Scan Isolated Complete Blocks in an Image

I. Freeze the Image Source Immediately

Preserve disk evidence first as described in Protect the Recovery Scene.

II. Configure Scan Ranges

MONGODBDATA=
EXTENT_MAP=
DISK_PATH=/recovery-input/mongodb/source/image-source
SOURCE_VERSION=8.0.0
SOURCE_KIND=imagecopy
SOURCE_FROZEN=true
RESMODE=all
EXMODE=bson
DSOFF=193
SCAN_END=24512
SCAN_STEP=512

Offsets, end positions and steps are examples; set them from actual sources. Scan ranges have inclusive starts and exclusive ends. Without a file origin, overflow address mappings cannot be resolved.

III. Scan and Export Complete-Block Candidates

ds idx;
ds idx status;
ds unload all;
ds log;

Retain complete parseable inline records and locations without automatically removing physical duplicates or inferring collection names from filenames or _id. Missing dependencies retain partial-source states.

IV. Handle Sources That Cannot Be Parsed as Complete Blocks

If block headers or cell boundaries are damaged but plaintext BSON remains, use deep-fragment recovery in a separate task. Recognizable compressed fragments can be decoded within bounds with readable prefixes retained. Undecoded damaged tails, missing dictionaries, ciphertext and overwritten bytes retain their failure reasons.

See the deep-fragment recovery procedure.

Output Files

Results are physical candidates within the selected range. Collection attribution, business time, arbitrary filesystem remnants and TRIM scenarios need further evidence. Bounded scanning is not complete collection recovery.

Retain native success, failure, unresolved dependencies, original errors and checkpoints. Completed-run resume reads native records and file metadata without checking exported content for counts, JSON, UTF-8, hashes, redecoding or trial import.