ntfs partition on usb disk messed up by gparted needs recovery
 

Hi all!
I was trying to resize and move an ntfs partition on usb external hd with gparted on Ubuntu 8.10 .
The operation finished with an error:
(...)
updating bootsector of ntfs filesystem on /dev/sdb1 00:00:00 ( SUCCESS )
echo 3f000000 | /usr/bin/xxd -r -p | /bin/dd conv=notrunc of=/dev/sdb1 bs=1 seek=28
4+0 records in
4+0 records out
4 bytes (4 B) copied, 0.000135352 s, 29.6 kB/
check filesystem on /dev/sdb1 for errors and (if possible) fix them 00:00:00 ( ERROR )
ntfsresize -P -i -f -v /dev/sdb1
ntfsresize v2.0.0 (libntfs 10:0:0)
ERROR: Device '/dev/sdb1' is mounted read-write. You must 'umount' it first.
.
Now the partition is not mountable and appears to have a corrupted partition table:
root@cribuntu:~# fdisk -l /dev/sdb
Disk /dev/sdb: 251.0 GB, 251000193024 bytes
255 heads, 63 sectors/track, 30515 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Disk identifier: 0x0005f72d

Device Boot Start End Blocks Id System
/dev/sdb1 1 1057 8490321 7 HPFS/NTFS
root@cribuntu:~# fdisk -l /dev/sdb1

Disk /dev/sdb1: 8694 MB, 8694088704 bytes
255 heads, 63 sectors/track, 1056 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Disk identifier: 0x00000000

Disk /dev/sdb1 doesn't contain a valid partition table
.
How to recover this situation ???
I can recover files with scrounge-ntfs but I would like to recover the partition.

Try using testdisk.

almost solved
 

Testdisk could not repair anything.
The utility scrounge-ntfs could not recover most of the files
(almost all with length 0).
At the end, I tried this:

# made another ntfs filesystem on the same partition:
mkfs.ntfs -f -n -p 63 -c 4096 /dev/sdb1
# resized partition to the original value (dimension from gparted log)
(used gparted interface -> resize)
#resized filesystem to match the original dimension:
ntfsresize -P --force --force /dev/sdb1 -s 199232699903

Now using scrounge I CAN recover most of files (or all...the recovering
is still not finished).
Not a perfect solution since all files are copied to a single directory
without order but I can recover my files.
This is the best I could do....damn gparted!!!!

Maybe next time

I like to use a Parted Magic live-cd which has a copy of GParted on it and the ROX terminal program where I can use the command fdisk or cfdisk to manage partitions measured in cylinders.

I discovered that ALL files contains messed up bytes!
Only Mp3 seems to be readable and play good ; all other files (iso, zip, ppt and so on) have the wrong sequence of bytes....sigh!
It appears that scrounge restored files with the correct size and name but the wrong sequence of bytes. Perhaps this was the original error of
gparted that tried to move the partition at the beginning of the disk.
I finished with a bunch of stupid mp3 and lost all my data...
If some guru can give an idea to recover files, please post a note now because tomorrow I will reformat the disk in ext3!!!.
Thanks.

For next time...

For Xp, you can move the upper limit of the Windows partition with a linux partitioning tool after you have defragmented Windows.

For Vista, you should use Vistas own partitioning tool to move the upper limit of the Windows partition. Vista does not have a defragmentation utility.

In both instances use a linux partitioning tool thereafter to format for linux.

It is possible with any partitioner to shift a partitions limits down so much that the result removes a portion of the partition containing data that was there. That is the reason for defragmentation, which in Windows groups the files at the beginning of the partition.

I like to check, if I practically can, what I have for partitions and where they by using a partitioning tool that gives me the information in cylinders before I do anything.

I do not like or trust partitioners and their automatic actions when they want to clear and partition a given number of GBs as part of doing a linux installation when there is another installation on the HDD that has to survive the process.

total newbie needs help recovering data
 

Hi All,

I was using windows xp when i got hit by a trojan and erased system files. as a result, my computer crashed completely. A friend suggested that I load linux on my hard drive and then I would be able to recover my files on the hdd. upon installing ubuntu 8.10 over the hdd, i found to my dismay that I had lost all my files and folders.

Is there any way to retrieve those files that were previously on the windows partition? note that the whole hdd is linux ...

hoping that there are some gurus who can give a dummy advice.

faiselm;

I closed your other thread before I saw this. I will re-open the other thread.

I suggest you edit out the content of this post---it really does not fit in this thread.

just fyi.. Vista Defrag how-to

although lately I've become a fan of this free Defrag utility from auslogics