NTFS Data Recovery: "Only" a wiped MBR + Partition Table

[nomind]

Hello folks,

Recently I tried to install 2006.0 Live x86 using the text-mode installer, and it severely corrupted my partition table. I previously had the following setup:

Code: Select all

/dev/sda1 = Windows XP Home [NTFS, Primary, 21.5GB]
/dev/sda4 = Linux (Primary)  [17GB]
/dev/sda5 = NTFS Data partition   [36GB, logical]
/dev/sda6 = Linux Swap       [1.3GB]

The new setup is three partitions (sda1 = Windows XP, sda2 = NTFS data, sda3 = Linux swap) and a whole bunch of apparently unallocated disk space
So I ran gpart and wrote a new partition table with the help of it. I backed up my messed partition table before running gpart, so I can easily restore that as well (not that it would be of much use anyway). After that I used the Windows recovery console and ran fixmbr, which managed to get me into WinXP until an "Unmountable_Boot_Volume" error. So I rebooted again and ran chkdsk, which said that there were "one or more unrecoverable errors" on both my NTFS partitions. I really hope chkdsk is wrong in this case. After that I ran fixboot, and the problem still exists.

Here's my question: is it possible to recover data from the NTFS data partition? I really don't care about anything else besides that. Windows and Linux can be reinstalled, but my data cannot be obtained all over again as easily Would you say it's safe to try mounting the NTFS data partition?

Thanks

[unclecharlie]

nomind,
I'd use one of the bootable rescue cd's out there. The system rescue cd at http://www.sysresccd.org works well. You can either mount the ntfs volume read-only and copy the data, or create a partition image and install that image on an empty ntfs partition. (This is usually how I set up dual boot on my laptops without having to reinstall XP...)

hope this helps,
Charlie

[nomind]

Thanks for the reply Charlie. Unfortunately I'm only able to write this through the LiveCD, as all my OSes are borked. Hence, downloading and burning an iso is impossible (only have one computer, one HD). Furthermore, after running fixboot from the Windows recovery console, my Windows boot partition got labeled as a FAT one, only 10MB large. This is simply ridiculous, since "fdisk -l" still shows the actual size and type (21.5GB, NTFS). However even gpart is fooled by the FAT labeling, and no longer recognises the original NTFS partition. I guess that partition is gone for good. My data partition is still intact (I think/hope) after all this nonsense, and I haven't done _anything_ to it since the fixboot damage. The attempted fixboot recovery might have spared the NTFS data partition since it's not even bootable.
I have a couple of questions regarding your suggestions. Firstly, is it safe to mount the NTFS data partition at all, even if it's merely an read-only mount? I haven't even tried a "mount -f" simulation for fear of corrupting the contents. Secondly, I'm wondering if it's such a good idea to create a new ntfs partition after all this. Like I mentioned earlier, I only have one HD. Would it be safe to attempt a clean Windows reinstall on the confused FAT/NTFS 21.5GB primary and hope for the best?

Thanks again.

[mtylerb]

I'm currently running a similar setup. My setup looks like:

/dev/sda1 - NTFS Windows XP Pro 80 GB's
/dev/sda2 - Linux Boot 32 MB's
/dev/sda3 - Linux Swap 512 MB's
/dev/sda4 - Linux Root 10 GB's

When I rebooted after wiping the Linux half of my hard drive to do a fresh install, I was getting invalid partition table error. I ran all the utilities in the Automated Recovery Service on the Win XP disc to no avail. Finally I realized the reason it was giving that error was because Windows didn't like the fact that there was more than 1 bootable partition. So, I booted up the LiveCD and ran fdisk /dev/sda then turned off the bootable flag on /dev/sda2. Not sure if this helps you any, this is just my experience with Win XP/Linux.

Tyler

[unclecharlie]

nomind,
Yes It's safe to mount your NTFS data partition read-only. You are also safe to create a new NTFS partition. Pretty much all of my computers (4 right now) are dual-boot with an NTFS 'C:' drive for windows. I usually keep a fat32 'D:' drive to share data between OS's.
One other thing- don't just reinstall the OS onto the messed up partition! Remove the partition with fdisk/cfdisk, reboot and create a new partition to install windows to. As for the data drive, leave it as it is. Don't alter it in cfdisk or in the windows setup or you risk losing data.

hope this helps,
Charlie

[nomind]

nomind,
Yes It's safe to mount your NTFS data partition read-only. You are also safe to create a new NTFS partition. Pretty much all of my computers (4 right now) are dual-boot with an NTFS 'C:' drive for windows. I usually keep a fat32 'D:' drive to share data between OS's.
One other thing- don't just reinstall the OS onto the messed up partition! Remove the partition with fdisk/cfdisk, reboot and create a new partition to install windows to. As for the data drive, leave it as it is. Don't alter it in cfdisk or in the windows setup or you risk losing data.

hope this helps,
Charlie

You sir, are my saviour! I literally jumped with joy to see that all my data is accessible with a read-only mount. I'll probably buy a second HD this weekend to backup the files, or maybe use my older 4GB hard-drive as a master (with the current 80GB SATA as a slave) and use one of the windows-only NTFS recovery tools like Partition Table Doctor to salvage what I can from the FAT/NTFS messed boot drive (it had my CV and some other reports on it, but nothing worth throwing chairs over!). If that doesn't work, I'll remove the partition with cfdisk and attempt a clean reinstall. I will post back if I run into any trouble along the way.

Thanks a million bud!

[nomind]

Alright Charlie, for various reasons I'm unable to get a second drive to ghost the image of the borked one onto. I now want to install Ubuntu again, on the free space after the NTFS data and the Linux swap partitions, so I can at least have a permanent environment to work with. Ubuntu's installation reads the confused FAT/NTFS partition as a 21.5GB FAT32 (at least it got the size right). Moreover, when prompted for disk info, it gives the correct start and end sectors of free space. Would you say it's safe to go ahead with the install then? I've tried running TestDisk through the Gentoo liveCD (that's now my only hope), but that fails to get the correct HD size - it reads 840MB!

I'll go ahead with the install only if you say it's safe.

Thanks

[unclecharlie]

nomind,
If you can mount the data drive read-only and see your files, then that partition is o.k.

As far as the messed up NTFS/FAT "C:" partiton, the damage is done...

Now, from the original post- Your original 'data' partition was a logical drive (/dev/sda5), Your new 'data' partition is a primary one (/dev/sda2). Did you move the data over to the "new" data drive? Or are you trying to recover the information from /dev/sda5?

This is very important! Is your data on /dev/sda2 or on the (wiped)/dev/sda5?

If your actual data is on /dev/sda2, then you're o.k. If your data is on /dev/sda5 then things are bad as /dev/sda5 no longer exists...

If you moved the actual DATA over after your gpart adventure then Boot to a live CD and try to mount /dev/sda2 read-only to look for the files on your data drive. If you are trying to recover your data from the (wiped) then you may have to restore the old MBR and PRAY that the data drive is on your 'free space' and has not been overwritten...

It might help to know the sizes of the partitions you created. Other Important info would be whether the new partitions have been formatted, etc.

Again, before you do anything else- If you mount your 'data' drive, CAN YOU SEE YOUR FILES?

Charlie

[nomind]

Yes, I can definitely mount my data partition (now /dev/sda2, previously /dev/sda5) as read-only through the liveCD and copy files from it onto ramdisk. Furthermore, ntfsreader shows the data just fine and gives me the option to copy it onto any existing FAT logical drive - of course I don't have any right now, nor do I plan on making one just yet, since I need a working installed environment to backup my files onto CDs. The physical location of my data partition is still the same, only the enumeration has changed because of a severely corrupted MBR + partition table.

You're right about the data partition being labeled as a primary now, even though it was originallly on an extended partition (gpart is just miserable with extended partitions, so I'm not surprised it got that wrong). I don't think this should have any effect on the integrity of data though - the MFT for it seems intact. Even the Linux swap space is being labeled as primary; I could've sworn I had initially placed it on another extended partition.

The reason for the Ubuntu install is once again to have a working environment so I can copy files from the data partition and burn them onto ~20 CDs before I reinstall Windows . The installer detects the free-space after the NTFS data partition just fine (it reads every partition as primary, of course) and the sector limits seem alright to me. It even correctly detects the size of the messed FAT/NTFS partition at the beginning of the disk, so I doubt it will potentially overwrite stuff on /dev/sda2.

Here are the current sizes of all partitions on my disk. I have not made any changes to this layout:

Code: Select all

/dev/sda1 = 21.5GB NTFS (real size) ; 10MB FAT12 shown by Windows installation environment and actual Linux mount command.
/dev/sda2 = 36GB NTFS (data partition. readable with "mount -r" and readntfs.exe)
/dev/sda3 = 1.4GB Linux swap (labeled as primary for aforementioned reason)
Free space after sda3 - 17.5GB worth, until end of disk

Thanks for the help!

[unclecharlie]

nomind,

If the physical location of the data drive is the same but it reads as primary and not extended/logical, then you need to be very careful and back up all of your data before you continue. Reason being that your free space is likely not at the end of the drive but in the middle. Depending on how much data you've got on your NTFS partition you may be able to 'bootstrap' a backup without burning everything onto CD. I'll describe this below. But I do have one more question for you-

If you run cfdisk /dev/sda does it show your 'C:' drive as NTFS or FAT?
Don't change anything or write the MBR yet, just run it and then quit.

If it shows the drive as FAT then you may be able to change the drive type to 07 in cfdisk and recover your 'C:' drive. But I wouldn't do that until you've got a good backup of the 'data' drive, just in case.

As far as backing things up. You can do this->
Create a partition to Save your stuff to-
1. Boot to a livecd and run cfdisk. Create a linux partition on the free space. (make it primary not extended...) write the partition table. Do not alter any existing partitions, just create a new one.
2. Format this partition with the filesystem of your choice (Ext3, reiserfs)
3. mount this partition
4. use the partimage program to back up your data drive to an image file. Make sure this image file is stored wherever your new linux drive is mounted. (This will only work if the new linux partition is large enough to store all the data from the NTFS drive. If the new partition is 17+ gigs but you've 25 gigs of data then you may be SOL.) Also make sure the data drive you are backing up IS NOT mounted. If you just run partimage with no command line options, you get a fairly straightforward ncurses style gui which you can use to back up. You'll also want to ls -l the contents of your new linux partition after to verify that the image(s) were created and are roughly the right size. (i.e.- If you've 10 gigs of Data on the 'D:' drive and you're using gzip compression for your image then you should have 5-8 gigs worth of image. If you've 10 gigs of data but only 20 megs worth of image file- then worry.)

Once you've got a backup of your data, then you can fiddle with the partition table a bit. Be very careful not to alter the partition your backup is on.
So let's assume you've got a good backup image. Now what?
You can-
1. Use cfdisk to change the partition type of /dev/sda1 to 07(hpfs/ntfs) and try to boot windows...(this may actually work. Stranger things have happened.)
2. If that doesn't work then use cfdisk to REMOVE /dev/sda1 before reinstalling windows. Otherwise you may end up with a 10 gig FAT 12 'c:' drive and 11 gig's of unusable space after it. (unusable because you MBR is messed up and you can only have 4 primary partitions anyway...) Once you have removed the /dev/sda1 partition, you can reboot to the windows install CD, create a new (21 gig) NTFS partition where the old /dev/sda1 was and install windows onto that. Once you do that, You should be able to boot to windows and see your data drive as 'D:' Verify that your data is there. If your data is intact then copy it ALL to a directory on the 'C:' drive. (don't worry if that fills most of the drive up. It's not going to stay there. We're just trying to unf**k the MBR/partition table right now.)
If all the data fits onto C: then you can use cfdisk to get rid of the data partition, the swap partition and the linux(backup) partition. At this point you will have JUST the /dev/sda1 partition with a working copy of windows AND all of your data. Reboot before proceeding further.

If that worked then you should now be able to install ubuntu/gentoo/whatever on the free space.

If after installing windows you do not have a 'd:' drive or your data is not visible there, you have the images on the linux drive to work off of. You can use partimage to restore the data... (post back I'll show you.)

Why do all this? Because if you know your MBR got messed up then you're better off starting over. Creating a new /dev/sda1 fixes that part. Moving all the data over to /dev/sda1 after your windows install allows you to remove the remaining partitions and create new ones without losing any data. At the end of it all you should still have all the files from your old data drive, but you're basically working off of a fresh partition table...

If you decide to try ANY of this, make sure you understand what you are doing. If you have any questions about how to proceed, ask them now before you start. Mistakes made will likely be impossible to undo...

hope this helps,
Charlie

p.s.- definitely post back what cfdisk shows for /dev/sda1, If the partition type has been changed to FAT12, then changing it back to NTFS could recover your 'c:' drive without having to do all these backflips...

[nomind]

Wow you're taking this just as seriously as I am. You seriously need to be commended with an avatar-badge for providing this level of help!

The output of "fdisk -l" shows the confused C: partition as an HPFS/NTFS. Cfdisk shows NTFS. Both show the correct size. Funnily enough, the readntfs utility shows all my partitions as logical - I mean sda2 really is logical, but Linux swap and the confused one? It's probably a natural limitation of the program though.

Code: Select all

                                  cfdisk 2.12r

                              Disk Drive: /dev/sda
                        Size: 80026361856 bytes, 80.0 GB
              Heads: 255   Sectors per Track: 63   Cylinders: 9729

    Name        Flags      Part Type  FS Type          [Label]        Size (MB)
 ------------------------------------------------------------------------------
    sda1        Boot        Primary   NTFS           [NO NAME    ]     23063.69*                            
                              Pri/Log   Free Space                           0.04*    
    sda2                    Primary   NTFS             [^D]            37992.54*                   
                              Pri/Log   Free Space                           0.04*    
    sda3                    Primary   Linux swap / Solaris              1439.40* 
                              Pri/Log   Free Space                       17528.08

I'm wondering if it would be wise to unset the bootable flag for the confused C: drive. Since the main problem with that thing is a corrupt boot-sector, even readntfs gets confused and asks if it should take the partition table's word (NTFS) or the boot-sector's (FAT), but still refuses to read when I specify the former. I really don't care about its bootability at this point, but it would be nice to salvage some pics and ebooks from it if possible (don't need a CD for that - will fit in my USB key).

I'll also try to get a hold of a second cd-rw drive over the weekend to see if I can start burning discs directly from the livecd environment. Your method of backing up the data is interesting, but I have the data partition at least 90% full - don't know if compressing the image file will make it fit within 17.5GB. But with regards to steps 1 & 2, once I create a Linux partition over the free space with cfdisk, would it then be safe to go ahead with the Ubuntu install, since the installer itself wouldn't have to bother creating or manipulating anything - just a simple file copy?


EDIT: btw, my problem is incredibly similar to the one here. Of course, that guy managed to get it working again with Partition Table Doctor, a liberty I don't have.

[unclecharlie]

nomind,
Will /dev/sda1 mount in linux read-only? i.e. -If you boot a livecd, does this work?-

Code: Select all

mount -t ntfs /dev/sda1 /mnt/gentoo

If linux sees it as ntfs, you may be able to mount it within linux. If that works, you can copy the files you need, then wipe the /dev/sda1 partition. If that doesn't work, all you can really try is to restore the entire MBR.

Since your data drive is mostly full, Your backup options for the data drive are also somewhat limited. partimage does allow for gzip or bzip compression. bzip would get you close, but it takes a long time. If you've got a CD burner on that box, then you might end up creating the linux partition as I described previously, installing ubuntu and using that install to burn CDs. (partimage allows you also to back up to image files of any size. So you can split up the backup image to ~600 meg images and burn them onto CDs.) Since your data is there and accessible though, you may just want to see if you can mount /dev/sda1 to get what you need first.

I'd go ahead and create your linux partition on the free space and install ubuntu. That'll at least give you an environment to back up from.
The other option is if you've got an old hard drive around(even if it's old and small), you can install it as the primary hd and make the messed up drive the secondary one. This would allow you to have an environment to work from without risking data loss on the damaged drive...

Hope this helps,
Charlie

[nomind]

/dev/sda1 will not mount correctly, even if I pass the "-r -t ntfs" options to mount. The command simply pukes back the classic "I/O error, bad superblock or incorrect type" message. It reads 10MB when mounted as FAT, which is no good. I guess professional recovery software is the only way to extract anything reasonable from that thing (intriguingly, I could read portions of the documents on the partition while browsing the sectors with a hex-editor).

I do have an old 4GB IDE drive from my old machine lying around, but I doubt it's even usable after years of both Windows 95 and physical abuse. I'll give it a shot nonetheless. If that doesn't work, I'll attempt the Ubuntu install and see if it helps. A week of worrying has left me in a Zen-like state; at this point I don't give a damn anymore. If I get the data, good. If I don't, too bad.

Thanks for all your help throughout this ordeal, Charlie. You r0xx0rz!

[unclecharlie]

nomind,

If you can get the data drive backed up to CD, then you should be able to restore the old MBR without data loss and start windows fine. (Restoring the old MBR might not even mess up the data drive. But then again it might. Technically you haven't changed any data on the NTFS drives since you made that backup. So it **should** work. I'd just be really nervous about it without having my data backed up...

hope this helps,
Charlie

[nomind]

Booyakasha! I managed to successfully install Ubuntu, and am backing up my data right now. Once that's done, I'll format the Ubuntu partition as NTFS with QTparted and try to run Partition Table Doctor from that install.

Thanks again!