[gentoo-user] [OT]: Powering off Windows XP, crashing NTFS with a Live CD.

[gentoo-user] [OT]: Powering off Windows XP, crashing NTFS with a Live CD.

[Alan Mackenzie]

Hi, Gentoo.

There's been a cock and bull story on comp.os.linux.setup and I'm
wondering about some of the details.  Mainly, I'd like some education,
please!

The story, in essence:
(i) Windows XP is running, with a normal NTFS filesystem(s).
(ii) Power off without a proper shutdown.
(iii) Start again with a Linux Live CD (distribution not specified).
(iv) This corrupts the NTFS journal(s).
(v) It is now difficult to start Windows.

OK.  My questions:
o - Do live CDs actually mount filesystems on HDDs?
o - If so, would the start-up actually write anything to a partition?
o - Would this actually try to mount an NTFS filesystem?
o - Given that Linux's NTFS doesn't (?yet) do journaling (see kernel
  docs), would the driver not detect the presence of a journal and leave
  well alone? 

-- 
Alan Mackenzie (Nuremberg, Germany).

Re: [gentoo-user] [OT]: Powering off Windows XP, crashing NTFS with a Live CD.

[Mick]

[-- Attachment #1: Type: Text/Plain, Size: 3517 bytes --]

On Sunday 03 Jul 2011 11:31:14 Alan Mackenzie wrote:
> Hi, Gentoo.
> 
> There's been a cock and bull story on comp.os.linux.setup and I'm
> wondering about some of the details.  Mainly, I'd like some education,
> please!
> 
> The story, in essence:
> (i) Windows XP is running, with a normal NTFS filesystem(s).
> (ii) Power off without a proper shutdown.

Not particularly wise on NTFS.  Upon next boot up it'll try to run chkdsk, 
which you *must* not interrupt.  99% of the time it'll happily continue into a 
normal boot.


> (iii) Start again with a Linux Live CD (distribution not specified).
> (iv) This corrupts the NTFS journal(s).

No it does not.  The NTFS journals (or the MSWindows partition and its NTFS) 
have nothing to do with a LiveCD booting and running exclusively in RAM.
 

> (v) It is now difficult to start Windows.

It would be without running chkdsk first, but you do not explain what the 
difficulty amounts to ... error messages 'n all.


> OK.  My questions:
> o - Do live CDs actually mount filesystems on HDDs?

Only when you ask them to.

To mount NTFS you would these days use ntfs-3g:

  ntfs-3g /dev/sda1 /mnt/windows

or
  mount -t ntfs-3g /dev/sda1 /mnt/windows


> o - If so, would the start-up actually write anything to a partition?

Nope.  The start-up of a LiveCD happens in RAM.


> o - Would this actually try to mount an NTFS filesystem?

Linux LiveCDs will not typically mount anything whatsoever.  They are by 
default respectful of the devices on the system.  I don't know if this 
convention has changed recently, or if there are particular LiveCDs created 
with different mounting conventions for the sake of MSWindows users - who 
would not otherwise know how to mount a partition from Linux.

Can't recall what MSWindows based LiveCDs do (e.g. BartsPE).


> o - Given that Linux's NTFS doesn't (?yet) do journaling (see kernel
>   docs), would the driver not detect the presence of a journal and leave
>   well alone?

The Kernel's NTFS driver is not safe for writing to a NTFS partition.  It is 
mostly a read only driver (check the Help page of the module, next time you're 
rolling up a new kernel).  If you mount a NTFS partition using the kernel 
driver and then try to write to it in a way that it requires a change to the 
fs journals then you will invariably corrupt the NTFS fs.  The working 
solution for NTFS partitions these days is the ntfs-3g userspace application 
as mentioned above.


CONCLUSION:

To recover a MSWindows partition which did not shutdown cleanly, boot into 
MSWindows and let it run through the chkdsk sequence.  When it finishes all 
should be good.

If the MSWindows journal is corrupted, then you could try running 

  ntfsfix /dev/sda1

to force it to run chkdsk next time it boots.

When the MSWindows OS boots next time it will go through the chkdsk routine.  
If that does not fix it either, then the journalling problem is probably 
unrecoverable.  In that case ntfs-3g won't work.  Instead you could try 
mounting the partition using the Linux kernel driver (read only of course) and 
if it succeeds recover the files you need.

If the Linux kernel NTFS driver does not work, then we are into a full blown 
recovery exercise.  You could try testdisk and photorec.  There are also a 
bunch of MSWindows solutions too to recover NTFS partitions/files, but I'm not 
sure if any of these are open source.

HTH.
-- 
Regards,
Mick

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 198 bytes --]

Re: [gentoo-user] [OT]: Powering off Windows XP, crashing NTFS with a Live CD.

[Alan Mackenzie]

Hi, Mick.

On Sun, Jul 03, 2011 at 01:17:33PM +0100, Mick wrote:
> On Sunday 03 Jul 2011 11:31:14 Alan Mackenzie wrote:
> > Hi, Gentoo.

> > There's been a cock and bull story on comp.os.linux.setup and I'm
> > wondering about some of the details.  Mainly, I'd like some education,
> > please!

> > The story, in essence:
> > (i) Windows XP is running, with a normal NTFS filesystem(s).
> > (ii) Power off without a proper shutdown.

> Not particularly wise on NTFS.  Upon next boot up it'll try to run chkdsk, 
> which you *must* not interrupt.  99% of the time it'll happily continue into a 
> normal boot.

Not wise on any system.  :-).

> > (iii) Start again with a Linux Live CD (distribution not specified).
> > (iv) This corrupts the NTFS journal(s).

> No it does not.  The NTFS journals (or the MSWindows partition and its NTFS) 
> have nothing to do with a LiveCD booting and running exclusively in RAM.

I worked that out too.  Beyond doubt, the teller of the tale was a troll,
of dubious credibility.

> > (v) It is now difficult to start Windows.

> It would be without running chkdsk first, but you do not explain what the 
> difficulty amounts to ... error messages 'n all.

The troll said he had to let chkdsk run "repeatedly", before W32 would
boot.

> > OK.  My questions:
> > o - Do live CDs actually mount filesystems on HDDs?

> Only when you ask them to.

I'm stupid.  Of _course_ a live CD can't mount HDD filesystems at boot.
To do this it would need /etc/fstab, for which it would need to be told
the root partition.  A live CD doesn't get this.

> To mount NTFS you would these days use ntfs-3g:

>   ntfs-3g /dev/sda1 /mnt/windows

> or
>   mount -t ntfs-3g /dev/sda1 /mnt/windows

I hadn't heard of this.  Useful to know, though.

> > o - Would this actually try to mount an NTFS filesystem?

> Linux LiveCDs will not typically mount anything whatsoever.  They are by 
> default respectful of the devices on the system.  I don't know if this 
> convention has changed recently, or if there are particular LiveCDs created 
> with different mounting conventions for the sake of MSWindows users - who 
> would not otherwise know how to mount a partition from Linux.

> Can't recall what MSWindows based LiveCDs do (e.g. BartsPE).

Something else I hadn't heard about before yesterday.

> > o - Given that Linux's NTFS doesn't (?yet) do journaling (see kernel
> >   docs), would the driver not detect the presence of a journal and leave
> >   well alone?

> The Kernel's NTFS driver is not safe for writing to a NTFS partition.  It is 
> mostly a read only driver (check the Help page of the module, next time you're 
> rolling up a new kernel).  If you mount a NTFS partition using the kernel 
> driver and then try to write to it in a way that it requires a change to the 
> fs journals then you will invariably corrupt the NTFS fs.  The working 
> solution for NTFS partitions these days is the ntfs-3g userspace application 
> as mentioned above.


> CONCLUSION:

> To recover a MSWindows partition which did not shutdown cleanly, boot into 
> MSWindows and let it run through the chkdsk sequence.  When it finishes all 
> should be good.

Yes.

> If the MSWindows journal is corrupted, then you could try running 

>   ntfsfix /dev/sda1

> to force it to run chkdsk next time it boots.

> When the MSWindows OS boots next time it will go through the chkdsk routine.  
> If that does not fix it either, then the journalling problem is probably 
> unrecoverable.  In that case ntfs-3g won't work.  Instead you could try 
> mounting the partition using the Linux kernel driver (read only of course) and 
> if it succeeds recover the files you need.

> If the Linux kernel NTFS driver does not work, then we are into a full blown 
> recovery exercise.  You could try testdisk and photorec.  There are also a 
> bunch of MSWindows solutions too to recover NTFS partitions/files, but I'm not 
> sure if any of these are open source.

> HTH.

Indeed it does.  Thanks!

> -- 
> Regards,
> Mick

-- 
Alan Mackenzie (Nuremberg, Germany).

Re: [gentoo-user] [OT]: Powering off Windows XP, crashing NTFS with a Live CD.

[Neil Bothwick]

[-- Attachment #1: Type: text/plain, Size: 755 bytes --]

On Mon, 4 Jul 2011 12:12:03 +0000, Alan Mackenzie wrote:

> > > o - Do live CDs actually mount filesystems on HDDs?  
> 
> > Only when you ask them to.  
> 
> I'm stupid.  Of _course_ a live CD can't mount HDD filesystems at boot.
> To do this it would need /etc/fstab, for which it would need to be told
> the root partition.  A live CD doesn't get this.

A live CD can mount partitions automatically at boot, some do. all it
needs to do is scan the disk partition tables, create the mount points
and mount them.

Knoppix has been doing the first two for years, and writing the details
to /etc/fstab to allow the user to mount them easily.


-- 
Neil Bothwick

A computer without Microsoft is like a chocolate cake without mustard.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 198 bytes --]

Re: [gentoo-user] [OT]: Powering off Windows XP, crashing NTFS with a Live CD.

[Joshua Murphy]

On Mon, Jul 4, 2011 at 9:15 AM, Neil Bothwick <neil@digimed.co.uk> wrote:
> On Mon, 4 Jul 2011 12:12:03 +0000, Alan Mackenzie wrote:
>
>> > > o - Do live CDs actually mount filesystems on HDDs?
>>
>> > Only when you ask them to.
>>
>> I'm stupid.  Of _course_ a live CD can't mount HDD filesystems at boot.
>> To do this it would need /etc/fstab, for which it would need to be told
>> the root partition.  A live CD doesn't get this.
>
> A live CD can mount partitions automatically at boot, some do. all it
> needs to do is scan the disk partition tables, create the mount points
> and mount them.
>
> Knoppix has been doing the first two for years, and writing the details
> to /etc/fstab to allow the user to mount them easily.
>
>
> --
> Neil Bothwick
>
> A computer without Microsoft is like a chocolate cake without mustard.
>

And to further complicate it, many also use a similar technique for
finding themselves, mounting one filesystem after another until they
find some distinct marker file to identify where to find the rest of
their data. Others auto-mount and poke around for auto-loading of
extensions unless such features are disabled by a boot-time option.

-- 
Joshua M. Murphy

Re: [gentoo-user] [OT]: Powering off Windows XP, crashing NTFS with a Live CD.

[Mick]

[-- Attachment #1: Type: Text/Plain, Size: 1710 bytes --]

On Monday 04 Jul 2011 15:48:06 Joshua Murphy wrote:
> On Mon, Jul 4, 2011 at 9:15 AM, Neil Bothwick <neil@digimed.co.uk> wrote:
> > On Mon, 4 Jul 2011 12:12:03 +0000, Alan Mackenzie wrote:
> >> > > o - Do live CDs actually mount filesystems on HDDs?
> >> > 
> >> > Only when you ask them to.
> >> 
> >> I'm stupid.  Of _course_ a live CD can't mount HDD filesystems at boot.
> >> To do this it would need /etc/fstab, for which it would need to be told
> >> the root partition.  A live CD doesn't get this.
> > 
> > A live CD can mount partitions automatically at boot, some do. all it
> > needs to do is scan the disk partition tables, create the mount points
> > and mount them.
> > 
> > Knoppix has been doing the first two for years, and writing the details
> > to /etc/fstab to allow the user to mount them easily.
> > 
> > 
> > --
> > Neil Bothwick
> > 
> > A computer without Microsoft is like a chocolate cake without mustard.
> 
> And to further complicate it, many also use a similar technique for
> finding themselves, mounting one filesystem after another until they
> find some distinct marker file to identify where to find the rest of
> their data. Others auto-mount and poke around for auto-loading of
> extensions unless such features are disabled by a boot-time option.

I've only come across LiveCDs which scan the drive and create mount points - 
but not mount any device unless explicitly asked to do so by the user.

However, I wouldn't be surprised if some more recent installation CDs go 
further than that, as Joshua claims.

Joshua, which LiveCDs behave in the way you describe by automounting 
partitions and searching fs?

-- 
Regards,
Mick

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 198 bytes --]

Re: [gentoo-user] [OT]: Powering off Windows XP, crashing NTFS with a Live CD.

[Joshua Murphy]

On Mon, Jul 4, 2011 at 12:00 PM, Mick <michaelkintzios@gmail.com> wrote:
> On Monday 04 Jul 2011 15:48:06 Joshua Murphy wrote:
>> On Mon, Jul 4, 2011 at 9:15 AM, Neil Bothwick <neil@digimed.co.uk> wrote:
>> > On Mon, 4 Jul 2011 12:12:03 +0000, Alan Mackenzie wrote:
>> >> > > o - Do live CDs actually mount filesystems on HDDs?
>> >> >
>> >> > Only when you ask them to.
>> >>
>> >> I'm stupid.  Of _course_ a live CD can't mount HDD filesystems at boot.
>> >> To do this it would need /etc/fstab, for which it would need to be told
>> >> the root partition.  A live CD doesn't get this.
>> >
>> > A live CD can mount partitions automatically at boot, some do. all it
>> > needs to do is scan the disk partition tables, create the mount points
>> > and mount them.
>> >
>> > Knoppix has been doing the first two for years, and writing the details
>> > to /etc/fstab to allow the user to mount them easily.
>> >
>> >
>> > --
>> > Neil Bothwick
>> >
>> > A computer without Microsoft is like a chocolate cake without mustard.
>>
>> And to further complicate it, many also use a similar technique for
>> finding themselves, mounting one filesystem after another until they
>> find some distinct marker file to identify where to find the rest of
>> their data. Others auto-mount and poke around for auto-loading of
>> extensions unless such features are disabled by a boot-time option.
>
> I've only come across LiveCDs which scan the drive and create mount points -
> but not mount any device unless explicitly asked to do so by the user.
>
> However, I wouldn't be surprised if some more recent installation CDs go
> further than that, as Joshua claims.
>
> Joshua, which LiveCDs behave in the way you describe by automounting
> partitions and searching fs?
>
> --
> Regards,
> Mick
>

I haven't seen any install cds that do that, but DSL and, if I recall,
TinyCore/MicroCore look for extensions in a default path on the local
filesystems. One thing I'm fairly sure on, though, is that without the
"-f" flag, mount won't take the risk on an unclean NTFS, and instead
just tosses an "are you sure?" message, which would make me presume
even those livecds that do look for extensions wouldn't risk the
damage there.

-- 
Poison [BLX]
Joshua M. Murphy

Re: [gentoo-user] [OT]: Powering off Windows XP, crashing NTFS with a Live CD.

[Mick]

[-- Attachment #1: Type: Text/Plain, Size: 3412 bytes --]

On Monday 04 Jul 2011 17:15:55 Joshua Murphy wrote:
> On Mon, Jul 4, 2011 at 12:00 PM, Mick <michaelkintzios@gmail.com> wrote:
> > On Monday 04 Jul 2011 15:48:06 Joshua Murphy wrote:
> >> On Mon, Jul 4, 2011 at 9:15 AM, Neil Bothwick <neil@digimed.co.uk> wrote:
> >> > On Mon, 4 Jul 2011 12:12:03 +0000, Alan Mackenzie wrote:
> >> >> > > o - Do live CDs actually mount filesystems on HDDs?
> >> >> > 
> >> >> > Only when you ask them to.
> >> >> 
> >> >> I'm stupid.  Of _course_ a live CD can't mount HDD filesystems at
> >> >> boot. To do this it would need /etc/fstab, for which it would need
> >> >> to be told the root partition.  A live CD doesn't get this.
> >> > 
> >> > A live CD can mount partitions automatically at boot, some do. all it
> >> > needs to do is scan the disk partition tables, create the mount points
> >> > and mount them.
> >> > 
> >> > Knoppix has been doing the first two for years, and writing the
> >> > details to /etc/fstab to allow the user to mount them easily.
> >> > 
> >> > 
> >> > --
> >> > Neil Bothwick
> >> > 
> >> > A computer without Microsoft is like a chocolate cake without mustard.
> >> 
> >> And to further complicate it, many also use a similar technique for
> >> finding themselves, mounting one filesystem after another until they
> >> find some distinct marker file to identify where to find the rest of
> >> their data. Others auto-mount and poke around for auto-loading of
> >> extensions unless such features are disabled by a boot-time option.
> > 
> > I've only come across LiveCDs which scan the drive and create mount
> > points - but not mount any device unless explicitly asked to do so by
> > the user.
> > 
> > However, I wouldn't be surprised if some more recent installation CDs go
> > further than that, as Joshua claims.
> > 
> > Joshua, which LiveCDs behave in the way you describe by automounting
> > partitions and searching fs?
> > 
> > --
> > Regards,
> > Mick
> 
> I haven't seen any install cds that do that, but DSL and, if I recall,
> TinyCore/MicroCore look for extensions in a default path on the local
> filesystems. 

I had to look again at DSL because last time I used it a couple of years ago 
it definitely did not automount anything - unless ... you had set up a 
persistent /home or settings directory.  In that case it would mount the 
device in which you saved your settings, but this would be something the user 
would set up and run consciously at boot time.


> One thing I'm fairly sure on, though, is that without the
> "-f" flag, mount won't take the risk on an unclean NTFS, and instead
> just tosses an "are you sure?" message, which would make me presume
> even those livecds that do look for extensions wouldn't risk the
> damage there.

From what I recall the Linux kernel NTFS driver will mount a unclean NTFS 
partition regardless (can't recall for sure though), but the ntfs-3g will 
behave as you describe above.

So in answer to the OP questions, the only way I can think that a Linux LiveCD 
would corrupt a NTFS partition is to mount it with the Linux Kernel driver as 
rw and then create or edit a file.

If this was not the case and fs corruption ensued, then it would be just a 
coincidence that the drive had some bad blocks and they decided to play up at 
the time the MSWindows fs was being booted into.
-- 
Regards,
Mick

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 198 bytes --]