Reading Windows Files/drives In Ubuntu

[purple_monkfish]

Windows crashed on me, again.. thanks in part to various viruses so i've booted up Ubuntu off a cd which at the very least gives me internet access. However, I want to access my hard drive (it's partitioned into two parts via win2k) but have no idea where to start.

I'm a complete linux noob i'm afraid.

I need to back things up (again) before I can wipe my hard drive completely and start again so any help in mounting and accessing those drives would be appreciated.

I'm not sure if they're NTFS or FAT, I have the feeling that for some reason the partition is fat and the other is default ntfs but i'm not 100% certain. When I go into browser I can see what it claims is a 200gb hard drive (sounds about right) but it tells me when I click on it that it isn't able to access it, it isn't mounted properly.

Help!

thanks!

[iccaros]

open a command console

if its an IDE drive

sudo - su

enter your password (live cd ?? it may not ask)

type mkdir /mnt/windows1

mount /dev/hda1 /mnt/window1

if its a sata drive (or SCSI)

do the same but the mount command is

mount /dev/sda1 /mnt/window1

post any error that pop up and we can go from there... with out more information its hard to say... also that live cd may not have ntfs3g and in that case will not be able to mount the NTFS partition...

[purple_monkfish]

open a command console

if its an IDE drive

sudo - su

enter your password (live cd ?? it may not ask)

type mkdir /mnt/windows1

mount /dev/hda1 /mnt/window1

if its a sata drive (or SCSI)

do the same but the mount command is

mount /dev/sda1 /mnt/window1

post any error that pop up and we can go from there... with out more information its hard to say... also that live cd may not have ntfs3g and in that case will not be able to mount the NTFS partition...

Ok,

Hda1 - Special device hda1 does not exist

Same for sda1

Either they have different names or it's unable to read/detect ntfs.

Suggestions?

[hitest]

open a command console

if its an IDE drive

sudo - su

enter your password (live cd ?? it may not ask)

type mkdir /mnt/windows1

mount /dev/hda1 /mnt/window1

if its a sata drive (or SCSI)

do the same but the mount command is

mount /dev/sda1 /mnt/window1

post any error that pop up and we can go from there... with out more information its hard to say... also that live cd may not have ntfs3g and in that case will not be able to mount the NTFS partition...

Ok,

Hda1 - Special device hda1 does not exist

Same for sda1

Either they have different names or it's unable to read/detect ntfs.

Suggestions?

After you have root access try typing fdisk -l

That may show what your HD label is.

[purple_monkfish]

Nope, but I tried taking away the number and mount hda seemed to do something.

It's told me: dev/hda is write protected, mounting read only

Progress? maybe...

Trying to mount SDA (which is what it claims my large file system is it says: Cannot read superblock.

Edited April 1, 2008 by purple monkfish

[iccaros]

this is progress, sorry it was late last night.

This means that hda is your cdrom/dvd what ever

and sda is your harddrive, but NTFS has not unmounted it or has damaged it

can you as root type ntfs and hit tab twice and post what ntfs tools are showing up on your system.. we may be able to fix this..

superblocks are were the drive markes sections in a partition.. you can normally fix superbloc issues in a UNIX FS, but I am not soure about NTFS

[purple_monkfish]

ntfs-3g ntfscluster ntfsdecrypt ntfslabel ntfsresize

ntfscat ntfscmp ntfsfix ntfsls ntfsundelete

ntfsclone ntfscp ntfsinfo ntfsmount

Ahh, partition thing makes sense, as I said, my harddrive was partitioned into two parts because my father in his infinite wisdow decided it was better than having two independent drives (bah, bah I say. I would have prefered two drives so I could access at least one of the damned things)

[iccaros]

progress.. I love (I have gotten more than 3 hours of sleep... oh ya your issues:) )

please run fdisk -l /dev/sda

and see what partitions are listed

then run ntfsfix /dev/sda and see what it tells your, please post the output (a simple way of doing this is

ntfsfix /dev/sda > /tmp/fixntfs.txt and post the contents of that file....

some light reading.. ntfsfix

[purple_monkfish]

fdisk -l doesn't seem to do anything at all, it doesn't give me any output.

root@ubuntu:/home/ubuntu# ntfsfix /dev/sda

Mounting volume... Failed to startup volume : Invalid argument

FAILED

Attempting to correct errors... FAILED

Failed to startup volume : Invalid argument

Volume is corrupt. You should run chkdsk.

That, doesn't look good.

[iccaros]

I need to install some tools, I just rebuilt my laptop... (yes it running windows for developmet and I need to reactivate my ubuntu partition.. )

so as soon as I get that done I'll test these command on my NTFS partition

[iccaros]

it should run like this

stevelinux ~ # fdisk -l /dev/hda

Disk /dev/hda: 30.7 GB, 30750031872 bytes

255 heads, 63 sectors/track, 3738 cylinders

Units = cylinders of 16065 * 512 = 8225280 bytes

Device Boot Start End Blocks Id System

/dev/hda1 * 1 10 80293+ 83 Linux

/dev/hda2 11 141 1052257+ 82 Linux swap / Solaris

/dev/hda3 142 3738 28892902+ 83 Linux

stevelinux ~ #

but yours would be sda not hda

[purple_monkfish]

Disk /dev/sda: 320.0 GB, 320072933376 bytes

255 heads, 63 sectors/track, 38913 cylinders

Units = cylinders of 16065 * 512 = 8225280 bytes

Disk identifier: 0x69737369

This doesn't look like a partition table

Probably you selected the wrong device.

Device Boot Start End Blocks Id System

/dev/sda1 ? 116388 126889 84344761 69 Unknown

Partition 1 does not end on cylinder boundary.

/dev/sda2 ? 105915 222310 934940732+ 73 Unknown

Partition 2 does not end on cylinder boundary.

/dev/sda3 ? 1 1 0 74 Unknown

Partition 3 does not end on cylinder boundary.

/dev/sda4 1 213826 1717556736 0 Empty

Partition 4 does not end on cylinder boundary.

Partition table entries are not in disk order

Hmm..

[iccaros]

it looks like you have some disk errror.

the bad news is that you need to chkdisk from a windows (same version that formated)

this is because NTFS is not documented from microsoft and all of the Linux drivers are created by hacking the drive..

now you can use vmware or virtual box to host the windows and tell it that its disk is a real partition..

you can for fun run ntfsfix on /dev/sda1 and on /dev/sda2

[purple_monkfish]

Hmmm, well given that I can't even open windows it's that corrupt... Not a good thing ever. Maybe I can sacrifice an old pc with an old windows installation to gain access to the drive as a slave drive. Within moments i'm sure the viruses would infect the second pc but it might buy me enough time.. maybe. I'd have to check to see if my old pc has windows still installed on it but I think that hard drive is completely corrupt and unsalvagable. I'll have to find a cheap small drive to install windows on.

So, step by step.. i'd need to access windows and run chkdsk, then run virtualbox? What is that? remember, i'm a noob lol.

Both sda1 and sda2 give me the same response, run chkdsk, drive corrupt.

[iccaros]

we like noob's

ok..

forget the Virtual machine part, on latter look it seams that only VMware workstation lets you mount a real drive...

so if you have another windows box, then a great tool all computer people need is a IDE or sata to usb adaptor

since you have sata drives this is my favourite http://www.crazypc.com/products/blacx-95470.html

plug in the adaptor into the other machine, and plug in the hardrive. windows should see the drive if not.. then you how important is the data on the drive?

Note: you do not need to worry about virus on a second drive if you do not run any software from the drive..

right click on the drive and run check disk for errors..

this should fix the issues..

now assuming all is good with the drive then you can try to run WinClam to look for viruses..

if the harddrive is 2 or more years old, it may just be a bad harddrive and not a virus..

[purple_monkfish]

Well i'll have to leave it for now then, least till I have the time to spend slaving drives etc etc.

The drive itself, i don't actually know how old it is, it was a replacement for my last drive which died quite thoroughly a few years back. I seem cursed when it comes to hard drives, they last for about a year then just explode heh.. what do I do to them!?

I think most of the really really important data is backed up on the internet (like art, photos etc) but there's a few things i'd like to be able to save if I can. Mostly my MP3s because oh dear god i'm not going to burn 200 cds again.

I know viruses are mostly responsible but it is possible they may have just helped accelerate the problem windows seems to have with devouring my hard drives.

Anyway, thank you so much for your help! Shame we couldn't fix things the easy way aye?

[iccaros]

sorry, unless someone else has an answer, you can also try the windows forum.. they are also smart..

its a shame the NTFS schema is so undocumented.. it has taken years just to read and write to it.

there are some recovery tools that should allow you to grab data off the disk, but since I normally just wipe and forget..

[hitest]

Yeah, maybe the windows guys can help. If all else fails I do what iccaros does. Pop in your Ubuntu CD, reboot and wipe your windows partition, and install Linux. You'll have no issues with viruses, malware running Linux.

Then you'd at least be able to use this computer. Good luck with this.

[jcl]

Device Boot Start End Blocks Id System

/dev/sda1 ? 116388 126889 84344761 69 Unknown

Partition 1 does not end on cylinder boundary.

/dev/sda2 ? 105915 222310 934940732+ 73 Unknown

Partition 2 does not end on cylinder boundary.

/dev/sda3 ? 1 1 0 74 Unknown

Partition 3 does not end on cylinder boundary.

/dev/sda4 1 213826 1717556736 0 Empty

Partition 4 does not end on cylinder boundary.

Partition table entries are not in disk order

It's occured to me that it would be a good idea for people to record their partition maps somewhere so they can reconstruct the partition tables if needed. Rebuilding the master partition table, at least, is easy if you know the layout and formats of the partitions.

Alternatively, someone could do something really crazy like store backup copies of the boot sector at known locations on the HDD -- like, say, the second sector -- and provide an option to redirect the BIOS to them. Or, gee, I don't know, save a copy in the CMOS or BIOS PROM, if the massive 64 bytes of storage that's required isn't too expensive.

[iccaros]

I remember doing this in solars (and sun OS), but I could not even begin to know how to do this for windows.

I guess you can use linux...

here is a how to

http://martybugs.net/linux/image.cgi

ackup the Partition Table

To backup the partition table to a file, we can use dd as follows:

dd if=/dev/hda of=/mnt/hdc1/my-hda.mbr count=1 bs=512

Linux treats a filesystem or a partition as a file, and the syntax above specifies the input file to be the /dev/hda partition, and the output file is a file on our target HDD. The other parameters specify that only a single block should be copied, and we're forcing the filesize to be 512 bytes.

The output filename is arbitrary, so give it a suitable name that indicates which HDD it relates to. A ".mbr" file extension indicates it contains details relating to the master boot record.

Backup Extended Partition Information

If you have any extended partitions on the HDD being imaged, the details of the extended partitions can be saved as follows:

sfdisk -d /dev/hda > /mnt/hdc1/my-hda.sf

This will dump the partition table contents into the file we specify, in a format suitable for easily rebuilding the partition table.

Again, the output filename is arbitrary, so use a suitable filename.

to restore

# se dd to restore the partition table (dd if=/mnt/hdc1/my-hda.mbr of=/dev/hda)

# use sfdisk to restore the extended partition information (sfdisk /dev/hda < /mnt/hdc1/my-hda.sf)

Edited April 7, 2008 by iccaros

[jcl]

I remember doing this in solars (and sun OS), but I could not even begin to know how to do this for windows.

AFAIK it's basically the same on Windows. The physical disks can be accessed via Win32 at \\.\PhysicalDriven for n >= 0.

Once you have the boot sector you can extract or modify the partition table easily enough. The format is dead simple if the bootloader uses LBA and not much more complicated if it uses CHS addressing.