INTELLIGENT WORK FORUMS
FOR COMPUTER PROFESSIONALS

Log In

Come Join Us!

Are you a
Computer / IT professional?
Join Tek-Tips Forums!
  • Talk With Other Members
  • Be Notified Of Responses
    To Your Posts
  • Keyword Search
  • One-Click Access To Your
    Favorite Forums
  • Automated Signatures
    On Your Posts
  • Best Of All, It's Free!

*Tek-Tips's functionality depends on members receiving e-mail. By joining you are opting in to receive e-mail.

Posting Guidelines

Promoting, selling, recruiting, coursework and thesis posting is forbidden.

Jobs

Help Recover partition on External ntfs Drive with Linux

Help Recover partition on External ntfs Drive with Linux

(OP)
hi

can someone direct me to a guide for recovering an ntfs volume?

the drive can mount, and reports nearly full, but appears to be empty in file-manager.

it's an external usb ntfs-formatted 500 GB HD. Last time i checked, the disk had a couple hundred GB of files on it (but NOT almost full as now reporting).

now all the files are gone, and the drive reports "68 GB" free. the partition is visible, but it's empty.

really appreciate any help, these are my only backups of some important files.

at first, gparted info reported "cluster accounting failed".

then i tried the following:

CODE

# e2fsck -n /dev/sdb1
e2fsck 1.42.8 (20-Jun-2013)
ext2fs_open2: Bad magic number in super-block
e2fsck: Superblock invalid, trying backup blocks...
e2fsck: Bad magic number in super-block while trying to open /dev/sdb1

The superblock could not be read or does not describe a correct ext2
filesystem.  If the device is valid and it really contains an ext2
filesystem (and not swap or ufs or something else), then the superblock
is corrupt, and you might try running e2fsck with an alternate superblock:
    e2fsck -b 8193 <device>

# ntfsfix /dev/sdb1
Mounting volume... OK
Processing of $MFT and $MFTMirr completed successfully.
Checking the alternate boot sector... OK
NTFS volume version is 3.1.
NTFS partition /dev/sdb1 was processed successfully.

# fsck /dev/sdb1
fsck from util-linux 2.21.2
fsck: fsck.ntfs: not found
fsck: error 2 while executing fsck.ntfs for /dev/sdb1

# fsck /dev/sdb
fsck from util-linux 2.21.2
e2fsck 1.42.8 (20-Jun-2013)
ext2fs_open2: Bad magic number in super-block
fsck.ext2: Superblock invalid, trying backup blocks...
fsck.ext2: Bad magic number in super-block while trying to open /dev/sdb

The superblock could not be read or does not describe a correct ext2
filesystem.  If the device is valid and it really contains an ext2
filesystem (and not swap or ufs or something else), then the superblock
is corrupt, and you might try running e2fsck with an alternate superblock:
    e2fsck -b 8193 <device>

# ntfsfix /dev/sdb
Mounting volume... NTFS signature is missing.
FAILED
Attempting to correct errors... NTFS signature is missing.
FAILED
Failed to startup volume: Invalid argument
NTFS signature is missing.
Trying the alternate boot sector
Unrecoverable error
Volume is corrupt. You should run chkdsk. 

after the above, and before mounting the drive, gparted displays an exclamation icon and says:

Quote:

Unable to read the contents of this file system!
Because of this some operations may be unavailable.
The cause might be a missing software package.
The following list of software packages is required for ntfs file system support: ntfsprogs / ntfs-3g.

but, i can mount it. after mounting, gparted says:
[url=http://postimage.org/][/url]

thx!

RE: Help Recover partition on External ntfs Drive with Linux

This sequence of commands appears to have altered some of the file system metadata structures. At a data recovery company, this is one of the worst scenarios we encounter, where attempts, all well-meaning have been made to recovery the data.

This is a reminder of why we always secure an image copy of the disk that we're working on, and never work on the live disk, once this has been done.

What damage running these tools has done can only be divined by looking directly at the data. The damage could range from only a small change to the first entries to the Master File Table (MFT) right through to wholesale destruction of file entries. Hopefully it is the former, and you're able to find a way, either through a data recovery company, which would be my recommendation or via other software to recover the data.

Dr Parker, Software engineer and webmaster for DiskEng, Oxford, UK.
www.DiskEng.com

RE: Help Recover partition on External ntfs Drive with Linux

(OP)
thx for reply.

this has been resolved.

Solution:
- In Linux, use ddrescue to make an image-file of the disk.
- Launch Hirens Rescue CD Mini XP:
-- Use ImgMount to mount the image-file.
-- Run chkdsk on the mounted drive. Files are recovered. Some files are in "found" folders.
-- Use windows explorer to copy the files from the mounted image-file to a safe location.

details here:
http://www.murga-linux.com/puppy/viewtopic.php?t=99196

RE: Help Recover partition on External ntfs Drive with Linux

Use Recuva or Disk Drill to recover your deleted files. Both are freeware

Red Flag This Post

Please let us know here why this post is inappropriate. Reasons such as off-topic, duplicates, flames, illegal, vulgar, or students posting their homework.

Red Flag Submitted

Thank you for helping keep Tek-Tips Forums free from inappropriate posts.
The Tek-Tips staff will check this out and take appropriate action.

Reply To This Thread

Posting in the Tek-Tips forums is a member-only feature.

Click Here to join Tek-Tips and talk with other members!

Resources

Close Box

Join Tek-Tips® Today!

Join your peers on the Internet's largest technical computer professional community.
It's easy to join and it's free.

Here's Why Members Love Tek-Tips Forums:

Register now while it's still free!

Already a member? Close this window and log in.

Join Us             Close