Can't See Any of my Windows Files, Errors Mounting

I am trying to recover data from my Windows XP hard drive. The drive is a 120 GB SATA drive installed on my Compaq desktop PC.

Prior to using Knoppix, I tried running a FIXMBR from the Windows Recovery Console to try and fix my Master Boot Record however that did not work. I did not format the drive or erase any data so I know that there are still files on this drive however when I boot up the PC using Knoppix, I can't see any Windows files on the drive. There is one text document on the drive called BOOTEX.LOG and it says:

The type of file system is FAT, Errors in File Allocation Table Corrected, The specified disk appears to be a non-Windows XP disk, etc...

Is there another utility that I can run while Knoppix is loaded to scan the disk as a lower level and recover the files that I know are still on it?

Since the disk is FAT, I am assuming that NTFSUNDELETE won't work. When I ran that command, I get this error:

Error reading bootsector: Is a directory
Failed to startup volume: Is a directory
Failed to mount '/media/sda': Is a directory

Any ideas on how I can get to the files on the disk even though they aren't appearing on the disk within in Knoppix?

Knoppix can often read partitions that are so mucked up that Windows can't read them, but Windows is also quite capable of destroying a partition so well that even Knoppix can't recover the data. I'm sad to say that I have 3 hard drives in this state and have not been able to get the data off them. I hope that you can do better.

That your partitions are FAt is likely to help. There are a number of file recovery programs that work in the Windows or DOS environments, but the ones that do a good job for NTFS partitions all seem to be sold at a high price (more than a new 500 gig hard drive would cost), while a Google search should help you find a number of free ones that work on FAT partitions.

As far as using Knoppix, you might be able to get back all of you data quite easily. Not infrequently, the problem isn't a corrupted partition at all; it turns out to be that Windows has corrupted the partition table, that little block of data in the master boot record that defines where the partitions are on the disk. If this is mucked up your partition could be complete fine, but windows can't find it. And Linux can't find it either. But windows does this to their victims, I mean customers, often enough that there are a couple of Linux tools that can can examine the entire disk and try to figure out what the MBR should look like, and then fix the MBR for you. If this is all that is wrong, a quick repair to the MBR will let you see your lost FAT partition again.

Two tools that will do this are gpart and testdisk. I suggest that you read the man pages for each (type man gpart at a command prompt, for example). gpart stands for guess partition and is, by my way of thinking the more technical of the two but gives you better feedback and control. You can run it and see what it thinks of your disk and what it would do, so you can decide for yourself if the results seem believable, so you are not likely to do any further harm if it would make a change that would make things worse. testdisk is more of a "for dummies" tool. It doesn't seem to think the user is smart enough to make the decision, and may change the MBR without discussing it with you. I think you'll prefer the former, but I wanted to mention both.

Quote:

---

Originally Posted by michaelmaxim

....Failed to mount '/media/sda': Is a directory

---

By the way, you will not be mounting sda if this is a normally formatted hard drive. sda is the entire drive, but sda1 is the first partition on the drive. You'll want to mount the partition, not the drive. If the gpart or testdisk commands recover the MBR for you then you should get a desktop icon for sda1 (you might have to reboot Knoppix to see it).

When I run this command, I get the following errors...

gpart /media/sda

Fatal Error: cannot get sector size on dev(/media/sda).

if I run the command gpart /media/sda1, I get the following error:

Fatal Error: open(/media/sda1) No such file or directory.

Any ideas?

Thanks for the explanation also on the MBR and how it works. I just wish I could get SOMETHING to see some files on this darn disk. I am downloading Active @ UNDELETE Pro 7.0 now. It has a bootable CD iso image that I can burn and hopefully fix the issues (according to their documentation).

We'll see how well this works and I'll post back any progress I make with that app.

Quote:

---

Originally Posted by michaelmaxim

Thanks for the explanation also on the MBR and how it works. I just wish I could get SOMETHING to see some files on this darn disk. I am downloading Active @ UNDELETE Pro 7.0 now. It has a bootable CD iso image that I can burn and hopefully fix the issues (according to their documentation).

We'll see how well this works and I'll post back any progress I make with that app.

---

I could go into more detail about the partition table in the MBR, but there is lots of information on the Internet about it, much of that information is even reasonably correct. So unless you have specific questions I'll leave you to research that for yourself.

Before using any undelete software I would certainly see what gpart has to say. If the MBR is wrong (as I suspect) and it can be fixed with gpart, you'll have a much better chance of recovering all of your data (and no deleted files) than you will have letting some file recovery software crawl around on the disk.

Do please let us know how things work out for you. Have you tried gpart or testdisk yet?

When I run this command, I get the following errors...

gpart /media/sda

Fatal Error: cannot get sector size on dev(/media/sda).

if I run the command gpart /media/sda1, I get the following error:

Fatal Error: open(/media/sda1) No such file or directory.

Any ideas?

I'm sorry, I missed that you had tried the gpart command. I'm not clear on why you are getting that error. It's been a while since I've run gpart, but I've never seen an error like that. I've never run it on an sata drive though, only on ide drives, so there could be a sata issue. Or it could be your sata hardware, maybe Knoppix just isn't recognizing your sata interface. Hard to know, particularly since I don't believe you have mentioned either the hardware platform or even what version of Knoppix it is that you are using (hint: any 3.x version id likely to be too old to recognize your sata hardware). If you have the current version (5.3.1) and gpart still can't find the drive, have you tried testdisk?

I think it's reading the SATA disk because it sees that single text file that is on it from the /FIXMBR command I ran when I had the Windows Recovery Console.

What's the syntax for the testdisk command? Simply type testdisk /list or do I have to add a arguement in the command for the drive to test like testdisk /media/sda /list ?

Quote:

---

Originally Posted by michaelmaxim

What's the syntax for the testdisk command?.....

---

It's been ages since I've looked at it, I wouldn't trust my memory. There should be a man file for it (man testdisk), which would be my fist step. Beyond that a simple Google search will find you lots of links such as this one. Google is your friend (a.k.a. STFW)