I know that there's something to be had on there somewhere: [root at server /]# more /dev/da0s1 <C2>^A<FD>S<A4>s;<E6>D+'<C8><E0>M;<CE>B<B2>uC@<ED><99><EB><C0><9E>N^K<FF><96>#W<E1><DA>^T^X<BB><C3>-^Z<D8>:<87><8D>O<CB><C8>I<AD><FF><AE><BD>v<D8><CA>V^Y^<E6><B2>mK<C2><BE><FA>^M]<C2><A9>"2Xj'j?r<CD>^A<99>~o<E4><85><B5><C7><93><DD><C1><85><D6>^E<D1><AC>|<F8><8C>w<DC><E4>}<E1>kZ<EA>v8<C8><BD>^Wp8<9D>^U"<9B> <97>`Iz@^F^C<B0>^K^U<A7>~JPs<C7>^^+#<B8><92>}<81><B5>%o<F0>S7<BC>^Y<93> <F0>Q<A3>J^]^Lt=K+<CE><BB><88>dN<C0><AE>1<9A>qY<D7>^^Xm Any help would be GREATLY appreciated. I'd like to recover all the family history files and photos that [corporate conglomerate redacted] could not do. Thanks a million! -- Ryan -------------- next part -------------- An HTML attachment was scrubbed... URL: http://mailman.mn-linux.org/pipermail/tclug-list/attachments/20100413/c9efa6c1/attachment.htm