Recovering NTFS partition (Newbie)

[Davidsa]

I want to recover some data from a corrupted NTFS partition which has Windows XP Pro (among other things) installed on it.

Knoppix/Konquerer "sees" only a FAT (plain FAT, not FAT32) partition on the disk which I imagine is the XP recovery consol. I do not need to preserve this partition or the files in it.

How do I make Knoppix "see" the NTFS partition?

I realize Knoppix won't write to an NTFS partition. I have another, working hard disk formatted FAT32 with enough space to take the data I need to recover.

Many thanks in advance for suggestions. I have no previous experience of Linux/Knoppix.

David

[mzilikazi]

Well I have no idea about Konqueror but I would personally just do this:

fdisk -l /dev/hda

OR

fdisk -l /dev/hdb

or where ever your drive is. Then, you *should* be able to mount it.

mount /dev/hda2 /mnt/hda2

If /mnt/hda2 doesn't exist simply mount it somewhere else. Anywhere will do.

[j.drake]

I want to recover some data from a corrupted NTFS partition which has Windows XP Pro (among other things) installed on it.

Knoppix/Konquerer "sees" only a FAT (plain FAT, not FAT32) partition on the disk which I imagine is the XP recovery consol. I do not need to preserve this partition or the files in it.

How do I make Knoppix "see" the NTFS partition?

I realize Knoppix won't write to an NTFS partition. I have another, working hard disk formatted FAT32 with enough space to take the data I need to recover.

Many thanks in advance for suggestions. I have no previous experience of Linux/Knoppix.

David

By any chance, are you using a program called GoBack?

http://www.knoppix.net/forum/viewtopic.php?p=21961#21961

[user unknown]

If /mnt/hda2 doesn't exist simply mount it somewhere else. Anywhere will do.

If /mnt/hda2 doesn't exist, call

mkdir /mnt/hda2

mounting it just somewhere will hide that folder, so mounting to /bin will perhaps do, but then you are caught, because 'umount' is hidden (and a lot of importants programs too).

I guess mzilikazi meant 'anywhere in /mnt/ (i.e.: /mnt/winpartition)' will do.
Just to prevent unlikely errors...

[j.drake]

I want to recover some data from a corrupted NTFS partition which has Windows XP Pro (among other things) installed on it.

Knoppix/Konquerer "sees" only a FAT (plain FAT, not FAT32) partition on the disk which I imagine is the XP recovery consol. I do not need to preserve this partition or the files in it.

How do I make Knoppix "see" the NTFS partition?

I realize Knoppix won't write to an NTFS partition. I have another, working hard disk formatted FAT32 with enough space to take the data I need to recover.

Many thanks in advance for suggestions. I have no previous experience of Linux/Knoppix.

David

The following thread:
http://www.knoppix.net/forum/viewtopic.php?t=4887&highlight=
chronicles my newbie journey through a very similar problem about a year ago, when my Windows would not boot due to a motherboard problem, and I had to back up an NTFS drive onto a second HD before returning the computer for warranty service. Knoppix 3.2 saved me. Back then, K3B did not support my DVD+R/RW drive, and I needed to save some video files which were too large to fit on a CD. If you have the patience to read through it, it might be of help. I will tell you that I've never heard this solution suggested anywhere else, and the copy process took a surprising amount of time to complete.

Good luck,

JD

[Davidsa]

Well I have no idea about Konqueror but I would personally just do this:

fdisk -l /dev/hda

OR

fdisk -l /dev/hdb

or where ever your drive is. Then, you *should* be able to mount it.

mount /dev/hda2 /mnt/hda2

If /mnt/hda2 doesn't exist simply mount it somewhere else. Anywhere will do.

Thanks - but when I try this I get an error message something like "Unable to open /dev/hda "

What am I missing?

David

[Davidsa]

I want to recover some data from a corrupted NTFS partition which has Windows XP Pro (among other things) installed on it.

Knoppix/Konquerer "sees" only a FAT (plain FAT, not FAT32) partition on the disk which I imagine is the XP recovery consol. I do not need to preserve this partition or the files in it.

How do I make Knoppix "see" the NTFS partition?

I realize Knoppix won't write to an NTFS partition. I have another, working hard disk formatted FAT32 with enough space to take the data I need to recover.

Many thanks in advance for suggestions. I have no previous experience of Linux/Knoppix.

David

By any chance, are you using a program called GoBack?

http://www.knoppix.net/forum/viewtopic.php?p=21961#21961


No - Norton Antivirus is on there, but on this drive I have only ever used the other Norton tools from the HD.

David

[Davidsa]

If /mnt/hda2 doesn't exist simply mount it somewhere else. Anywhere will do.

If /mnt/hda2 doesn't exist, call

mkdir /mnt/hda2

mounting it just somewhere will hide that folder, so mounting to /bin will perhaps do, but then you are caught, because 'umount' is hidden (and a lot of importants programs too).

I guess mzilikazi meant 'anywhere in /mnt/ (i.e.: /mnt/winpartition)' will do.
Just to prevent unlikely errors...

Thanks but I haven't got that far yet!

David

[Davidsa]

I want to recover some data from a corrupted NTFS partition which has Windows XP Pro (among other things) installed on it.

Knoppix/Konquerer "sees" only a FAT (plain FAT, not FAT32) partition on the disk which I imagine is the XP recovery consol. I do not need to preserve this partition or the files in it.

How do I make Knoppix "see" the NTFS partition?

I realize Knoppix won't write to an NTFS partition. I have another, working hard disk formatted FAT32 with enough space to take the data I need to recover.

Many thanks in advance for suggestions. I have no previous experience of Linux/Knoppix.

David

The following thread:
http://www.knoppix.net/forum/viewtopic.php?t=4887&highlight=
chronicles my newbie journey through a very similar problem about a year ago, when my Windows would not boot due to a motherboard problem, and I had to back up an NTFS drive onto a second HD before returning the computer for warranty service. Knoppix 3.2 saved me. Back then, K3B did not support my DVD+R/RW drive, and I needed to save some video files which were too large to fit on a CD. If you have the patience to read through it, it might be of help. I will tell you that I've never heard this solution suggested anywhere else, and the copy process took a surprising amount of time to complete.

Good luck,

JD

Not exactly the same but your experience is indeed relevant and useful

Thanks

David

[mzilikazi]

Thanks - but when I try this I get an error message something like "Unable to open /dev/hda "

What am I missing?

David

Try it as root. ;)

[Davidsa]

Thanks - but when I try this I get an error message something like "Unable to open /dev/hda "

What am I missing?

David

Try it as root. ;)

OK, thanks. I now seem to have the HDs (both of them).mounted. But now the drive with the corrupted NTFS partition gives an 'Access denied" message although I CAN access and manipulate the other one with the FAT32 partition.

How can I give myself permisson to access my own hard disk?

Fdisk listed more partitions on the NTFS disk than I thought were there.

I can't seem to navigate between partitiions although I can move between disks.

The icon on the desktop for the NTFS hard disk has a green flash on its bottom RH corner, but not the other one. What does this mean?

Thanks again for any pointers - and apologies for my current state of ignorance.

David

[mzilikazi]

Issue this:
mount

Is your partition mounted rw? If not:

mount -o remount,rw /mnt/hdx?

Then you should be able to access the drive. Also you likely need to access the drives as root unless you've changed permission somewhere yourself.


I can't seem to navigate between partitiions although I can move between disks.

Not exactly sure what you meant here but you'll need to mount each partition before you can access them. If that's not what you meant perhaps you could restate your question?

[Dave_Bechtel]

--Are you crazy? You *never* want to mount something over /bin, it will break things severely. This is why you make /mnt/tmp directories; mkdir /tmp/blah or even /ramdisk/tmp will work.



If /mnt/hda2 doesn't exist simply mount it somewhere else. Anywhere will do.

If /mnt/hda2 doesn't exist, call

mkdir /mnt/hda2

mounting it just somewhere will hide that folder, so mounting to /bin will perhaps do, but then you are caught, because 'umount' is hidden (and a lot of importants programs too).

I guess mzilikazi meant 'anywhere in /mnt/ (i.e.: /mnt/winpartition)' will do.
Just to prevent unlikely errors...

[Dave_Bechtel]

--Post the results of ' fdisk -l ' as root, so we can tell you exactly what to do. We're just guessing at what your HD looks like here until we can see this for ourselves...





Thanks - but when I try this I get an error message something like "Unable to open /dev/hda "

What am I missing?

David

Try it as root. ;)

OK, thanks. I now seem to have the HDs (both of them).mounted. But now the drive with the corrupted NTFS partition gives an 'Access denied" message although I CAN access and manipulate the other one with the FAT32 partition.

How can I give myself permisson to access my own hard disk?

Fdisk listed more partitions on the NTFS disk than I thought were there.

I can't seem to navigate between partitiions although I can move between disks.

The icon on the desktop for the NTFS hard disk has a green flash on its bottom RH corner, but not the other one. What does this mean?

Thanks again for any pointers - and apologies for my current state of ignorance.

David

[Davidsa]

--Post the results of ' fdisk -l ' as root, so we can tell you exactly what to do. We're just guessing at what your HD looks like here until we can see this for ourselves...

OK here goes:-

Disk /dev/hdd: 123.5 GB, 123522416640 bytes
255 heads, 63 sectors/track, 15017 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

Device Boot Start End Blocks Id System
/dev/hdd1 * 1 15016 120615988+ 7 HPFS/NTFS

Disk /dev/hda: 30.0 GB, 30020272128 bytes
16 heads, 63 sectors/track, 58168 cylinders
Units = cylinders of 1008 * 512 = 516096 bytes

Device Boot Start End Blocks Id System
/dev/hda1 * 1 58168 29316640+ c W95 FAT32 (LBA)


Also:-

fdisk -l /dev/hdd1

Disk /dev/hdd1: 123.5 GB, 123510772224 bytes
255 heads, 63 sectors/track, 15015 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

Device Boot Start End Blocks Id System
/dev/hdd1p1 ? 116388 126889 84344761 69 Unknown
Partition 1 does not end on cylinder boundary.
/dev/hdd1p2 ? 105915 222310 934940732+ 73 Unknown
Partition 2 does not end on cylinder boundary.
/dev/hdd1p3 ? 1 1 0 74 Unknown
Partition 3 does not end on cylinder boundary.
/dev/hdd1p4 1 213826 1717556736 0 Empty
Partition 4 does not end on cylinder boundary.

Partition table entries are not in disk order

The bigger disk is currently set up as slave on ide 2, but until it crashed it was the master on ide 1. It has Win XP pro on it, with the 'recovery console' installed. Indeed, clicking the hdd1 icon on the Knoppix desktop shows a FAT partition only which I imagine is this. console.

I have enough room on the hda1 disk for all the data I need to recover from the hdd1 disk (which is currently running Win2K)

When I have recovered what I need I will reformat the bigger disk, put it back as primary master and reinstall WinXP, and put in a partition for an intial toe dip into Linux (haven't yet decided on distro).

I am trying to get my head around the way partitions etc work in Linux cf Windows/DOS. I'm also discovering that things like 'mkdir' aren't quite the same! javascript:emoticon(':(')

I hope the above is enough to go on - many thanks in advance for suggestions.

David











Thanks - but when I try this I get an error message something like "Unable to open /dev/hda "

What am I missing?

David

Try it as root. ;)

OK, thanks. I now seem to have the HDs (both of them).mounted. But now the drive with the corrupted NTFS partition gives an 'Access denied" message although I CAN access and manipulate the other one with the FAT32 partition.

How can I give myself permisson to access my own hard disk?

Fdisk listed more partitions on the NTFS disk than I thought were there.

I can't seem to navigate between partitiions although I can move between disks.

The icon on the desktop for the NTFS hard disk has a green flash on its bottom RH corner, but not the other one. What does this mean?

Thanks again for any pointers - and apologies for my current state of ignorance.

David

[Dave_Bechtel]

--Well, hda looks OK, but hdd definitely looks pretty screwed up - I've never seen anything like that before. (smacks head) Oh wait, I get it now...

--You're not supposed do do fdisk on sub-devices... Only "main" or "top-level" devices, like hdd, sda, that sort of thing. Trying to do an fdisk on hdd1 only confuses the program. Stick to ' fdisk -l /dev/hdd '.

--What you want to do is this:

o Boot the livecd
o Switch to Ctrl-Alt-F1 console (the GUI will still be active on Alt-F5 or Alt-F7)

' mkdir /mnt/ntfs ' == Arbitrary mount point
' mkdir /mnt/fat32 '

' mount /dev/hdd1 /mnt/ntfs ' == If this fails or the resulting filenames look weird, look at ' man mount ' and see if it needs additional translation; you might have to do:
o ' umount /mnt/ntfs; mount /dev/hdd1 /mnt/ntfs -outf8,ro '

--Now you can mount the fat32:

' mount /dev/hda1 /mnt/fat32 ' == It will mount R/W by default

' cd /mnt/ntfs '
' ls -al '

--Now I recommend you run ' mc ' and start copying files. It should start up with /mnt/ntfs in the left pane; hit Tab and type:
' cd /mnt/fat32 '
to get that directory in the other pane. Hit Tab again to get back to the original pane. Now you can tag files/dirs by hitting Insert, and use the F5 key to Copy. (Note that tagging files only works for the current directory and below; meaning: if you tag files in the root dir and then hit Enter to drop down into a subdir, the rootdir files won't be tagged anymore. But tagging a top-level directory also grabs everything beneath it by implication.)



--Post the results of ' fdisk -l ' as root, so we can tell you exactly what to do. We're just guessing at what your HD looks like here until we can see this for ourselves...

OK here goes:-

Disk /dev/hdd: 123.5 GB, 123522416640 bytes
255 heads, 63 sectors/track, 15017 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

Device Boot Start End Blocks Id System
/dev/hdd1 * 1 15016 120615988+ 7 HPFS/NTFS

Disk /dev/hda: 30.0 GB, 30020272128 bytes
16 heads, 63 sectors/track, 58168 cylinders
Units = cylinders of 1008 * 512 = 516096 bytes

Device Boot Start End Blocks Id System
/dev/hda1 * 1 58168 29316640+ c W95 FAT32 (LBA)


Also:-

fdisk -l /dev/hdd1

Disk /dev/hdd1: 123.5 GB, 123510772224 bytes
255 heads, 63 sectors/track, 15015 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

Device Boot Start End Blocks Id System
/dev/hdd1p1 ? 116388 126889 84344761 69 Unknown
Partition 1 does not end on cylinder boundary.
/dev/hdd1p2 ? 105915 222310 934940732+ 73 Unknown
Partition 2 does not end on cylinder boundary.
/dev/hdd1p3 ? 1 1 0 74 Unknown
Partition 3 does not end on cylinder boundary.
/dev/hdd1p4 1 213826 1717556736 0 Empty
Partition 4 does not end on cylinder boundary.

Partition table entries are not in disk order

The bigger disk is currently set up as slave on ide 2, but until it crashed it was the master on ide 1. It has Win XP pro on it, with the 'recovery console' installed. Indeed, clicking the hdd1 icon on the Knoppix desktop shows a FAT partition only which I imagine is this. console.

I have enough room on the hda1 disk for all the data I need to recover from the hdd1 disk (which is currently running Win2K)

When I have recovered what I need I will reformat the bigger disk, put it back as primary master and reinstall WinXP, and put in a partition for an intial toe dip into Linux (haven't yet decided on distro).

I am trying to get my head around the way partitions etc work in Linux cf Windows/DOS. I'm also discovering that things like 'mkdir' aren't quite the same! javascript:emoticon(':(')

I hope the above is enough to go on - many thanks in advance for suggestions.

David











Thanks - but when I try this I get an error message something like "Unable to open /dev/hda "

What am I missing?

David

Try it as root. ;)

OK, thanks. I now seem to have the HDs (both of them).mounted. But now the drive with the corrupted NTFS partition gives an 'Access denied" message although I CAN access and manipulate the other one with the FAT32 partition.

How can I give myself permisson to access my own hard disk?

Fdisk listed more partitions on the NTFS disk than I thought were there.

I can't seem to navigate between partitiions although I can move between disks.

The icon on the desktop for the NTFS hard disk has a green flash on its bottom RH corner, but not the other one. What does this mean?

Thanks again for any pointers - and apologies for my current state of ignorance.

David

[Davidsa]

[quote="Dave_Bechtel"]--Well, hda looks OK, but hdd definitely looks pretty screwed up - I've never seen anything like that before. (smacks head) Oh wait, I get it now...

--You're not supposed do do fdisk on sub-devices... Only "main" or "top-level" devices, like hdd, sda, that sort of thing. Trying to do an fdisk on hdd1 only confuses the program. Stick to ' fdisk -l /dev/hdd '.

--What you want to do is this:

o Boot the livecd
o Switch to Ctrl-Alt-F1 console (the GUI will still be active on Alt-F5 or Alt-F7)

' mkdir /mnt/ntfs ' == Arbitrary mount point
' mkdir /mnt/fat32 '

' mount /dev/hdd1 /mnt/ntfs ' == If this fails or the resulting filenames look weird, look at ' man mount ' and see if it needs additional translation; you might have to do:
o ' umount /mnt/ntfs; mount /dev/hdd1 /mnt/ntfs -outf8,ro '

--Now you can mount the fat32:

' mount /dev/hda1 /mnt/fat32 ' == It will mount R/W by default

' cd /mnt/ntfs '
' ls -al '

--Now I recommend you run ' mc ' and start copying files. It should start up with /mnt/ntfs in the left pane; hit Tab and type:
' cd /mnt/fat32 '
to get that directory in the other pane. Hit Tab again to get back to the original pane. Now you can tag files/dirs by hitting Insert, and use the F5 key to Copy. (Note that tagging files only works for the current directory and below; meaning: if you tag files in the root dir and then hit Enter to drop down into a subdir, the rootdir files won't be tagged anymore. But tagging a top-level directory also grabs everything beneath it by implication.)

OK, I've done all this, and it seems to work fine for hda1.

But for hdd1 I can still only see what looks like part of the disk, and with 'wierd' filenames and funny looking sizes (some apparently empty). Generally looks the same as what I see by clicking the fixed disk icon on the Knoppix desktop. The -outf8.ro suffix seemed to make little difference. There still seems to be a big chunk of ntfs-formatted HD I can't seem to find. I'm reluctant to believe it us utterly corrupted as it is visible (and the files are openable) with a data recovery tool I've used on it under Win2k (but that one insists I pay them before it'll let me copy!).

Can you explain a bit more about 'man mount' and 'additional translation'?

Thanks again


David

[Dave_Bechtel]

--Sigh; patience for teh n00b...

--Type in ' man mount '
Hit the Slash (/) key and type "ntfs" w/o the quotes -- this is Search
Hit Enter
Keep hitting the "N" key until you find the section dealing with NTFS mount options.

============
OK, I've done all this, and it seems to work fine for hda1.

But for hdd1 I can still only see what looks like part of the disk, and with 'wierd' filenames and funny looking sizes (some apparently empty). Generally looks the same as what I see by clicking the fixed disk icon on the Knoppix desktop. The -outf8.ro suffix seemed to make little difference. There still seems to be a big chunk of ntfs-formatted HD I can't seem to find. I'm reluctant to believe it us utterly corrupted as it is visible (and the files are openable) with a data recovery tool I've used on it under Win2k (but that one insists I pay them before it'll let me copy!).

Can you explain a bit more about 'man mount' and 'additional translation'?

Thanks again


David

[Davidsa]

[quote="Dave_Bechtel"]--Sigh; patience for teh n00b...

--Type in ' man mount '
Hit the Slash (/) key and type "ntfs" w/o the quotes -- this is Search
Hit Enter
Keep hitting the "N" key until you find the section dealing with NTFS mount options.

Can you explain a bit more about 'man mount' and 'additional translation'?

Sorry, Dave!!

Now I get it. Doh!!

Clearly "man" is Linuxese for "Manual" or "Help files"

I suppose you mean by "additional translation" using some of the many arguments to the "mount" command.

But you must admit that "man mount" or rather "mount man" could be misunderstood to mean something ..er.. entirely different!

In fact the "mount manual" is corrupted on my Knoppix disk, giving an error message and putting the machine into a loop. This is the second bad Knoppix disk I have had, the first wouldn't boot up fully. Now I have a third, and the "Man" files seem to work. So I will try to print out the "Mount" section and try again.

So long - will be in touch again no doubt

And be assured that your patience is much appreciated

David

[Davidsa]

OK here's my problem, more clearly:-

fdisk gives:

root@ttyp0[knoppix]# fdisk -l

Disk /dev/hdd: 123.5 GB, 123522416640 bytes
255 heads, 63 sectors/track, 15017 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

Device Boot Start End Blocks Id System
/dev/hdd1 * 1 15016 120615988+ 7 HPFS/NTFS

Disk /dev/hda: 30.0 GB, 30020272128 bytes
16 heads, 63 sectors/track, 58168 cylinders
Units = cylinders of 1008 * 512 = 516096 bytes

Device Boot Start End Blocks Id System
/dev/hda1 * 1 58168 29316640+ c W95 FAT32 (LBA)

That is a hard disk partition NTFS formatted (btw, what's HPFS ?), as well as the other disk which is FAT32 and acessible.

But, on mounting them, the "mount" command gives:-

dev/hdd1 on /mnt/ntfs type vfat (rw)
/dev/hda1 on /mnt/fat32 type vfat (rw)

so the system is only "seeing" a fat or fat32 partition.
The disk does in fact have the WinXP recovery console installed which may well constitute another non-ntfs formatted partition, which perhaps is what this is.

But how can I get hold of the ntfs one?

Thanks again

David

[Dave_Bechtel]

--HPFS is/was the filesystem used by OS/2.

--As far as the NTFS stuff goes, I'm afraid I can't help much more; I don't use NTFS myself at all. I know there is a "captive" driver in the latest Knoppix rev that can supposedly write 100% safely to NTFS, but haven't tested it - that's pretty much all I know about it.

--If the data is really crucial and nothing homebrew seems to be doing the job, I'd suggest taking the drive to a data recovery specialist. It might be expensive, but it all boils down to "how much is your data worth."


OK here's my problem, more clearly:-

fdisk gives:

root@ttyp0[knoppix]# fdisk -l

Disk /dev/hdd: 123.5 GB, 123522416640 bytes
255 heads, 63 sectors/track, 15017 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

Device Boot Start End Blocks Id System
/dev/hdd1 * 1 15016 120615988+ 7 HPFS/NTFS

Disk /dev/hda: 30.0 GB, 30020272128 bytes
16 heads, 63 sectors/track, 58168 cylinders
Units = cylinders of 1008 * 512 = 516096 bytes

Device Boot Start End Blocks Id System
/dev/hda1 * 1 58168 29316640+ c W95 FAT32 (LBA)

That is a hard disk partition NTFS formatted (btw, what's HPFS ?), as well as the other disk which is FAT32 and acessible.

But, on mounting them, the "mount" command gives:-

dev/hdd1 on /mnt/ntfs type vfat (rw)
/dev/hda1 on /mnt/fat32 type vfat (rw)

so the system is only "seeing" a fat or fat32 partition.
The disk does in fact have the WinXP recovery console installed which may well constitute another non-ntfs formatted partition, which perhaps is what this is.

But how can I get hold of the ntfs one?

Thanks again

David

[intuxicated]

Greetings.

I've been reading this thread, which has been very interesting so far. I don't know if this has come to mind, to suggest to the Customising & Remastering gurus, to make a Knoppix distro which auto mounts all available drives on a PC with read and write capabilities, with FAT16 up to NTFS support, and all you have to do is launch a file manager and start copying.

What do you think?


--
Take care.