From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from pigeon.gentoo.org ([208.92.234.80] helo=lists.gentoo.org)
	by finch.gentoo.org with esmtp (Exim 4.60)
	(envelope-from <gentoo-user+bounces-125110-garchives=archives.gentoo.org@lists.gentoo.org>)
	id 1Qdi3j-0001J0-El
	for garchives@archives.gentoo.org; Mon, 04 Jul 2011 12:15:27 +0000
Received: from pigeon.gentoo.org (localhost [127.0.0.1])
	by pigeon.gentoo.org (Postfix) with SMTP id E74C521C0BA;
	Mon,  4 Jul 2011 12:14:04 +0000 (UTC)
Received: from mail.muc.de (colin.muc.de [193.149.48.1])
	by pigeon.gentoo.org (Postfix) with ESMTP id 6EFC621C0BA
	for <gentoo-user@lists.gentoo.org>; Mon,  4 Jul 2011 12:14:04 +0000 (UTC)
Received: (qmail 82808 invoked by uid 3782); 4 Jul 2011 12:14:03 -0000
Received: from acm.muc.de (pD9557494.dip.t-dialin.net [217.85.116.148]) by
	colin2.muc.de (tmda-ofmipd) with ESMTP;
	Mon, 04 Jul 2011 14:14:01 +0200
Received: (qmail 13509 invoked by uid 1000); 4 Jul 2011 12:12:03 -0000
Date: Mon, 4 Jul 2011 12:12:03 +0000
To: gentoo-user@lists.gentoo.org
Subject: Re: [gentoo-user] [OT]: Powering off Windows XP, crashing NTFS with
	a Live CD.
Message-ID: <20110704121203.GB30318@acm.acm>
References: <20110703103114.GA2739@acm.acm>
	<201107031317.42848.michaelkintzios@gmail.com>
Precedence: bulk
List-Post: <mailto:gentoo-user@lists.gentoo.org>
List-Help: <mailto:gentoo-user+help@lists.gentoo.org>
List-Unsubscribe: <mailto:gentoo-user+unsubscribe@lists.gentoo.org>
List-Subscribe: <mailto:gentoo-user+subscribe@lists.gentoo.org>
List-Id: Gentoo Linux mail <gentoo-user.gentoo.org>
X-BeenThere: gentoo-user@lists.gentoo.org
Reply-to: gentoo-user@lists.gentoo.org
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <201107031317.42848.michaelkintzios@gmail.com>
User-Agent: Mutt/1.5.21 (2010-09-15)
X-Delivery-Agent: TMDA/1.1.5 (Fettercairn)
From: Alan Mackenzie <acm@muc.de>
X-Primary-Address: acm@muc.de
X-Archives-Salt: 
X-Archives-Hash: bed571edecd2dbea4c853066dab4d65d

Hi, Mick.

On Sun, Jul 03, 2011 at 01:17:33PM +0100, Mick wrote:
> On Sunday 03 Jul 2011 11:31:14 Alan Mackenzie wrote:
> > Hi, Gentoo.

> > There's been a cock and bull story on comp.os.linux.setup and I'm
> > wondering about some of the details.  Mainly, I'd like some education,
> > please!

> > The story, in essence:
> > (i) Windows XP is running, with a normal NTFS filesystem(s).
> > (ii) Power off without a proper shutdown.

> Not particularly wise on NTFS.  Upon next boot up it'll try to run chkdsk, 
> which you *must* not interrupt.  99% of the time it'll happily continue into a 
> normal boot.

Not wise on any system.  :-).

> > (iii) Start again with a Linux Live CD (distribution not specified).
> > (iv) This corrupts the NTFS journal(s).

> No it does not.  The NTFS journals (or the MSWindows partition and its NTFS) 
> have nothing to do with a LiveCD booting and running exclusively in RAM.

I worked that out too.  Beyond doubt, the teller of the tale was a troll,
of dubious credibility.

> > (v) It is now difficult to start Windows.

> It would be without running chkdsk first, but you do not explain what the 
> difficulty amounts to ... error messages 'n all.

The troll said he had to let chkdsk run "repeatedly", before W32 would
boot.

> > OK.  My questions:
> > o - Do live CDs actually mount filesystems on HDDs?

> Only when you ask them to.

I'm stupid.  Of _course_ a live CD can't mount HDD filesystems at boot.
To do this it would need /etc/fstab, for which it would need to be told
the root partition.  A live CD doesn't get this.

> To mount NTFS you would these days use ntfs-3g:

>   ntfs-3g /dev/sda1 /mnt/windows

> or
>   mount -t ntfs-3g /dev/sda1 /mnt/windows

I hadn't heard of this.  Useful to know, though.

> > o - Would this actually try to mount an NTFS filesystem?

> Linux LiveCDs will not typically mount anything whatsoever.  They are by 
> default respectful of the devices on the system.  I don't know if this 
> convention has changed recently, or if there are particular LiveCDs created 
> with different mounting conventions for the sake of MSWindows users - who 
> would not otherwise know how to mount a partition from Linux.

> Can't recall what MSWindows based LiveCDs do (e.g. BartsPE).

Something else I hadn't heard about before yesterday.

> > o - Given that Linux's NTFS doesn't (?yet) do journaling (see kernel
> >   docs), would the driver not detect the presence of a journal and leave
> >   well alone?

> The Kernel's NTFS driver is not safe for writing to a NTFS partition.  It is 
> mostly a read only driver (check the Help page of the module, next time you're 
> rolling up a new kernel).  If you mount a NTFS partition using the kernel 
> driver and then try to write to it in a way that it requires a change to the 
> fs journals then you will invariably corrupt the NTFS fs.  The working 
> solution for NTFS partitions these days is the ntfs-3g userspace application 
> as mentioned above.


> CONCLUSION:

> To recover a MSWindows partition which did not shutdown cleanly, boot into 
> MSWindows and let it run through the chkdsk sequence.  When it finishes all 
> should be good.

Yes.

> If the MSWindows journal is corrupted, then you could try running 

>   ntfsfix /dev/sda1

> to force it to run chkdsk next time it boots.

> When the MSWindows OS boots next time it will go through the chkdsk routine.  
> If that does not fix it either, then the journalling problem is probably 
> unrecoverable.  In that case ntfs-3g won't work.  Instead you could try 
> mounting the partition using the Linux kernel driver (read only of course) and 
> if it succeeds recover the files you need.

> If the Linux kernel NTFS driver does not work, then we are into a full blown 
> recovery exercise.  You could try testdisk and photorec.  There are also a 
> bunch of MSWindows solutions too to recover NTFS partitions/files, but I'm not 
> sure if any of these are open source.

> HTH.

Indeed it does.  Thanks!

> -- 
> Regards,
> Mick

-- 
Alan Mackenzie (Nuremberg, Germany).