0

I am trying to recover deleted files from a Windows HDD (320 Gb) with multiple partitions. Have three questions:

  1. Will dd if=/dev/sdb of=~/image_sdb.img bs=4096 create an image of all partitions together?
  2. Will deleted files be included in the image?
  3. Can I use a recovery program like TestDisk directly on that image or are there reasons to prefer the original disk?
Improve this question

1 Answer 1

Reset to default
3

I don't know the answer to Question 1.

Deleted files will be included in a dd copy, since it is a byte-for-byte copy from the disk (not file-by-file).

If your recovery program can work on disk images, it should work the same as if it was a physical drive, once again because the image should be byte-for-byte the same as the disk.

EDIT
It appears that dd can be used to copy all partitions. The linked wiki page suggests using dd like this: dd if=/dev/sda of=/dev/sdb bs=4096 conv=notrunc,noerror,sync, so perhaps you should use dd if=/dev/sdb of=~/image_sdb.img bs=4096 conv=notrunc,noerror,sync.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .