TestDisk

You need to extract all the files from the archive before running TestDisk or PhotoRec.

Yes, TestDisk can work with disk images, including forensics images created by EnCase and FTK imager.

If your goal is to recover some precious files and you know where they are, in the advanced menu of TestDisk, select your partition, try to list the content of the filesystem and copy your files. If it doesn't work or if the hard disk is seriously damaged, it's usually better to clone the hard disk first.

By default, TestDisk copies the files in the current folder. For example, look at testdisk-6.11.3/win/ on a Windows computer or testdisk-6.12-WIP.

You can mount the image.dd file using the command 'mount -o loop,ro image.dd directory'. Alternatively, you can rename image.dd to image.img or image.dmg and double-click on the file. You can also specify the image pathname as a parameter to run TestDisk or PhotoRec on the disk image.

For FAT partitions, run 'scandisk c:' or 'chkdsk /f c:' from Windows. For NTFS partitions, run 'chkdsk /f c:' from Windows. For ReiserFS, if the superblock is missing, you can rebuild it with 'reiserfsck --rebuild-sb device'.

For DOS/Win9x, reinstall the system files with 'sys c:'. For Windows 2000/XP/2003, run 'fixmbr' from the Recovery Console and check 'c:\boot.ini'. For Windows Vista/Windows 7, run 'bootrec.exe /fixmbr' from the Recovery Console and check 'c:\boot.ini'. For Linux/FreeBSD, update your '/etc/fstab' to reflect the new partition order and reinstall the multiboot in the Master Boot Record.

TestDisk can undelete files from NTFS, FAT12, FAT16, FAT32, and ext2 filesystems. For ReiserFS, read the ReiserFS file undelete HOWTO. If the system is too badly damaged to be repaired or to allow file undeletion, try PhotoRec.