Appendix.

Here are all the tools that made an arguably irreplaceable contribution in the recovery:

• Knoppix CD
• ddrescue
• DiskProbe
• fsstat (part of Knoppix)
• ext2 Installable File System (use with caution, as it may crap on your ext2 partition)
• Mount Image Pro
• vdk
• nfi
• chkdsk (part of Windows XP)
• ntbackup (part of Windows XP)
• Advanced EFS Data Recovery

Here are some additional links that I looked at, with more information:

• Hard disk recovery utilities
• Installing XP on external USB drive
• “PC Inspector” recovery software
• “Stellar” recovery software
• Forensics tools
• ddrescue documentation and discussion
• Knoppix boot options
• Tips on NTFS recovery from ddrescue image and log
• NTFS file system description
• More technical information about NTFS
• Ext2 file system description (I only found the section entitled “The ext2 Group Descriptor” to be helpful. I put little trust in the correctness of the rest.)
• Disk layout of ext2 and ocfs2 (The data structures and the example of what the Group Descriptor Table were useful. The rest like the “first data block” value is different from what is observed — although the examples use a block size of 1KB, which may make a difference.)

For the record, here are the two external disks I have with their ext2 partitions’ Superblocks shown:

100GB disk, just one ext2 partition, starts at sector 63.

160GB disk, there is a 20GB FAT32 partition, and the second ext2 partition starts at sector 41945715. This is the partition whose backup superblocks are all off by +1KB (but are otherwise correct), and hence has an illegal formatting.

And here are the ddrescue log files, from the first run and the second run.

Back to the beginning.