After DDRescue or data recovery

Archive Witness begins after low-level recovery. It does not image failing media, recover sectors, or replace GNU DDRescue or professional recovery tools.

Preserve recovery evidence first

Before establishing a new baseline, keep the recovered image or filesystem on healthy storage and preserve:

• the DDRescue mapfile and recovery logs;
• historical checksum manifests or catalog exports;
• known-good peer copies; and
• a separate backup of Archive Witness catalog data once assessment begins.

Do not reread a failing physical source merely to gather evidence that the recovery tool already captured more safely.

Start with inventory, not new checksum authority

For a recovered filesystem, begin with Inventory only and keep the archive read-only while reviewing what is visible. Inspect metadata/enumeration uncertainty before treating an absent file as definitely missing.

Apply historical checksum and peer evidence before creating replacement checksum authority. A historical checksum match can establish that recovered bytes are unchanged from the older accepted value. A newly created post-recovery checksum can only establish what Archive Witness can read now.

Important DDRescue caveat

Unrecovered regions in a newly created regular image can remain readable as zero-filled areas. A filesystem file overlapping such a region may therefore read successfully even though original sectors were not recovered.

That means:

• a normal filesystem read does not prove every original sector was recovered;
• a media decode can reveal some readable corruption, but a successful decode still does not prove historical byte identity; and
• without older checksums, peer evidence, format evidence, or mapfile correlation, some readable corruption may be indistinguishable from legitimate current bytes.

Keep the DDRescue mapfile as recovery provenance. Use recovery-aware tooling outside Archive Witness when file-to-bad-sector correlation is required.