New to Linux

Hello, I just finished downloading Knoppix and have a few questions.

My main computer is a laptop. My Desktop used to be my main computer until I had a big failure.

On the desktop, I had a 6GB hard disk installed. Then I installed Windows XP Pro on this drive. When I got a new drive, I used Partition Magic to image the 6GB drive onto the 30GB drive. This created a C:\ partition and a D:\ partition. At first everything was fine. At some point later, I had to reinstall Windows. It reinstalled successfully, but because the D:\ partition was NTFS at the time of the reinstall, I can no longer access the D:\ partition. I had very important files on that D:\ partition, and have been trying to recover those files with no success. I tried installing a second hard drive with XP installed and set as the main drive, and set the 30GB drive to slave status. But that didn't help either.

So when I found out that you could recover files from bad partitions using Linux, I thought I'd give it a try. But since I'm a newbie, I don't want to screw up my desktop any more than it already is.

Is it possible to access a damaged/unreadable (at least to Windows) NTFS partition via Linux?

• 1) Awful choice for a subject of a post in a forum already called MS Windows & New to Linux. See my answer #7.
  
  2) Knoppix can often read NTFS partitions when Windows can't. But it should be obvious that certain bad things that can happen to the partition or the disk might destroy it enough that even Knoppix can't read it. Knoppix can not be used to write to a NTFS partition though. See my generic answer #5.

Sorry about the title, I couldn't think of any other attention-grabbing titles.

I forgot to ask, is it possible to use a USB data-transfer cable to use the laptop (running Linux) to access the bad WinXP desktop? The instructions for the data cable say to create a name for the desktop and the laptop, and then to access the remote computer via a link in My Computer. But I don't remember if there were any data-transfer drivers for Linux. I will search and try to find one.

Thanks for your advice.

Quote:

---

Originally Posted by Gthang

.....s it possible to use a USB data-transfer cable to use the laptop (running Linux) t.....

---

USB is truly awful for networking. There are many different designs of these usb cable hacks and none of them have software that is compatable with other devices, so if you are going to find software for it you will likely have to go to the maker. I certainly don't expect that you'll get Linux software for it.

Quote:

---

Originally Posted by Harry Kuhman

USB is truly awful for networking.

---

USB is truly awful for most anything. Except keyboards for video game consoles.

If windoze doesn't recognize your filesystem, connecting from another computer no matter what OS is not going to help.

You need to boot the desktop with the knoppix disk and search here for advice concerning your issues.

Good news, i was able to boot the Knoppix DVD on the desktop. Even better, I was able to access the bad partition.

Only problem, I am still relatively new, and am having trouble creating a new folder to copy the files to. I get a messge saying I don't have permission to create that folder.

Anyway, I will search the forums and see what I can find.

YIPPPPEEE! (Sorry, can't help myself; after almost 2 years of trying to get into this partition, I finally do!)

Quote:

---

Originally Posted by Gthang

Only problem, I am still relatively new, and am having trouble creating a new folder to copy the files to. I get a messge saying I don't have permission to create that folder.

---

Where are you trying to create that "folder"? Don't do it in the bad partition, and give up any foolish ideas abot Knoppix writing to a partition with an NTFS format. You should be able to copy the files to a FAT partition (assuming that none are larger than 4 gig) but you have to understand that Knoppix by default makes partitions read only and you have to change this if you plan to write to the partition.

I opened QTParted, and found out that the bad partition (with the important files on it) was hidden. If I unhid it, and commited the change, would I lose the files, or would it just make it visible to write to it from Windows?

Quote:

---

Originally Posted by Gthang

I opened QTParted, and found out that the bad partition (with the important files on it) was hidden. If I unhid it, and commited the change, would I lose the files, or would it just make it visible to write to it from Windows?

---

There is no easy answer to this. There is no one official hidden bit in the partition table. Some software does hide a partition by setting the high order bit of the partition type byte, thus making the partition an unknown type, but there are other ways to change the partition table so that the partition is not recognized and thus hidden too. And some OEMs do add an extra "hidden" partition to a disk to hold special recovery software. Without knowing how and why the partition is "hidden", it is my expectation that you will only make things worse and lower your chances of recovering the data if you make changes to the partition table without a good understanding of what has happened and what should be there.

Two years! Congratulations.

Now, as to that hidden filesystem. Keep in mind that partition and filesystem type information is kept in the boot sector of the drive. NTFS filesystems store information in an additional sector as well.

If this is one of the old hidden FAT type partitions, you should be okay. I do not know enough about the operating system response to a change of NTFS partition type to make a judgement if this is the case.

Either way, important data should always be backed up before any low level operation such as this. Even if you can not read the filesystem, you can still back up the data with any program that will make a bit copy. The standard diagnostic tool here is the command: dd . This utility will make direct disk writes from an input file to an output file. The command: dd if=/dev/hdc of=/dev/hdd bs=32768 ; will overwrite the target location with the entire contents of the source. Other tools are partimage for for _ghosting_ a partition and the parted utility itself for cloning a partition.

OK, good thing I didn't commit the change then.

When the problematic partition first presented itself, Windows said that it was inaccessible because it was a third-party software that partitioned it. And Windows did not even list the partition in Explorer.

In my mind, by unhiding it using QTParted, it may actually unhide it in explorer, as it is an NTFS partition.

Any other thoughts?

Copy it to another drive on a diagnostic system and experiment on it from there.

RE: Cloning (backing up) the bad partition

OK, I have two external high-capacity HDD with more that 4.40 GB free disk space, with the 4.40GB being the total amount of data on the bad partition.

The external disks are labeled as /UNIONFS/dev/sda1 and /UNIONFS/dev/sdb1.

If I wanted to back up my partition from /UNIONFS/dev/hda2 (the bad partition that's "hidden") and store the backup in a new folder called "Recovered Files", what would I type in the Root Shell?

OK, finally found out how to copy.

I searched the forums (duh, should have done that first...), and found that hard drives are set to read-only by default. I learned how to change this and am now copying the files (even created a new folder!).

Thanks for your help everyone! Linux is great! :-):D

Uh oh, it seems one of the files could not be copied, and the system froze. I will have to figure it out tomorrow, as it is getting late.

I will talk to you guys tomorrow, see what we can do.

Good Night!

Perhaps I should have been more succinct when I suggested that you copy _it_. What I meant for you to copy was the partition (clone) not the filesystem tree. In order to do this you use a low level utility with the filesystems _unmounted_.

There should be no harm done other than a little stress on the drives. Please post back with whatever results you have achieved so far and realize that if a particular file _froze_ your process you can always kill it from another terminal. Also note that an image copy from a cloning utility or direct read/write will not have this issue as it does not care what order or pattern those ones and zeros are in.

Yeah i knew what you meant by the copy. I just thought that if my destination drive was by default read-only, then by changing this setting, I should be able to recover the files.

So which low-level utility should I use to clone the partition?

This depends on the type of filesystem. I believe that parted will call the necessary ntfs utilities if required. Read the man page.

Direct instructions with the dd command will perform the actions listed on the command line regardless of the filesystem type or your intentions. Be careful.

Why is it that when I try to access an external hard disk, the status bar reads "Stalled"?

Once in a while, refreshing the Konqueror window shows the files, but other times, I can't see them at all.

How do I fix this?