themaddoctor / linux-mybook-tools

tools for opening some encrypted WD My Book drives in linux
GNU General Public License v3.0
185 stars 26 forks source link

Scanning for Win partition. #22

Open Fratacchione opened 6 years ago

Fratacchione commented 6 years ago

So, to give everyone somewhat of a background: My pops fried the JMicron chip on his WD hdd. It had multiple partitions on it, at least 2. After the chip damage he tried to put it in a generic enclosure and open it via Windows, messing up the MBR on the drive. Thanks to @themaddoctor I managed to recover one of the partitions, the one created to be used with OSX, after a long search via a script that looked Megabyte-by-Megabyte for the partition mounting point. Now I was looking to recover another partition, the one made to be used with Windows, and @themaddoctor suggested me to edit the script and make it do a sector-by-sector search. Now, given that the script is the following:


#!/bin/bash

RESULT=""
megabytes=-1

while [ "$RESULT" = "" ]; do
      megabytes=`expr $megabytes + 1`
      offset=`expr $megabytes \* 2048`
      echo "current position = $megabytes MB"
      RESULT=`dd if="$1" skip=$offset count=1 status=none | file - |
grep
NTFS`
    done

echo
echo "$RESULT"
echo
echo "Found NTFS filesystem at offset $megabytes MB in $1"
echo

# end

Should I simply swap the '2048' with a '1'? Or some other value? Thanks anyone answering in advance.

themaddoctor commented 6 years ago

Blocks/sectors are 512 bytes. So 2048 does one MB at a time. Most modern and intelligent systems put partition boundaries at megabyte boundaries. Windows? Who knows? Using 2 will check every kB, if you want to try that.

Fratacchione commented 6 years ago

Ok, I tried running the script with '512' as its value. What I still have not clear is the reason why I'm using the script. Shouldn't that app 'testdisk' be able to find the 'Windows partition' mount point just as it did with the 'OSX' one?

themaddoctor commented 6 years ago

Sure try it.