Knoppix ate my Windows NTFS?

[Cutefangs]

I have an 78gb Windows XP NTFS partition on my harddrive. I was fooling with a KNOPPIX LiveCD which lets you boot from the CD into Linux, loading most of the OS into RAM. While playing with this temporary Linux, I tried to copy a file boot.img to /hda1/ which is my NTFS Windows partition. It could see all of my files and access them. Then I restarted my machine and popped out the LiveCD, ready to go back into Windows. Instead I am given a Knoppix boot screen! So at this point I reboot once more, booting from a Windows XP CD to run Recovery Console. I run fixboot and fixmbr and reboot again. Still the Linux boot screen. I pop in the KNOPPIX LiveCD again, and now /hda1/ appears to be a 1.4mb partition with things like vmlinuz on it. cfdisk says however that there is only one partition, and it is a 78gb FAT partition (weird since my Windows is NTFS and Linux tends to be ext2..).

So obviously my question is: How can I get Windows back?! Linux thinks the hd is only 1.4mb and FAT.. sounds like a floppy to me. Recovery Console for the C: also lists all of the same linux files and the 1.4mb size. So I'm confident my Windows NTFS is still largely intact. What should I do?

[Cutefangs]

I forgot to mention, now when I boot straight to the harddrive, I get the NTLDR is missing error.

[j.drake]

I tried to copy a file boot.img to /hda1/ which is my NTFS Windows partition.

How did you do that? You didn't copy over boot.ini by chance, did you? ( e.g., did you copy boot.img to boot.* ?)

jd

[Cutefangs]

That may very well may have happened, I was trying to move boot.img over to the root of C:. Any way to fix this?

[j.drake]

Couple of thoughts:

1. Boot Knoppix and take a look at your /hda1/ Do you see a file called boot.ini ? If so, what date is associated with it? Is it the date you transferred the file?

2. Look inside the file (use a text editor like kwrite, or whatever to open)and print it out, copy it down, whatever (if you're new to knoppix you might not have set up your printer file yet - you can do it with the penguin icon, configure, printer, new printer, yada, yada).

3. Mine looks like this:

[boot loader]
timeout=15
default=multi(0)disk(0)rdisk(0)partition(1)\windows

[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\windows="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

Your timeout may be less that 15, or even 0 (mine's at 15, because the portion I didn't copy has a link to my grubloader for my PMI). But it should contain at least this much. If nothing else, running the recovery disk should have fixed it.

Anyway, that's all I can offer for now, based on what I've read. Check your BIOS settings obviously.

Please pardon this stupid question also - you didn't do an install of Knoppix by any chance, did you? As you probably know, it's possible to do a HD install from live CD. A lot of people new to linux assume that Knoppix needs to be installed, they ask, someone helps them, and they wind up dealing with installation issues.

HTH,

jd

[bfree]

So obviously my question is: How can I get Windows back?! Linux thinks the hd is only 1.4mb and FAT.. sounds like a floppy to me. Recovery Console for the C: also lists all of the same linux files and the 1.4mb size. So I'm confident my Windows NTFS is still largely intact. What should I do?

I suspect you have hosed your windows installation though just how you managed to do it I don't know! Knoppix will not write to an NTFS formatted partition unless you use captive-ntfs (if this doesn't ring a bell, you didn't do it) so I wonder how you copied the file. It sounds to me like you managed not to copy the floppy image to a file the hard disk partition, but to write the image over the start of the partition (effectively wiping the first 1.4M and making the entire partition appear the size of a floppy), you could do this with the following command, but you wouldn't want to do this, "dd if=boot.img of=/deb/hda1" is this what you did? You see when you run fixmbr, you are only restoring the master boot record which by default (afaik) boots the first partition, which now looks for all intents and purposes like a knoppix floppy image.

I'm surprised cfdisk states the partition is FAT, I would have thought it would still say ntfs as this information is stored in the root of the drive outside of the partitions, and this should not have been effected. Perhaps the source of the whole problem is that your partition was erroneously labelled as fat when in fact it was ntfs, then Knoppix setup fstab (the file which controls how partitions are accessed) for a fat partition even though it was ntfs so it would let you mount it read-write without the usual ntfs warnings. Knoppix normal ntfs support will only let you overwrite data with more data the same size, it won't let you create files or change the size of a file, I'm not sure what it would do if you tried to do something else other then the fact it is likely to do damage. How you would manage to write a floppy image to the start of a mounted partition is another question (perhaps this is the sort of destruction the ntfs driver is capable of if used incorrectly).

The good news is that everything on your 78G partition after the first 1.4M is still intact, the bad news is I'm not sure how you can recover your data from this. I would certainly suspect that you will not be able to get it to boot your Windows again without re-installing/repairing windows, possibly after first getting it to somehow try and recoer the ntfs partition. I would seriously recommend starting by trying to make a direct backup of the entire partition somewhere so you can try to bring it back to life without possibly hosing the partition further. I can only assume that on ntfs (like fat) the information required to interpret the partition is held in multiple copies on the drive, and hopfully there is a valid set of the data outside the first 1.4M, so you should be able to get all the files on your partition back except for those which had data in the first 1.4M, of course just what software you will have to use to do this I'm not sure and no matter what softwre you try I really would try and get yourself a backup first so if it all goes wrong you haven't just finished of your data by trying to recover it.

The old old adage comes back again ... "You do have a backup don't you, hard disks can fail you know". Sorry to have to say it but anyone who has anything they value in the slightest on a computer not backed up is waiting for disaster.

[Cuddles]

Cutefangs,

Considering the "issues" of this, and the severity...

I would suggest you start a topic in the "Windows" Forum... I have no clue how to resolve this issue, but, I would guess, that "something" like this, has happened to someone else, and the people who frequent the "Windows" Forums, may have a lot more answers...

Dont get me wrong, here, I'm not trying to "brush you off", but, rather, trying to get you the best help, and where you might get a lot more help

If you like, a Moderator can move this topic completely, to another forum, for you, if you like ( just ask, I dont want to assume )... Or, you can just start a new topic in the other forum, whichever you prefer...

Hope that this helps,
Ms. Cuddles

[Cutefangs]

Yeah, I'm thinking I probably used dd if=boot.img of=/deb/hda1. As root.

[rusty]

Well, there's a couple of things you can try if you have data on the drive that must be recovered, but if the data is not critical then reformatting and reinstalling is the least time consuming option.

Google up lde (linux disk editor) and gpart (guess partition). Both are usually included on live cd distros and are data recovery tools that you can use to try get data off the disk. You'll probable end up spending alot of time searching bit by bit (or byte by byte) through the disk . Not fun.

As mentioned above, backing up the disk contents using dd is a good idea.

HTH