linux-ntfs-dev

[Linux-NTFS-Dev] NTFS recovery with the Linux NTFS tools or driver?

[Joshua K. <jo...@tr...>]

Hi,

So yesterday, thanks to a Win98 large disk blunder, I wiped out the
first half gigabyte or so of my Windows XP partition. Luckily, I was
able to boot with a MS-DOS floppy and run this trialware program which
told me that my data was safe (supposedly.) It was able to mount the
corrupt NTFS partition and read the directory structure. However, being
trialware it didn't allow me to save it.

I started wondering if the Linux NTFS driver supports recovery of this
sort. I'm pretty sure that demo program was reading from the backup MFT,
and if I can just restore that and the valid NTFS signature so I can
mount it in Knoppix, I can pluck all of the important files away and
reinstall from scratch.

Is this possible? The driver source refers to the MFT mirror briefly,
when does it try to use it?

Thanks a lot,
Josh

--=20
"Notice that, written there, rather legibly, in the Baroque style common=20
to New York subway wall writers, was, uhm... was the old familiar=20
suggestion. And rather beautifully illustrated, as well..."

       -- Art Garfunkel on the inspiration for "A Poem On The Underground W=
all"

Re: [Linux-NTFS-Dev] NTFS recovery with the Linux NTFS tools or driver?

[Szakacsits S. <sz...@si...>]

On Thu, 17 Jul 2003, Joshua Kwan wrote:

> So yesterday, thanks to a Win98 large disk blunder, I wiped out the
> first half gigabyte or so of my Windows XP partition. Luckily, I was
> able to boot with a MS-DOS floppy and run this trialware program which
> told me that my data was safe (supposedly.) It was able to mount the
> corrupt NTFS partition and read the directory structure. However, being
> trialware it didn't allow me to save it.

XP starts filling the partition usually from 3 GB (said to be because of
performance reasons) so probably you only wiped out the boot sector. This
is also stored in the last sector (last 512 bytes) of the partition. Just
copy it to the partition beginning and that's all. The process was detailed
sometimes in the NTFS Help/Open discussion forums, maybe it's even in the
FAQ? If not, probably it should be ...

You could also try 'fixboot' using Windows Recovery Console.

BTW, most Linux kernel has problem reading the last sector of a partition
in cases (man mkntfs and see BUGS part), in this case you should calculate
its place on the disk and copy from there.

> I started wondering if the Linux NTFS driver supports recovery of this
> sort. I'm pretty sure that demo program was reading from the backup MFT,
> and if I can just restore that and the valid NTFS signature so I can
> mount it in Knoppix, I can pluck all of the important files away and
> reinstall from scratch.

I don't think the MFT got damaged because that would cause much serious
damage. $MFTMirr doesn't really have so much useful info that 0.5GB could
be recovered.

	Szaka

Re: [Linux-NTFS-Dev] NTFS recovery with the Linux NTFS tools or driver?

[Joshua K. <jo...@tr...>]

On Sun, Jul 20, 2003 at 06:16:20PM +0200, Szakacsits Szabolcs wrote:
> XP starts filling the partition usually from 3 GB (said to be because of
> performance reasons) so probably you only wiped out the boot sector. This
> is also stored in the last sector (last 512 bytes) of the partition. Just
> copy it to the partition beginning and that's all. The process was detail=
ed
> sometimes in the NTFS Help/Open discussion forums, maybe it's even in the
> FAQ? If not, probably it should be ...

Sadly, the partition i formatted in win98 setup was ~4GB. So I lost a
chunk of system files when I finally fixed it. [See below]

> You could also try 'fixboot' using Windows Recovery Console.

Thanks, that by itself worked. =3DD

> I don't think the MFT got damaged because that would cause much serious
> damage. $MFTMirr doesn't really have so much useful info that 0.5GB could
> be recovered.

Live and learn :)

-Josh

--=20
Using words to describe magic is like using a screwdriver to cut roast beef.
		-- Tom Robbins