Hello!
I successfully extracted all the data from my failing hard disk. There were a few IO errors, but out of 17 million there were only a couple hundred.
This worked for my two other partitions (same hdd), but on the one knoppix couldn't mount I have experienced difficulties.
The error occurs when I try to mount the rescue image as a device...
I use ntfs-3g, because I am stuck with NTFS (and have to write on it), for using windows as my primary OS.
Anyway:
ntfs-3g /mnt/ntfs/rescue /mnt/rescue -o ro,show_sys_files
$MFTMirr does not match $MFT (record 0).
Failed to mount '/mnt/ntfs/rescue': Input/output error
NTFS is inconsistent. Run chkdsk /f on Windows then reboot it TWICE!
The usage of /f parameter is very IMPORTANT! No modification was made to NTFS by this software.
What can I do?
This worked like a charm for the two other partitions.
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
Sorry, the response got lost back then. Maybe it's still useful...
First, im probably the wrong person to ask, since I have no experience
with ntfs-3g. You might get more competent help from the ntfs-3g team.
I do not completely understand your first paragraph. You wrote that
there were a few hundred IO errors, but you also wrote that you got
all the data? So were these IO errors recoverable? Just to make sure,
re-run myrescue once again with no special options, just the source
and destination (and the bitmap, if you have chosen a non-default
location). This should finish with zero bad blocks. If not, you did
not recover *all* of the data.
In the case of missing blocks, the result of mounting the filesystem
depends on what blocks are missing and can vary from files with
zero-bytes to a complete crash. In your case this is a failed
consistency check and the system simply refuses to mount this
filesystem.
When you encounter non-recoverable missing blocks you will need a
recovery program, which is specific to the filesystem, something like
fsck. I don't know wheter ntfs-3g offers something like a specialized
ntfs-fsck. The recommendation to run chkdsk on Windows makes this look
unlikely. Maybe you could follow that advice and build a disc with
that partition on it, so chkdsk can work on it. I would strongly
recommend to make a backup of the rescued data beforehand, just in
case chkdsk screws up badly.
The other option is to manually dig into the filesystem data
structures. I once saw a really elaborate documentation of ntfs, might
even have been on the ntfs-3g website. Basically, NTFS goes like this:
The first quarter (or so, depending on the disc size) is reserved for
the Master File Table (MFT), which is a sequence of (AFAIR) 1k-records
for each file. Each record contains the filename, record number of the
parent directory, permissions, timestamps and either a list of the
sectors that contain the file data or - if the file is small enough to
fit in the remainder of the record - the file data itself.
So you can scan the disc for MFT records (AFAIR they have a special
"magic" byte sequence at the beginning) and extract the file data. You
know the filename and can follow up the directory tree to learn the
path. Then you can copy everything into a new directory structure on
another disc. I once started with such a program, but it never got into
a publishable state. Maybe in the meantime ntfs-3g has a program that
does this automatically.
Best regards,
Kristof
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
Hello!
I successfully extracted all the data from my failing hard disk. There were a few IO errors, but out of 17 million there were only a couple hundred.
This worked for my two other partitions (same hdd), but on the one knoppix couldn't mount I have experienced difficulties.
The error occurs when I try to mount the rescue image as a device...
I use ntfs-3g, because I am stuck with NTFS (and have to write on it), for using windows as my primary OS.
Anyway:
ntfs-3g /mnt/ntfs/rescue /mnt/rescue -o ro,show_sys_files
$MFTMirr does not match $MFT (record 0).
Failed to mount '/mnt/ntfs/rescue': Input/output error
NTFS is inconsistent. Run chkdsk /f on Windows then reboot it TWICE!
The usage of /f parameter is very IMPORTANT! No modification was made to NTFS by this software.
What can I do?
This worked like a charm for the two other partitions.
Sorry, the response got lost back then. Maybe it's still useful...
First, im probably the wrong person to ask, since I have no experience
with ntfs-3g. You might get more competent help from the ntfs-3g team.
I do not completely understand your first paragraph. You wrote that
there were a few hundred IO errors, but you also wrote that you got
all the data? So were these IO errors recoverable? Just to make sure,
re-run myrescue once again with no special options, just the source
and destination (and the bitmap, if you have chosen a non-default
location). This should finish with zero bad blocks. If not, you did
not recover *all* of the data.
In the case of missing blocks, the result of mounting the filesystem
depends on what blocks are missing and can vary from files with
zero-bytes to a complete crash. In your case this is a failed
consistency check and the system simply refuses to mount this
filesystem.
When you encounter non-recoverable missing blocks you will need a
recovery program, which is specific to the filesystem, something like
fsck. I don't know wheter ntfs-3g offers something like a specialized
ntfs-fsck. The recommendation to run chkdsk on Windows makes this look
unlikely. Maybe you could follow that advice and build a disc with
that partition on it, so chkdsk can work on it. I would strongly
recommend to make a backup of the rescued data beforehand, just in
case chkdsk screws up badly.
The other option is to manually dig into the filesystem data
structures. I once saw a really elaborate documentation of ntfs, might
even have been on the ntfs-3g website. Basically, NTFS goes like this:
The first quarter (or so, depending on the disc size) is reserved for
the Master File Table (MFT), which is a sequence of (AFAIR) 1k-records
for each file. Each record contains the filename, record number of the
parent directory, permissions, timestamps and either a list of the
sectors that contain the file data or - if the file is small enough to
fit in the remainder of the record - the file data itself.
So you can scan the disc for MFT records (AFAIR they have a special
"magic" byte sequence at the beginning) and extract the file data. You
know the filename and can follow up the directory tree to learn the
path. Then you can copy everything into a new directory structure on
another disc. I once started with such a program, but it never got into
a publishable state. Maybe in the meantime ntfs-3g has a program that
does this automatically.
Best regards,
Kristof