Messed up NTFS HDD

[Styrus]

Hi all,
i am currently getting mad. I have been trying for four days to get my HDD back to be at least readable, but it won't work. As i know the Unix/Linux basics, i tried Knoppix (not for the first time) to restore my data and tried everything in this forum that appeared in any way to be a possible solution.

My Win XP System worked without problems until i came home and the system told me a dozen or more times that a data loss occurred while writing to partition c:.
Well after i tried to reboot the system did not come up with anything, it just rebootet again. I ran chkdsk on all partitions of the physical drives which all were messed up.
chkdsk tells me that at least one unrecoverable error exists on the disk. The first three steps seem to repair the partition, but the fourth comes up with the described error. At last chkdsk tries to write to the file of lost clusters, but then tells me, that it could not change the protocol file size.
I tried Partition Magic's function to check a partition and it tells me that some sectors could not be found and finds even some lost clusters. But if try to repair the lost clusters, just a bunch of new lost clusters appear.

After botting into Knoppix (which works without problems) the messed up partitions can be mounted and i even can see the directory structure. I tried to copy the files onto my external HDD and the system tells me, that it could not read the data for some files.
sudo gpart/dev/hda shows the following error: *** Fatal error: cannot get sector size on dev(/dev/hda).
sudo fdisk /dev/hda tells me that it could not read /dev/hda

I am at the edge of madness and would appreciate any detailed (and quick ) help as i do know the Linux/Unix basics, but i am not that experienced with it. I am going mad! Please help! I do not have a second computer and as my Notebook has only on CD-RW drive i cannot burn any disks with Knoppix as it needs the Knoppix disc in the drive permanently... I do not want to restore the system to be up and running the old installation! I just want to have my data back!


Thanks in advance!

[csdavid]

I routinely use Knoppix to recover data from Windows boxes where Windows does not work anymore.
I also (gasp!) have some DOS and Windows based tools that I use. A tool is a tool.

1) Check to make sure the computer is turned off. Unplugging the power cord can help.
With laptops, remove the battery as well.
2) Check to make sure all cables are firmly connected, into mainboard and drive.
3) Reconnect power and boot to bios. Check drive parameters and use auto detect.
4) if autodetect fails, set USER type to match specs on drive.
You may wish to test the drive with GWSCAN at this point to see if it has hardware errors:
http://support.gateway.com/s/HARDDRV...02/7513250.txt
5) if at all possible, plug source and destination drive into computer.
With laptops, use a USB jumpdrive or USB CD/DVD/RW
6) Boot to Knoppix and see the partition listed on the desktop.
If you used a second drive or USB jumpdrive, rightclick->Actions->Change read/write mode
IF the partition is not listed, run Start->System->Qtparted to view your partitions
Chances are the data will not be recoverable and the drive will never be useable again.
7) Click on the partition that has your Windows data and the destination drive
If you are using external USB CD/RW, start K3b Start->Multimedia->K3b
Find the folders you really need. "My Documents" in 98 and ME, "Documents and Settings" in 2000 and XP
BEWARE: Some programs like Quicken store their data in "Program Files"\company by default, where company is INTUIT in the case of quicken and Turbo Tax.
9) Copy the folders from the source drive to the destination drive. You can rightclick->Copy, then rightclick->Paste, just as in Windows. If using external USB drive, then burn disc with K3b.
NOTE: somebody has got to fix Knoppix so that you can burn on the same drive you boot from.
Until then, use two drives.

Hope this helps.

[jjmac]

So, it sounds like whatever happened, happened at the Windows end and not Linux. You haven't mention an estimate on the extent of scramble ?

But, whatever you do with a ntfs in Linux, remember that fs support for ntfs is largely broken. You can copy, but __don't__ try to __write__. Apparently one may write, as long as there's no change made to the file size. Which isn't that usefull really.

These might be of some use though:

http://linuxmafia.com/faq/Filesystems/ntfs.html

http://linux-ntfs.sourceforge.net


The only thing i can think of really, concerning this, would be if there is some sought of back-up super block file, or back-up journel that might exist from just before whatever happened. That you could possibly use. I suspect thats probably a big hope but.

If those tools above don't prove helpfull, you could look into using "dd" to raw copy data from one partition to another. Then grep through that mess looking for files. Very much a last resort though, i know, and very time consuming.


jm

[jjmac]

Hey Styrus,

Notice the othe similar thread a little way up the topic page ...

"Deleting Files/Dirs on NTFS Partition using Knoppix 3.7"

Not exactly the same issue as yours, but worth a look ...