[gentoo-user] NTFS free space disappeared

[gentoo-user] NTFS free space disappeared

[ert256]

[-- Attachment #1: Type: text/plain, Size: 919 bytes --]

Hello
I have some weird problem width NTFS partition in linux environment.
I have Knoppix LiveCD on some machine, which i want to clean out.
There was some virus and windows is unusable, so I'm copying data over
network to other machine, but what is the point
/media/sda5 is ntfs mounted in rea-only mode
root@Knoppix:/media# df -h
Filesystem            Size  Used Avail Use% Mounted on
/dev/sda5              31G   29G  2.3G  93% /media/sda5
root@Knoppix:~# du -h --summarize /media/sda5/
19G     /media/sda5/
I cannot fire up windows, because it is dangerous, and  that windows on
this machine is broken.
Question is : Where is missing 10G on NTFS partition ? Can I safely
clean disk without risk of data loss?
Thank you

-- 
Rafał (ert16) Trójniak
m@il : ert256@gmail.com
Jid : ert256@gmail.com ert16@chrome.pl 
GPG  key-ID : DD681D47 
749F E1DC A58F 9084 BBC0  
797A 0691 53D6 DD68 1D47



[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 260 bytes --]

[gentoo-user] Re: NTFS free space disappeared

[ert256]

[-- Attachment #1: Type: text/plain, Size: 1105 bytes --]

[ 18.09.2008 22:00 ], ert256 :
> Hello
> I have some weird problem width NTFS partition in linux environment.
> I have Knoppix LiveCD on some machine, which i want to clean out.
> There was some virus and windows is unusable, so I'm copying data over
> network to other machine, but what is the point
> /media/sda5 is ntfs mounted in rea-only mode
> root@Knoppix:/media# df -h
> Filesystem            Size  Used Avail Use% Mounted on
> /dev/sda5              31G   29G  2.3G  93% /media/sda5
> root@Knoppix:~# du -h --summarize /media/sda5/
> 19G     /media/sda5/
> I cannot fire up windows, because it is dangerous, and  that windows on
> this machine is broken.
> Question is : Where is missing 10G on NTFS partition ? Can I safely
> clean disk without risk of data loss?
> Thank you
Line from /etc/mtab for that disk :
/dev/sda5 /media/sda5 fuseblk
ro,nosuid,nodev,noatime,allow_other,blksize=4096 0 0




-- 
Rafał (ert16) Trójniak
m@il : ert256@gmail.com
Jid : ert256@gmail.com ert16@chrome.pl
GPG  key-ID : DD681D47
749F E1DC A58F 9084 BBC0
797A 0691 53D6 DD68 1D47


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 260 bytes --]

Re: [gentoo-user] NTFS free space disappeared

[b.n.]

ert256 ha scritto:
> Hello
> I have some weird problem width NTFS partition in linux environment.
> I have Knoppix LiveCD on some machine, which i want to clean out.
> There was some virus and windows is unusable, so I'm copying data over
> network to other machine, but what is the point
> /media/sda5 is ntfs mounted in rea-only mode
> root@Knoppix:/media# df -h
> Filesystem            Size  Used Avail Use% Mounted on
> /dev/sda5              31G   29G  2.3G  93% /media/sda5
> root@Knoppix:~# du -h --summarize /media/sda5/
> 19G     /media/sda5/
> I cannot fire up windows, because it is dangerous, and  that windows on
> this machine is broken.
> Question is : Where is missing 10G on NTFS partition ? Can I safely
> clean disk without risk of data loss?
> Thank you
> 

du and df show different things.
There was a thread, recently, on the subject:
http://www.gossamer-threads.com/lists/gentoo/user/170503

m.

Re: [gentoo-user] NTFS free space disappeared

[Alan McKinnon]

On Saturday 20 September 2008 03:04:38 b.n. wrote:
> ert256 ha scritto:
> > Hello
> > I have some weird problem width NTFS partition in linux environment.
> > I have Knoppix LiveCD on some machine, which i want to clean out.
> > There was some virus and windows is unusable, so I'm copying data over
> > network to other machine, but what is the point
> > /media/sda5 is ntfs mounted in rea-only mode
> > root@Knoppix:/media# df -h
> > Filesystem            Size  Used Avail Use% Mounted on
> > /dev/sda5              31G   29G  2.3G  93% /media/sda5
> > root@Knoppix:~# du -h --summarize /media/sda5/
> > 19G     /media/sda5/
> > I cannot fire up windows, because it is dangerous, and  that windows on
> > this machine is broken.
> > Question is : Where is missing 10G on NTFS partition ? Can I safely
> > clean disk without risk of data loss?
> > Thank you
>
> du and df show different things.
> There was a thread, recently, on the subject:
> http://www.gossamer-threads.com/lists/gentoo/user/170503

That's true enough, but I would still be mighty suspicious of those numbers.

He has a 31G filesystem, df says he has used 29G worth of blocks and du says 
the total amount of data in those blocks is 19G. The difference is always 
file allocation slack, but a full third of the filesystem?

It's not impossible of course. I don't know what the block size is on NTFS, 
but with 1k, you'd need 10 million files each 1 byte to consume 10G of slack. 
With 64k blocks it's something like 150,000 files. That's a whole lot of very 
very tiny files - not impossible, but highly unlikely in normal usage[1]

It looks like that disk could bear some investigation, even if only for peace 
of mind.

alan

[1]  I wouldn't be surprised if NTFS had some insane block allocation policy 
where this is quite common... or if MS has built some kind of hidden backup 
region (aka AllYouBaseAreBelongToUsFS) into the filesystem that is invisible 
to du



-- 
alan dot mckinnon at gmail dot com

Re: [gentoo-user] NTFS free space disappeared

[b.n.]

Alan McKinnon ha scritto:

> That's true enough, but I would still be mighty suspicious of those numbers.
> 
> He has a 31G filesystem, df says he has used 29G worth of blocks and du says 
> the total amount of data in those blocks is 19G. The difference is always 
> file allocation slack, but a full third of the filesystem?
> 
> It's not impossible of course. I don't know what the block size is on NTFS, 
> but with 1k, you'd need 10 million files each 1 byte to consume 10G of slack. 
> With 64k blocks it's something like 150,000 files. That's a whole lot of very 
> very tiny files - not impossible, but highly unlikely in normal usage[1]
> 
> It looks like that disk could bear some investigation, even if only for peace 
> of mind.
> 
> alan
> 
> [1]  I wouldn't be surprised if NTFS had some insane block allocation policy 
> where this is quite common... or if MS has built some kind of hidden backup 
> region (aka AllYouBaseAreBelongToUsFS) into the filesystem that is invisible 
> to du

He said the Windows partition is infected. Could have some virus 
corrupted the filesystem?

m.

[gentoo-user] Re: NTFS free space disappeared

[Nikos Chantziaras]

ert256 wrote:
> Hello
> I have some weird problem width NTFS partition in linux environment.
> I have Knoppix LiveCD on some machine, which i want to clean out.
> There was some virus and windows is unusable, so I'm copying data over
> network to other machine, but what is the point
> /media/sda5 is ntfs mounted in rea-only mode
> root@Knoppix:/media# df -h
> Filesystem            Size  Used Avail Use% Mounted on
> /dev/sda5              31G   29G  2.3G  93% /media/sda5
> root@Knoppix:~# du -h --summarize /media/sda5/
> 19G     /media/sda5/
> I cannot fire up windows, because it is dangerous, and  that windows on
> this machine is broken.
> Question is : Where is missing 10G on NTFS partition ? Can I safely
> clean disk without risk of data loss?
> Thank you

Run a 'chkdsk /F /V' on the disk.  Repeatedly until you get no more 
errors.  Pull the data you want to keep to another HD and then do the 
only thing that is able to reliably fix a Windows installation: Fresh 
install with a reformat of the partition.

Re: [gentoo-user] NTFS free space disappeared

[ert256]

[-- Attachment #1: Type: text/plain, Size: 1757 bytes --]

Hello
Thank You for all your help.
There was knoppix launched, so i need to run M$ installation disk to
check disk.
There was couple of 'Unexpected reboots', so Filesystem may be a bit
corrupt.
I need to go to office, and do it over there, everything else i did
remotely.
I'll lunch Windows XP Installation disk, and run  'chkdsk /F /V'.
After everything I'll write back.
Bye

[ 20.09.2008 12:09 ], b.n. :
> Alan McKinnon ha scritto:
> 
>> That's true enough, but I would still be mighty suspicious of those
>> numbers.
>>
>> He has a 31G filesystem, df says he has used 29G worth of blocks and
>> du says the total amount of data in those blocks is 19G. The
>> difference is always file allocation slack, but a full third of the
>> filesystem?
>>
>> It's not impossible of course. I don't know what the block size is on
>> NTFS, but with 1k, you'd need 10 million files each 1 byte to consume
>> 10G of slack. With 64k blocks it's something like 150,000 files.
>> That's a whole lot of very very tiny files - not impossible, but
>> highly unlikely in normal usage[1]
>>
>> It looks like that disk could bear some investigation, even if only
>> for peace of mind.
>>
>> alan
>>
>> [1]  I wouldn't be surprised if NTFS had some insane block allocation
>> policy where this is quite common... or if MS has built some kind of
>> hidden backup region (aka AllYouBaseAreBelongToUsFS) into the
>> filesystem that is invisible to du
> 
> He said the Windows partition is infected. Could have some virus
> corrupted the filesystem?
> 
> m.
> 
> 

-- 
Rafał (ert16) Trójniak
m@il : ert256@gmail.com
Jid : ert256@gmail.com ert16@chrome.pl
GPG  key-ID : DD681D47
749F E1DC A58F 9084 BBC0
797A 0691 53D6 DD68 1D47


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 260 bytes --]

Re: [gentoo-user] NTFS free space disappeared

[Stroller]

On 20 Sep 2008, at 10:17, Alan McKinnon wrote:
> ...
> He has a 31G filesystem, df says he has used 29G worth of blocks and  
> du says
> the total amount of data in those blocks is 19G. The difference is  
> always
> file allocation slack, but a full third of the filesystem?
>
> It's not impossible of course. I don't know what the block size is  
> on NTFS,
> but with 1k, you'd need 10 million files each 1 byte to consume 10G  
> of slack.
> With 64k blocks it's something like 150,000 files. That's a whole  
> lot of very
> very tiny files - not impossible, but highly unlikely in normal  
> usage[1]

My last employer sold tills & stock control software - running on the  
Windows 98 platform - to retail.

One version of their till software involved writing out the value of  
food & drinks orders into little text files - of about 20 or 30 bytes  
- in a shared directory. A "service" on the server would poll the  
shared directories on a periodic basis, look for text files and - if  
present - process them before deletion. On one memorable occasion a  
"user misconfiguration" (a configuration which shouldn't have been  
allowed by the buggy software) cased the text files to be written out  
empty, and they thus went unprocessed.

I can't tell you how long this went on for - I am sure that less than  
100 food orders would typically be taken per day, so it would surely  
have taken forever to fill even the c 6gig drives that were standard  
at the time,  but I have an idea that the software perhaps started  
making repeated attempts to write the data files, resulting in more  
empty files on the disk.

In any case, you can imagine the results. Dialing in using PC Anywhere  
over 56k was slow at the best of times - the GUI was particularly slow  
once the machine ran out of disk space & pagefile, whilst deleting  
these kazillions of zero-length files took several hours.

Stroller. 

Re: [gentoo-user] NTFS free space disappeared

[Stroller]

On 18 Sep 2008, at 21:00, ert256 wrote:
> ...
> /media/sda5 is ntfs mounted in rea-only mode
> root@Knoppix:/media# df -h
> Filesystem            Size  Used Avail Use% Mounted on
> /dev/sda5              31G   29G  2.3G  93% /media/sda5
> root@Knoppix:~# du -h --summarize /media/sda5/
> 19G     /media/sda5/
> I cannot fire up windows, because it is dangerous, and  that windows  
> on
> this machine is broken.
> Question is : Where is missing 10G on NTFS partition ? Can I safely
> clean disk without risk of data loss?


This isn't a Vista-formatted disk, is it by any chance?

NTFS file-systems written (created?) by Vista add some new & special  
features. You shouldn't write to the system disk of a Vista PC from  
Windows XP, for instance, and I suspect that Linux's support has not  
fully caught up yet.

It's not clear from your post whether you want to get this Windows  
installtion back in commission or whether you're just worried that, in  
the process of backing it up, you might overlook some of the data on  
the drive. Best advice is to reinstall the o/s on a new hard-drive,  
copy all the files from this one into a folder called "Old Stuff" and  
hang on to the old drive for a month. During that time the user can  
rake through "Old Stuff" for their emails & photos, and once they're  
happy with the new system you don't have to care what was wrong with  
the old one.

Stroller.

Re: [gentoo-user] NTFS free space disappeared

[Alan McKinnon]

On Saturday 20 September 2008 16:16:41 Stroller wrote:
> I can't tell you how long this went on for - I am sure that less than  
> 100 food orders would typically be taken per day, so it would surely  
> have taken forever to fill even the c 6gig drives that were standard  
> at the time,  but I have an idea that the software perhaps started  
> making repeated attempts to write the data files, resulting in more  
> empty files on the disk.
>
> In any case, you can imagine the results. Dialing in using PC Anywhere  
> over 56k was slow at the best of times - the GUI was particularly slow  
> once the machine ran out of disk space & pagefile, whilst deleting  
> these kazillions of zero-length files took several hours.

Well I *did* say it was not impossible :-) See what I did there - I built a 
catch-all opt-out clause into my post so I could always be at least partially 
right, hehehehe

I shudder to ask, but I will anyway - how many files? Any idea?

-- 
alan dot mckinnon at gmail dot com

Re: [gentoo-user] NTFS free space disappeared

[ert256]

[-- Attachment #1: Type: text/plain, Size: 518 bytes --]

Hello again
[ 20.09.2008 19:13 ], Alan McKinnon :
> [..]
> I shudder to ask, but I will anyway - how many files? Any idea?

I really don't know how many files may be hidden there inside that
filesystem.
It wasn't my box, just taking care of it few weeks.
There are not mine data, so i must be sure before cleaning up partition.

Bye
-- 
Rafał (ert16) Trójniak
m@il : ert256@gmail.com
Jid : ert256@gmail.com ert16@chrome.pl
GPG  key-ID : DD681D47
749F E1DC A58F 9084 BBC0
797A 0691 53D6 DD68 1D47


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 260 bytes --]

Re: [gentoo-user] NTFS free space disappeared

[Norberto Bensa]

On Saturday September 20 2008 11:22:21 Stroller wrote:
> NTFS file-systems written (created?) by Vista add some new & special
> features. 

Do you have more info on that? Any link?

Thanks,
Norberto

Re: [gentoo-user] NTFS free space disappeared

[Stroller]

On 20 Sep 2008, at 18:36, Norberto Bensa wrote:

> On Saturday September 20 2008 11:22:21 Stroller wrote:
>> NTFS file-systems written (created?) by Vista add some new & special
>> features.
>
> Do you have more info on that? Any link?

This Wikipeadia epic is nearly as comprehensive as some of the  
articles on chapters of the Warhammer 40k Space Marines:
http://en.wikipedia.org/wiki/NTFS

It seems I may have been mistaken - after a little search it's not  
clear to me whether its really unsafe to write to a Vista disk from  
XP. I think I'd check before trying to do so from Linux.

Stroller.
  

Re: [gentoo-user] NTFS free space disappeared

[ert256]

[-- Attachment #1: Type: text/plain, Size: 969 bytes --]

[ 21.09.2008 05:51 ], Stroller :
> 
> On 20 Sep 2008, at 18:36, Norberto Bensa wrote:
> 
>> On Saturday September 20 2008 11:22:21 Stroller wrote:
>>> NTFS file-systems written (created?) by Vista add some new & special
>>> features.
>>
>> Do you have more info on that? Any link?
> 
> This Wikipeadia epic is nearly as comprehensive as some of the articles
> on chapters of the Warhammer 40k Space Marines:
> http://en.wikipedia.org/wiki/NTFS
> 
> It seems I may have been mistaken - after a little search it's not clear
> to me whether its really unsafe to write to a Vista disk from XP. I
> think I'd check before trying to do so from Linux.
> 
> Stroller.
On my scenario, system was always running on Windows XP, and i mount
filesystems RO when coping files on Linux.

-- 
Rafał (ert16) Trójniak
m@il : ert256@gmail.com
Jid : ert256@gmail.com ert16@chrome.pl
GPG  key-ID : DD681D47
749F E1DC A58F 9084 BBC0
797A 0691 53D6 DD68 1D47


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 260 bytes --]

Re: [gentoo-user] NTFS free space disappeared

[Norberto Bensa]

----- Message from stroller@stellar.eclipse.co.uk ---------

> On 20 Sep 2008, at 18:36, Norberto Bensa wrote:
>
>> On Saturday September 20 2008 11:22:21 Stroller wrote:
>>> NTFS file-systems written (created?) by Vista add some new & special
>>> features.
>>
>> Do you have more info on that? Any link?
>
> This Wikipeadia epic is ...


Wikipedia.. yeah right. Everything that's on internet is true and if  
it is in wikipedia is absolutely right... :-/

Thanks anyway.

Regards,
Norberto



----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.