Can't See Any of my Windows Files, Errors Mounting

I am trying to recover data from my Windows XP hard drive. The drive is a 120 GB SATA drive installed on my Compaq desktop PC.

Prior to using Knoppix, I tried running a FIXMBR from the Windows Recovery Console to try and fix my Master Boot Record however that did not work. I did not format the drive or erase any data so I know that there are still files on this drive however when I boot up the PC using Knoppix, I can't see any Windows files on the drive. There is one text document on the drive called BOOTEX.LOG and it says:

The type of file system is FAT, Errors in File Allocation Table Corrected, The specified disk appears to be a non-Windows XP disk, etc...

Is there another utility that I can run while Knoppix is loaded to scan the disk as a lower level and recover the files that I know are still on it?

Since the disk is FAT, I am assuming that NTFSUNDELETE won't work. When I ran that command, I get this error:

Error reading bootsector: Is a directory
Failed to startup volume: Is a directory
Failed to mount '/media/sda': Is a directory

Any ideas on how I can get to the files on the disk even though they aren't appearing on the disk within in Knoppix?

Knoppix can often read partitions that are so mucked up that Windows can't read them, but Windows is also quite capable of destroying a partition so well that even Knoppix can't recover the data. I'm sad to say that I have 3 hard drives in this state and have not been able to get the data off them. I hope that you can do better.

That your partitions are FAt is likely to help. There are a number of file recovery programs that work in the Windows or DOS environments, but the ones that do a good job for NTFS partitions all seem to be sold at a high price (more than a new 500 gig hard drive would cost), while a Google search should help you find a number of free ones that work on FAT partitions.

As far as using Knoppix, you might be able to get back all of you data quite easily. Not infrequently, the problem isn't a corrupted partition at all; it turns out to be that Windows has corrupted the partition table, that little block of data in the master boot record that defines where the partitions are on the disk. If this is mucked up your partition could be complete fine, but windows can't find it. And Linux can't find it either. But windows does this to their victims, I mean customers, often enough that there are a couple of Linux tools that can can examine the entire disk and try to figure out what the MBR should look like, and then fix the MBR for you. If this is all that is wrong, a quick repair to the MBR will let you see your lost FAT partition again.

Two tools that will do this are gpart and testdisk. I suggest that you read the man pages for each (type man gpart at a command prompt, for example). gpart stands for guess partition and is, by my way of thinking the more technical of the two but gives you better feedback and control. You can run it and see what it thinks of your disk and what it would do, so you can decide for yourself if the results seem believable, so you are not likely to do any further harm if it would make a change that would make things worse. testdisk is more of a "for dummies" tool. It doesn't seem to think the user is smart enough to make the decision, and may change the MBR without discussing it with you. I think you'll prefer the former, but I wanted to mention both.

Quote:

---

Originally Posted by michaelmaxim

....Failed to mount '/media/sda': Is a directory

---

By the way, you will not be mounting sda if this is a normally formatted hard drive. sda is the entire drive, but sda1 is the first partition on the drive. You'll want to mount the partition, not the drive. If the gpart or testdisk commands recover the MBR for you then you should get a desktop icon for sda1 (you might have to reboot Knoppix to see it).

When I run this command, I get the following errors...

gpart /media/sda

Fatal Error: cannot get sector size on dev(/media/sda).

if I run the command gpart /media/sda1, I get the following error:

Fatal Error: open(/media/sda1) No such file or directory.

Any ideas?

Thanks for the explanation also on the MBR and how it works. I just wish I could get SOMETHING to see some files on this darn disk. I am downloading Active @ UNDELETE Pro 7.0 now. It has a bootable CD iso image that I can burn and hopefully fix the issues (according to their documentation).

We'll see how well this works and I'll post back any progress I make with that app.

Quote:

---

Originally Posted by michaelmaxim

Thanks for the explanation also on the MBR and how it works. I just wish I could get SOMETHING to see some files on this darn disk. I am downloading Active @ UNDELETE Pro 7.0 now. It has a bootable CD iso image that I can burn and hopefully fix the issues (according to their documentation).

We'll see how well this works and I'll post back any progress I make with that app.

---

I could go into more detail about the partition table in the MBR, but there is lots of information on the Internet about it, much of that information is even reasonably correct. So unless you have specific questions I'll leave you to research that for yourself.

Before using any undelete software I would certainly see what gpart has to say. If the MBR is wrong (as I suspect) and it can be fixed with gpart, you'll have a much better chance of recovering all of your data (and no deleted files) than you will have letting some file recovery software crawl around on the disk.

Do please let us know how things work out for you. Have you tried gpart or testdisk yet?

When I run this command, I get the following errors...

gpart /media/sda

Fatal Error: cannot get sector size on dev(/media/sda).

if I run the command gpart /media/sda1, I get the following error:

Fatal Error: open(/media/sda1) No such file or directory.

Any ideas?

I'm sorry, I missed that you had tried the gpart command. I'm not clear on why you are getting that error. It's been a while since I've run gpart, but I've never seen an error like that. I've never run it on an sata drive though, only on ide drives, so there could be a sata issue. Or it could be your sata hardware, maybe Knoppix just isn't recognizing your sata interface. Hard to know, particularly since I don't believe you have mentioned either the hardware platform or even what version of Knoppix it is that you are using (hint: any 3.x version id likely to be too old to recognize your sata hardware). If you have the current version (5.3.1) and gpart still can't find the drive, have you tried testdisk?

I think it's reading the SATA disk because it sees that single text file that is on it from the /FIXMBR command I ran when I had the Windows Recovery Console.

What's the syntax for the testdisk command? Simply type testdisk /list or do I have to add a arguement in the command for the drive to test like testdisk /media/sda /list ?

Quote:

---

Originally Posted by michaelmaxim

What's the syntax for the testdisk command?.....

---

It's been ages since I've looked at it, I wouldn't trust my memory. There should be a man file for it (man testdisk), which would be my fist step. Beyond that a simple Google search will find you lots of links such as this one. Google is your friend (a.k.a. STFW)

Quote:

---

Originally Posted by michaelmaxim

I think it's reading the SATA disk because it sees that single text file that is on it from the /FIXMBR command I ran when I had the Windows Recovery Console.

---

I just can't quite figure out what this is saying. /FIXMBR should not write any text file to anywhere on the disk, what it is intended to do is to replace the boot code part of the MBR with plain vanilla Microsoft boot code (which would, for example, remove grub or other third party boot loaders if they have been installed, or just plain replace the boot code if for some reason it's not there or corrupt. It should not change, replace or "fix" the partition table, which is the last 64 bytes of sector zero track zero cylinder zero, aka the MBR. Can you tell us more about this text file? It almost sounds like the drive has been directly written to, as would be a floppy or a USB flash drive, rather than a properly partitioned hard drive. If that's the case then gpart or testdisk will be essential to rebuild the partition table. The /fixmbr option would also restore the boot code, but I would expect that should make any text file on an unpartitioned hard drive vanish. You shouldn't need to run /fixmbr to read the disk with Knoppix, but you might need it in eventually recovering the disk for Windows use. The good news is that since modern hard drives contain so much space on cylinder zero, if the text file is reasonably small, you may not have damaged any or much data on the FAT partition if something did write to cylinder zero as if the disk wasn't partitioned. I'm at a loss on how that would have happened though, unless someone forced a Linux system to mount sda rather than sda1 and then wrote to it or formatted it.

If I remember correctly, gpart and testdisk need to be run against the entire drive device, not the mountpoint.

In other words:

/dev/sda

NOT

/media/sda1

I'm getting the same error on a Toshiba Satellite A55-1064 laptop. That is, /dev/sda exists, but /dev/sda1 doesn't exist, even though it should. The hard drive is listed as "40GB (5400 RPM); Enhanced IDE (ATA-6) hard disk drive." The MBR on the hard drive is not messed up. QTParted and GParted both report the hard drive as I expect (/dev/sda, with /dev/sda1 being the only partition and filling the entire drive). The partition has a windows install on it, and is NTFS. Windows can boot, but fails after about two minutes, still in the loading screen. I'm using the lastest knoppix cd.

dmesg | grep sda revealed

Code:

---

SCSI device sda: 78140160 512-byte hdwr sectors (40008 MB)
sda: Write Protect is off
sda: Mode Sense: 00 3a 00 00
SCSI device sda: drive cache: write back
SCSI device sda: 78140160 512-byte hdwr sectors (40008 MB)
sda: Write Protect is off
sda: Mode Sense: 00 3a 00 00
SCSI device sda: drive cache: write back
 sda: <3>ata1.00: exception Emask 0x0 SAct 0x0 SErr 0x0 action 0x2
sda: Current: sense key=0xb
end_request: I/O error, dev sda, sector 0
Buffer I/O error on device sda, logical block 0
sd 0:0:0:0: Attached scsi disk sda

---

I have no idea what this means or what to do next :?