[gentoo-user] OT: Rebuilding an NTFS directory structure

[gentoo-user] OT: Rebuilding an NTFS directory structure

[Peter Humphrey]

Hello list,

Someone not far from here has yanked his USB disk out of his computer once 
too often, without unmounting it, and now the whole disk is shown as off-line 
and inaccessible by his WinXP system. I'm trying to recover his data for 
him, which is mostly music files.

Does anyone here know of a tool that can rebuild an NTFS directory 
structure? I've tried several tools I found with Google, but the only one 
that had any success has extracted hundreds of small text files and lots of 
mp3 and other files, but with arbitrary names and no indication of how it all 
hangs together. It doesn't look very useful to me.

It's a lesson hard learnt for the lad, of course, but the problem with that 
is that it's another person's data, so any help would be gratefully 
received.

-- 
Rgds
Peter

Re: [gentoo-user] OT: Rebuilding an NTFS directory structure

[Mick]

[-- Attachment #1: Type: Text/Plain, Size: 850 bytes --]

On Saturday 09 January 2010 11:48:35 Peter Humphrey wrote:

> Does anyone here know of a tool that can rebuild an NTFS directory
> structure? I've tried several tools I found with Google, but the only one
> that had any success has extracted hundreds of small text files and lots of
> mp3 and other files, but with arbitrary names and no indication of how it
>  all hangs together. It doesn't look very useful to me.

I have tried ntfsfix.  It resets the ntfs journal and when the drive is booted 
into MSWindows it'll run a chkdsk - make sure you do not interrupt this!

In your friend's case you can force a chkdsk by right-clicking on the drive in 
Windows Explorer/Properties/Tools/Error-checking.

Other than that I think we're into a file recovery mode involving tools like 
photorec and dd_rescue.

HTH.
-- 
Regards,
Mick

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 198 bytes --]

Re: [gentoo-user] OT: Rebuilding an NTFS directory structure

[Peter Humphrey]

On Saturday 09 January 2010 12:34:26 Mick wrote:

> I have tried ntfsfix.

That's a new one to me - thanks.

> It resets the ntfs journal and when the drive is booted into MSWindows
> it'll run a chkdsk - make sure you do not interrupt this!

The disk in question is an external USB disk.

> In your friend's case you can force a chkdsk by right-clicking on the
> drive in Windows Explorer/Properties/Tools/Error-checking.

The only Windows system I can run at the moment is on my laptop; as soon as 
I plug the disk in I get a BSoD, so that's no help. On this box (my nice new 
i5 machine) Gentoo can't cope with USB storage devices at all - Plasma work-
space crashes immediately, together with Dolphin and Krunner; so I can't use 
that either. Ubuntu on the same box can't see the disk when I plug it in. 
The only Linux I can run that can see the disk is SysRescCd, either on the 
i5 box or on my laptop. Its ntfsfix said it had run successfully, but I still 
get the BSoD in WinXP, and ntfsck encounters problems it can't fix.
 
> Other than that I think we're into a file recovery mode involving tools
> like photorec and dd_rescue.

Photorec is what I've used to extract a few thousand files - the ones I 
mentioned with the unhelpful names. Maybe dd_rescue will help. Otherwise 
I'll give the disk back together with the rescued files and tell the lad to 
format it VFAT.

> HTH.

Indeed. Thanks again, Mick.

Re: [gentoo-user] OT: Rebuilding an NTFS directory structure

[Stroller]

On 9 Jan 2010, at 16:49, Peter Humphrey wrote:
> On Saturday 09 January 2010 12:34:26 Mick wrote:
> ...
>> It resets the ntfs journal and when the drive is booted into  
>> MSWindows
>> it'll run a chkdsk - make sure you do not interrupt this!
>
> The disk in question is an external USB disk.
>
>> In your friend's case you can force a chkdsk by right-clicking on the
>> drive in Windows Explorer/Properties/Tools/Error-checking.
>
> The only Windows system I can run at the moment is on my laptop; as  
> soon as
> I plug the disk in I get a BSoD, so that's no help.

I _believe_ that if you leave the USB drive, with the corrupt  
filesystem, plugged in when the laptop boots, then during the boot  
process the `chkdsk` will be performed.

I was not aware of `ntfsfix`, and have been of the opinion that the  
best way to repair a corrupt NTFS filesystem was to use `chkdsk`, this  
being MS's own tool for the job. If the `chkdsk` does indeed run  
during boot, I would probably do a second one, just to be sure. If you  
initiate `chkdsk` at the command line, instead of using the UI as  
described by Mick, you get some extra options. `chkdsk /?`

>> Other than that I think we're into a file recovery mode involving  
>> tools
>> like photorec and dd_rescue.
>
> Photorec is what I've used to extract a few thousand files - the  
> ones I
> mentioned with the unhelpful names. Maybe dd_rescue will help.

The problem with dd_rescue (GNU ddrescue is better, if I am  
remembering the underscore spelling correctly) is that it will produce  
an exact image of the disk, with the filesystem intact and (in your  
case) still corrupt. However you might use this as a backup image of  
your starting point, to give you multiple chances at repairing the fs  
using different approaches.

Stroller.

Re: [gentoo-user] OT: Rebuilding an NTFS directory structure

[Peter Humphrey]

On Saturday 09 January 2010 19:27:37 Stroller wrote:

> I _believe_ that if you leave the USB drive, with the corrupt
> filesystem, plugged in when the laptop boots, then during the boot
> process the `chkdsk` will be performed.

Unfortunately not. I was hoping so too, but when I tried it I got the same 
BSoD. XP just will not run in the presence of this disk.

> I was not aware of `ntfsfix`, and have been of the opinion that the
> best way to repair a corrupt NTFS filesystem was to use `chkdsk`, this
> being MS's own tool for the job. If the `chkdsk` does indeed run
> during boot, I would probably do a second one, just to be sure. If you
> initiate `chkdsk` at the command line, instead of using the UI as
> described by Mick, you get some extra options. `chkdsk /?`

I haven't yet discovered any way of getting XP running with this disk 
connected, more's the pity.
 
> The problem with dd_rescue (GNU ddrescue is better, if I am
> remembering the underscore spelling correctly) is that it will produce
> an exact image of the disk, with the filesystem intact and (in your
> case) still corrupt.

Indeed, that is what it does.

> However you might use this as a backup image of your starting point, to
> give you multiple chances at repairing the fs using different approaches.

Now I'm running out of space to store the data in.

Thanks all for the suggestions.

Re: [gentoo-user] OT: Rebuilding an NTFS directory structure

[Stroller]

On 9 Jan 2010, at 22:33, Peter Humphrey wrote:
> ...
>> However you might use this as a backup image of your starting  
>> point, to
>> give you multiple chances at repairing the fs using different  
>> approaches.
>
> Now I'm running out of space to store the data in.

Invest in storage. Doing so will make you glad.

Stroller.

Re: [gentoo-user] OT: Rebuilding an NTFS directory structure

[Neil Bothwick]

[-- Attachment #1: Type: text/plain, Size: 576 bytes --]

On Sat, 9 Jan 2010 16:49:50 +0000, Peter Humphrey wrote:

> > Other than that I think we're into a file recovery mode involving
> > tools like photorec and dd_rescue.  
> 
> Photorec is what I've used to extract a few thousand files - the ones I 
> mentioned with the unhelpful names.

The MP3 files probably have ID3 tags containing artist, album and title
information, so it should be possible to use a script to rename them
(Goggle will most likely turn up a few options).


-- 
Neil Bothwick

Will we ever get out of this airport? asked Tom interminably.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 198 bytes --]

Re: [gentoo-user] OT: Rebuilding an NTFS directory structure

[Peter Humphrey]

On Saturday 09 January 2010 19:47:33 Neil Bothwick wrote:

> The MP3 files probably have ID3 tags containing artist, album and title
> information, so it should be possible to use a script to rename them
> (Goggle will most likely turn up a few options).

That's a good idea - thanks.

Re: [gentoo-user] OT: Rebuilding an NTFS directory structure

[Adam]

> The MP3 files probably have ID3 tags containing artist, album and title
> information, so it should be possible to use a script to rename them
> (Goggle will most likely turn up a few options).

Looks like audiotag can do that, here's a snip of the help;

      --rename-files            rename files based on meta-data
      --rename-pattern          pattern to use when renaming files.  when no
                                  rename pattern is specified, the rename
                                  pattern defaults to: "%T. %a - %t"
                                  string replacement directives:
                                    %T: track number
                                    %a: artist name
                                    %t: song title
                                    %A: album name
				  You can specify subdirectories in the rename
				  pattern. "%a - %A/%T. %t" will rename and move
				  the files. "%a -%A/" moves the files to new
				  subdirectories without renaming.

Re: [gentoo-user] OT: Rebuilding an NTFS directory structure

[Peter Humphrey]

On Sunday 10 January 2010 12:00:40 Adam wrote:
> > The MP3 files probably have ID3 tags containing artist, album and title
> > information, so it should be possible to use a script to rename them
> > (Goggle will most likely turn up a few options).
> 
> Looks like audiotag can do that

Hm. Its website says it's for ID3/Ogg files, whatever ID3 is. I'd have a go 
anyway, but the disk with all the data has been taken home again. I don't 
have my own copy because the only space I have for it is on the machine that 
can't see the disk :-(

Thanks anyway - what a lot of helpful people live here!

-- 
Rgds
Peter.

Re: [gentoo-user] OT: Rebuilding an NTFS directory structure

[Neil Bothwick]

[-- Attachment #1: Type: text/plain, Size: 586 bytes --]

On Mon, 11 Jan 2010 11:51:20 +0000, Peter Humphrey wrote:

> > > The MP3 files probably have ID3 tags containing artist, album and
> > > title information, so it should be possible to use a script to
> > > rename them (Goggle will most likely turn up a few options).  
> > 
> > Looks like audiotag can do that  
> 
> Hm. Its website says it's for ID3/Ogg files, whatever ID3 is.

It's in the text you quoted :) ID3 is the tag format used by MP3 files.


-- 
Neil Bothwick

Why do programmers get Halloween and Christmas confused?
Because oct 31 is the same as dec 25.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 198 bytes --]

Re: [gentoo-user] OT: Rebuilding an NTFS directory structure

[Peter Humphrey]

On Monday 11 January 2010 13:27:30 Neil Bothwick wrote:
> On Mon, 11 Jan 2010 11:51:20 +0000, Peter Humphrey wrote:
> > > > The MP3 files probably have ID3 tags containing artist, album and
> > > > title information, so it should be possible to use a script to
> > > > rename them (Goggle will most likely turn up a few options).
> > >
> > > Looks like audiotag can do that
> >
> > Hm. Its website says it's for ID3/Ogg files, whatever ID3 is.
> 
> It's in the text you quoted :) ID3 is the tag format used by MP3 files.

So it is. Looks like 11:51 is still too early in the morning.

Ho hum.

-- 
Rgds
Peter.

Re: [gentoo-user] OT: Rebuilding an NTFS directory structure

[Neil Bothwick]

[-- Attachment #1: Type: text/plain, Size: 244 bytes --]

On Mon, 11 Jan 2010 15:15:37 +0000, Peter Humphrey wrote:

> So it is. Looks like 11:51 is still too early in the morning.

If it's morning, it's too early :)


-- 
Neil Bothwick

WYTYSYDG - What you thought you saw, you didn't get.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 198 bytes --]

[gentoo-user] Re: OT: Rebuilding an NTFS directory structure

[walt]

On 01/09/2010 03:48 AM, Peter Humphrey wrote:
> Hello list,
>
> Someone not far from here has yanked his USB disk out of his computer once
> too often, without unmounting it, and now the whole disk is shown as off-line
> and inaccessible by his WinXP system. I'm trying to recover his data for
> him, which is mostly music files.
>
> Does anyone here know of a tool that can rebuild an NTFS directory
> structure?

USB sticks are normally formatted with a FAT filesystem. Are you sure his
is NTFS instead?

Re: [gentoo-user] Re: OT: Rebuilding an NTFS directory structure

[Peter Humphrey]

On Saturday 09 January 2010 19:57:15 walt wrote:

> USB sticks are normally formatted with a FAT filesystem. Are you sure his
> is NTFS instead?

It isn't a stick, it's an external hard drive of something like 220GB 
capacity.

Re: [gentoo-user] Re: OT: Rebuilding an NTFS directory structure

[Mick]

[-- Attachment #1: Type: Text/Plain, Size: 1096 bytes --]

On Saturday 09 January 2010 19:57:15 walt wrote:
> On 01/09/2010 03:48 AM, Peter Humphrey wrote:
> > Hello list,
> >
> > Someone not far from here has yanked his USB disk out of his computer
> > once too often, without unmounting it, and now the whole disk is shown as
> > off-line and inaccessible by his WinXP system. I'm trying to recover his
> > data for him, which is mostly music files.
> >
> > Does anyone here know of a tool that can rebuild an NTFS directory
> > structure?
> 
> USB sticks are normally formatted with a FAT filesystem. Are you sure his
> is NTFS instead?

I thought that the OP mentioned an external USB drive, rather than a CF stick.  
Either way, one more thing that came to mind:

if the drive is partitioned, what may have been corrupted besides the files 
being written at the time it was disconnected from the OS, could be the 
partition boot record.  In this case running fixboot with a WinXP installation 
CD would restore the partition record and you will be able to access it and 
run chkdisk with the MSWindows OS.
-- 
Regards,
Mick

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 198 bytes --]