On Sunday 03 Jul 2011 11:31:14 Alan Mackenzie wrote: > Hi, Gentoo. > > There's been a cock and bull story on comp.os.linux.setup and I'm > wondering about some of the details. Mainly, I'd like some education, > please! > > The story, in essence: > (i) Windows XP is running, with a normal NTFS filesystem(s). > (ii) Power off without a proper shutdown.
Not particularly wise on NTFS. Upon next boot up it'll try to run chkdsk, which you *must* not interrupt. 99% of the time it'll happily continue into a normal boot. > (iii) Start again with a Linux Live CD (distribution not specified). > (iv) This corrupts the NTFS journal(s). No it does not. The NTFS journals (or the MSWindows partition and its NTFS) have nothing to do with a LiveCD booting and running exclusively in RAM. > (v) It is now difficult to start Windows. It would be without running chkdsk first, but you do not explain what the difficulty amounts to ... error messages 'n all. > OK. My questions: > o - Do live CDs actually mount filesystems on HDDs? Only when you ask them to. To mount NTFS you would these days use ntfs-3g: ntfs-3g /dev/sda1 /mnt/windows or mount -t ntfs-3g /dev/sda1 /mnt/windows > o - If so, would the start-up actually write anything to a partition? Nope. The start-up of a LiveCD happens in RAM. > o - Would this actually try to mount an NTFS filesystem? Linux LiveCDs will not typically mount anything whatsoever. They are by default respectful of the devices on the system. I don't know if this convention has changed recently, or if there are particular LiveCDs created with different mounting conventions for the sake of MSWindows users - who would not otherwise know how to mount a partition from Linux. Can't recall what MSWindows based LiveCDs do (e.g. BartsPE). > o - Given that Linux's NTFS doesn't (?yet) do journaling (see kernel > docs), would the driver not detect the presence of a journal and leave > well alone? The Kernel's NTFS driver is not safe for writing to a NTFS partition. It is mostly a read only driver (check the Help page of the module, next time you're rolling up a new kernel). If you mount a NTFS partition using the kernel driver and then try to write to it in a way that it requires a change to the fs journals then you will invariably corrupt the NTFS fs. The working solution for NTFS partitions these days is the ntfs-3g userspace application as mentioned above. CONCLUSION: To recover a MSWindows partition which did not shutdown cleanly, boot into MSWindows and let it run through the chkdsk sequence. When it finishes all should be good. If the MSWindows journal is corrupted, then you could try running ntfsfix /dev/sda1 to force it to run chkdsk next time it boots. When the MSWindows OS boots next time it will go through the chkdsk routine. If that does not fix it either, then the journalling problem is probably unrecoverable. In that case ntfs-3g won't work. Instead you could try mounting the partition using the Linux kernel driver (read only of course) and if it succeeds recover the files you need. If the Linux kernel NTFS driver does not work, then we are into a full blown recovery exercise. You could try testdisk and photorec. There are also a bunch of MSWindows solutions too to recover NTFS partitions/files, but I'm not sure if any of these are open source. HTH. -- Regards, Mick
signature.asc
Description: This is a digitally signed message part.
