From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from pigeon.gentoo.org ([208.92.234.80] helo=lists.gentoo.org) by finch.gentoo.org with esmtp (Exim 4.60) (envelope-from <gentoo-user+bounces-125110-garchives=archives.gentoo.org@lists.gentoo.org>) id 1Qdi3j-0001J0-El for garchives@archives.gentoo.org; Mon, 04 Jul 2011 12:15:27 +0000 Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id E74C521C0BA; Mon, 4 Jul 2011 12:14:04 +0000 (UTC) Received: from mail.muc.de (colin.muc.de [193.149.48.1]) by pigeon.gentoo.org (Postfix) with ESMTP id 6EFC621C0BA for <gentoo-user@lists.gentoo.org>; Mon, 4 Jul 2011 12:14:04 +0000 (UTC) Received: (qmail 82808 invoked by uid 3782); 4 Jul 2011 12:14:03 -0000 Received: from acm.muc.de (pD9557494.dip.t-dialin.net [217.85.116.148]) by colin2.muc.de (tmda-ofmipd) with ESMTP; Mon, 04 Jul 2011 14:14:01 +0200 Received: (qmail 13509 invoked by uid 1000); 4 Jul 2011 12:12:03 -0000 Date: Mon, 4 Jul 2011 12:12:03 +0000 To: gentoo-user@lists.gentoo.org Subject: Re: [gentoo-user] [OT]: Powering off Windows XP, crashing NTFS with a Live CD. Message-ID: <20110704121203.GB30318@acm.acm> References: <20110703103114.GA2739@acm.acm> <201107031317.42848.michaelkintzios@gmail.com> Precedence: bulk List-Post: <mailto:gentoo-user@lists.gentoo.org> List-Help: <mailto:gentoo-user+help@lists.gentoo.org> List-Unsubscribe: <mailto:gentoo-user+unsubscribe@lists.gentoo.org> List-Subscribe: <mailto:gentoo-user+subscribe@lists.gentoo.org> List-Id: Gentoo Linux mail <gentoo-user.gentoo.org> X-BeenThere: gentoo-user@lists.gentoo.org Reply-to: gentoo-user@lists.gentoo.org MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <201107031317.42848.michaelkintzios@gmail.com> User-Agent: Mutt/1.5.21 (2010-09-15) X-Delivery-Agent: TMDA/1.1.5 (Fettercairn) From: Alan Mackenzie <acm@muc.de> X-Primary-Address: acm@muc.de X-Archives-Salt: X-Archives-Hash: bed571edecd2dbea4c853066dab4d65d Hi, Mick. On Sun, Jul 03, 2011 at 01:17:33PM +0100, Mick wrote: > On Sunday 03 Jul 2011 11:31:14 Alan Mackenzie wrote: > > Hi, Gentoo. > > There's been a cock and bull story on comp.os.linux.setup and I'm > > wondering about some of the details. Mainly, I'd like some education, > > please! > > The story, in essence: > > (i) Windows XP is running, with a normal NTFS filesystem(s). > > (ii) Power off without a proper shutdown. > Not particularly wise on NTFS. Upon next boot up it'll try to run chkdsk, > which you *must* not interrupt. 99% of the time it'll happily continue into a > normal boot. Not wise on any system. :-). > > (iii) Start again with a Linux Live CD (distribution not specified). > > (iv) This corrupts the NTFS journal(s). > No it does not. The NTFS journals (or the MSWindows partition and its NTFS) > have nothing to do with a LiveCD booting and running exclusively in RAM. I worked that out too. Beyond doubt, the teller of the tale was a troll, of dubious credibility. > > (v) It is now difficult to start Windows. > It would be without running chkdsk first, but you do not explain what the > difficulty amounts to ... error messages 'n all. The troll said he had to let chkdsk run "repeatedly", before W32 would boot. > > OK. My questions: > > o - Do live CDs actually mount filesystems on HDDs? > Only when you ask them to. I'm stupid. Of _course_ a live CD can't mount HDD filesystems at boot. To do this it would need /etc/fstab, for which it would need to be told the root partition. A live CD doesn't get this. > To mount NTFS you would these days use ntfs-3g: > ntfs-3g /dev/sda1 /mnt/windows > or > mount -t ntfs-3g /dev/sda1 /mnt/windows I hadn't heard of this. Useful to know, though. > > o - Would this actually try to mount an NTFS filesystem? > Linux LiveCDs will not typically mount anything whatsoever. They are by > default respectful of the devices on the system. I don't know if this > convention has changed recently, or if there are particular LiveCDs created > with different mounting conventions for the sake of MSWindows users - who > would not otherwise know how to mount a partition from Linux. > Can't recall what MSWindows based LiveCDs do (e.g. BartsPE). Something else I hadn't heard about before yesterday. > > o - Given that Linux's NTFS doesn't (?yet) do journaling (see kernel > > docs), would the driver not detect the presence of a journal and leave > > well alone? > The Kernel's NTFS driver is not safe for writing to a NTFS partition. It is > mostly a read only driver (check the Help page of the module, next time you're > rolling up a new kernel). If you mount a NTFS partition using the kernel > driver and then try to write to it in a way that it requires a change to the > fs journals then you will invariably corrupt the NTFS fs. The working > solution for NTFS partitions these days is the ntfs-3g userspace application > as mentioned above. > CONCLUSION: > To recover a MSWindows partition which did not shutdown cleanly, boot into > MSWindows and let it run through the chkdsk sequence. When it finishes all > should be good. Yes. > If the MSWindows journal is corrupted, then you could try running > ntfsfix /dev/sda1 > to force it to run chkdsk next time it boots. > When the MSWindows OS boots next time it will go through the chkdsk routine. > If that does not fix it either, then the journalling problem is probably > unrecoverable. In that case ntfs-3g won't work. Instead you could try > mounting the partition using the Linux kernel driver (read only of course) and > if it succeeds recover the files you need. > If the Linux kernel NTFS driver does not work, then we are into a full blown > recovery exercise. You could try testdisk and photorec. There are also a > bunch of MSWindows solutions too to recover NTFS partitions/files, but I'm not > sure if any of these are open source. > HTH. Indeed it does. Thanks! > -- > Regards, > Mick -- Alan Mackenzie (Nuremberg, Germany).