NTFS Corrupt - [ Extremely important data]

[jan1024188]

Ok, so yesterday I installed F15 on my laptop and wanted to copy over .mozilla folder using the 32GB USB key with NTFS partition. After copy, I did pull the key out without unmounting (like I always do), but than it stopped working.

I tried to mount it in windows, but it outputs the error of "Corrupt Drive".

fdisk -l outputs:

Disk /dev/mapper/VolGroup-lv_swap: 5570 MB, 5570035712 bytes
255 heads, 63 sectors/track, 677 cylinders, total 10878976 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x00000000

Disk /dev/mapper/VolGroup-lv_swap doesn't contain a valid partition table

Disk /dev/mapper/VolGroup-lv_root: 53.7 GB, 53687091200 bytes
255 heads, 63 sectors/track, 6527 cylinders, total 104857600 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x00000000

Disk /dev/mapper/VolGroup-lv_root doesn't contain a valid partition table

Disk /dev/mapper/VolGroup-lv_home: 940.4 GB, 940396511232 bytes
255 heads, 63 sectors/track, 114330 cylinders, total 1836711936 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x00000000

Disk /dev/mapper/VolGroup-lv_home doesn't contain a valid partition table

Disk /dev/sdb: 32.0 GB, 32027705344 bytes
64 heads, 32 sectors/track, 30544 cylinders, total 62554112 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x2052474d

This doesn't look like a partition table
Probably you selected the wrong device.

Device Boot Start End Blocks Id System
/dev/sdb1 ? 6579571 1924427647 958924038+ 70 DiskSecure Multi-Boot
/dev/sdb2 ? 1953251627 3771827541 909287957+ 43 Unknown
/dev/sdb3 ? 225735265 225735274 5 72 Unknown
/dev/sdb4 2642411520 2642463409 25945 0 Empty

Partition table entries are not in disk order

ntfs-3g outputs:

[jan@localhost ~]$ sudo mount -t ntfs-3g /dev/sdb /mnt/key
ntfs_mst_post_read_fixup: magic: 0x00000000 size: 1024 usa_ofs: 0 usa_count: 65535: Invalid argument
Record 0 has no FILE magic (0x0)
Failed to load $MFT: Input/output error
Failed to mount '/dev/sdb': Input/output error
NTFS is either inconsistent, or there is a hardware fault, or it's a
SoftRAID/FakeRAID hardware. In the first case run chkdsk /f on Windows
then reboot into Windows twice. The usage of the /f parameter is very
important! If the device is a SoftRAID/FakeRAID then first activate
it and mount a different device under the /dev/mapper/ directory, (e.g.
/dev/mapper/nvidia_eahaabcc1). Please see the 'dmraid' documentation
for more details.
[jan@localhost ~]$

The panic is, that the drive contains some extremely important backups, and these backups are the only copy. The data has huge value, and it has to be rescued. I am probably going to send it to some data-rescue company to try and recover, but am wondering if you guys know if this issue can be solved at home too.

[glennzo]

I don't know how to help but it sure looks like you should just "send it out" instead of playing around with it if the data is that critical.

[jan1024188]

There are 2 software source codes backups, which are only backups, so it is kinda important. Just wondering if it can be an easy fix, maybe some sort of partition table rescue tool. Doesn't have to be limited to Linux, can be windows tool too.

I wanted to open-source both programs like few months ago already, but I never did take time for it, and now I have it all lost :S

[bodhi.zazen]

In my limited experience with ntfs, IMO, Linux does not have great tools for fixing the problem, the windows tools are superior.

I agree if the data is critical I would seek professional assistance as if you play with it yourself you can make it worse.

If you insist, try testdisk and photorec.

[glennzo]

Next time, remember to make reliable backups before you do anything like installing a new OS.

[jan1024188]

nah I was just using stickey when it corrupt...

[bodhi.zazen]

And do not pull the flash drive out without properly unmounting it.

[marvin_ita]

Have you tried to run 'chkdsk /f' in windows as suggested by ntfs-3g?

[Chilly Willy]

I agree with the others on the "if it is THAT critical, send it out" point. But if you intend to try to do it YOURSELF being an "X" M$ admin, I must say that being that this is an NTFS drive, I'd mount it under an M$ OS & run there tools on it. After all, it IS an M$ issue. & I think the one that MARVIN ITA mentions is it. - (I'm now out of the loop & been to long to recall w/o looking it up)

Also, look to only recover parts & have all the recovered (be it good or so-so) to be fragmented, even if a PRO does it. But a full recovery IS possible, as I've seen / done it, as rare as it is. - lets hope you didn't "ZAP" the drive.

[Doug G]

If possible, I'd make an image copy of the partition before running any repair tools, like with dd or ghost or something. Just for luck, it's possible chkdsk or other repair tools may lose data that could have been recovered. From your fdisk it looks like you could do dd if=/dev/sdb of=save_sdb.iso.

[Chilly Willy]

Doug - you just triggered my memory!

I agree, make an image if possible & IIRC one can work with the IMAGE on a known working drive to recover the data, leaving the original in tack. (or a much as one pass allows) Who care what happens to the IMAGE as you work with IT. (that is if you make a backup of the image, as I'd hope you would)

I'll still stick with what I said before as to the tools, ALTHOUGH I HAVE used testdisk with good results at restoring an accidentally blown away partition on my backup drive - & I know, "stuff happens", with these computer "toys" (cleaned it up a bit, didn't I)

[stevea]

Originally Posted by jan1024188

After copy, I did pull the key out without unmounting (like I always do), but than it stopped working.

ACT IN HASTE, REPENT AT LEISURE - Publilius Syrus, circa 50BCE



So I question whether you have a partition on that USB stick at all - it may just be a filesystem that span the entire block device without a partition table.

The reason I suggest that is that there is no reason that the partition table should be touched or corrupted by a file copy.

Run chkdsk or others on a Windows system.

[Doug G]

I agree, make an image if possible & IIRC one can work with the IMAGE on a known working drive to recover the data, leaving the original in tack. (or a much as one pass allows) Who care what happens to the IMAGE as you work with IT. (that is if you make a backup of the image, as I'd hope you would)

Yep, I do this all the time with my customer's screwed up disks. I usually put the image on a large external HDD, then it's trivial to mount the image from linux and work with the image copy.

But in this case the fdisk seems to say the partition table got screwed up but the drive is still recognizable, so an image of the entire usb disk should probably be do-able. If so then you can mess around trying to recover the partition table, perhaps by getting another duplicate usb drive and formatting it ntfs, then use dd to copy the partition table of that drive to the bad one, if that doesn't work restore the image and try again.

Disclaimer: I haven't done this type of stuff on usb flash drives much, but with normal hdd these procedures work well.