LinuxQuestions.org
Go Job Hunting at the LQ Job Marketplace
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices

Reply
 
Search this Thread
Old 09-07-2009, 12:55 PM   #1
anoop40
LQ Newbie
 
Registered: Sep 2009
Location: India , Kerala, Kottayam
Distribution: Red Hat Enterprise Linux
Posts: 3

Rep: Reputation: 0
I cant mount NTFS file system... please help..


I am trying to mount my NTFS drives in Linux using NTFS-3g. But an error message is displayed when mounting starts.""[FATAL: Module fuse not found.
NTFS signature is missing.
Failed to mount '/dev/sda1': Invalid argument
The device '/dev/sda1' doesn't seem to have a valid NTFS.
Maybe the wrong device is used? Or the whole disk instead of a
partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?]"" anybody help me....
 
Old 09-07-2009, 01:07 PM   #2
Wim Sturkenboom
Senior Member
 
Registered: Jan 2005
Location: Roodepoort, South Africa
Distribution: Slackware 10.1/10.2/12, Ubuntu 12.04, Crunchbang Statler
Posts: 3,786

Rep: Reputation: 282Reputation: 282Reputation: 282
Please provide exact command used. Also useful to know is the distro that you're using.
 
Old 09-07-2009, 01:11 PM   #3
colucix
Moderator
 
Registered: Sep 2003
Location: Bologna
Distribution: CentOS 6.5 OpenSuSE 12.3
Posts: 10,458

Rep: Reputation: 1941Reputation: 1941Reputation: 1941Reputation: 1941Reputation: 1941Reputation: 1941Reputation: 1941Reputation: 1941Reputation: 1941Reputation: 1941Reputation: 1941
We need some additional information to solve this issue. First tell us which linux distribution are you running on (you can also add this information in your LQ profile, so that it will be displayed in the left panel of every post). Then can you post the output of the following command (as root):
Code:
fdisk -l
this is to see your current partition set-up. Moreover, is the NTFS drive an external disk or a partition of your current hard drive? In the first case, be sure to issue fdisk -l when the drive is connected.

The problem is that you miss the fuse module loaded into your running kernel - as the error message clearly states. However, without knowing which distro are you running it's quite difficult to give further help.
 
Old 12-10-2009, 06:27 AM   #4
mikepeters76
Member
 
Registered: Apr 2009
Location: Sydney, Australia
Distribution: Ubuntus, Fedora, openSUSE, and Vector Lite 6.0
Posts: 46

Rep: Reputation: 16
Hi guys, running 9.10 Ubuntu, I am mounting a dd image of an entire HDD
Code:
sudo fdisk -l tbg1.img
[sudo] password for mrp: 
You must set cylinders.
You can do this from the extra functions menu.

Disk tbg1.img: 0 MB, 0 bytes
255 heads, 63 sectors/track, 0 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Disk identifier: 0x73c373c3

   Device Boot      Start         End      Blocks   Id  System
tbg1.img1   *           1       14588   117178078+   7  HPFS/NTFS
Partition 1 has different physical/logical endings:
     phys=(1023, 254, 63) logical=(14587, 254, 63)
This is what I have already tried:
Code:
sudo mount ./tbg1.img /media/test/
mount: /media/usb/My Documents/2009/Work/vm/tbg1.img is not a block device (maybe try `-o loop'?)

sudo mount -o loop ./tbg1.img /media/test
mount: you must specify the filesystem type


sudo mount -o loop -t ntfs ./tbg1.img /media/test
NTFS signature is missing.
Failed to mount '/dev/loop0': Invalid argument
The device '/dev/loop0' doesn't seem to have a valid NTFS.
Maybe the wrong device is used? Or the whole disk instead of a
partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?
 
Old 12-10-2009, 06:29 AM   #5
linuxlover.chaitanya
Senior Member
 
Registered: Apr 2008
Location: Nagpur, India
Distribution: Cent OS 5/6, Ubuntu Server 10.04
Posts: 4,627

Rep: Reputation: Disabled
If it is an image that you are mounting then you should consider dropping -t ntfs option from the command. You are not mounting any file system. You should use this option when you are mounting a partition that has been formatted as NTFS.
 
Old 12-10-2009, 06:41 AM   #6
mikepeters76
Member
 
Registered: Apr 2009
Location: Sydney, Australia
Distribution: Ubuntus, Fedora, openSUSE, and Vector Lite 6.0
Posts: 46

Rep: Reputation: 16
am... yes I did that, and:
Code:
sudo mount -o loop ./tbg1.img /media/test
mount: you must specify the filesystem type
so you can see I tried that already. Is there another option I can use with mount?

The disk is a win 2000K disk which was bootable and I ddied to the image file. This is shown when I do the fdisk -l command.
 
Old 12-10-2009, 07:32 AM   #7
Web31337
Member
 
Registered: Sep 2009
Location: Russia
Distribution: Gentoo, LFS
Posts: 399
Blog Entries: 71

Rep: Reputation: 65
ntfs-3g is a good solution for NTFS. i mean i used that one long time ago without problems, only problem is a CPU load when reading/writing on that drives(i run rtorrent which seeds at 10mbit/s, so CPU usage at time i used ntfs was around 10% by ntfs-3g driver). but i don't think something may fix that(re-writing perhaps or removing ntfs )
to mount NTFS partition after installation, run mount with option -t ntfs-3g it shall work.
ubuntu users can use apt-get install ntfs-3g ntfsprogs and do the same.
vol_id util is a useful thing too to get information about partition, ex:
Code:
root@srvr:~# vol_id /dev/sdb1
ID_FS_USAGE=filesystem
ID_FS_TYPE=reiserfs
ID_FS_VERSION=3.6
ID_FS_UUID=45e3b3b8-938f-4ccf-966a-c70ef70b808b
ID_FS_UUID_ENC=45e3b3b8-938f-4ccf-966a-c70ef70b808b
ID_FS_LABEL=300G
ID_FS_LABEL_ENC=300G
ID_FS_LABEL_SAFE=300G
hope it helps.

Last edited by Web31337; 12-10-2009 at 07:35 AM.
 
Old 12-10-2009, 07:42 AM   #8
mikepeters76
Member
 
Registered: Apr 2009
Location: Sydney, Australia
Distribution: Ubuntus, Fedora, openSUSE, and Vector Lite 6.0
Posts: 46

Rep: Reputation: 16
thanks but no.

I have tried ntfs-3g, and one more try:
Code:
 rp@mrp-desktop:/media/usb/My Documents/2009/Work/vm$ sudo mount -o loop -t ntfs-3g ./tbg1.img /media/test
NTFS signature is missing.
Failed to mount '/dev/loop0': Invalid argument
The device '/dev/loop0' doesn't seem to have a valid NTFS.
Maybe the wrong device is used? Or the whole disk instead of a
partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?
mrp@mrp-desktop:/media/usb/My Documents/2009/Work/vm$ sudo mount  -t ntfs-3g ./tbg1.img /media/test
NTFS signature is missing.
Failed to mount '/media/usb/My Documents/2009/Work/vm/tbg1.img': Invalid argument
The device '/media/usb/My Documents/2009/Work/vm/tbg1.img' doesn't seem to have a valid NTFS.
Maybe the wrong device is used? Or the whole disk instead of a
partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?
mrp@mrp-desktop:/media/usb/My Documents/2009/Work/vm$ sudo mount -t ntfs-3g ./tbg1.img /media/test
NTFS signature is missing.
Failed to mount '/media/usb/My Documents/2009/Work/vm/tbg1.img': Invalid argument
The device '/media/usb/My Documents/2009/Work/vm/tbg1.img' doesn't seem to have a valid NTFS.
Maybe the wrong device is used? Or the whole disk instead of a
partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?
and as suggested I installed ntfsprogs and ran ntfs3g.probe and got the same NTFS signature is missing.

I just want to analyse the image it is for forensic purposes so CPU cycles are not an issue, just image integrity but I am working on a copy anyhow.
 
Old 12-10-2009, 07:51 AM   #9
Web31337
Member
 
Registered: Sep 2009
Location: Russia
Distribution: Gentoo, LFS
Posts: 399
Blog Entries: 71

Rep: Reputation: 65
i believe .img is your previous NTFS partition image. it should first be placed onto HDD then mounted as partition... written or mounted. not really sure how to do it, didn't work with dd-created disk images(only backuped/restored USB that way once). correct me if i'm wrong.
 
Old 12-10-2009, 08:13 AM   #10
mikepeters76
Member
 
Registered: Apr 2009
Location: Sydney, Australia
Distribution: Ubuntus, Fedora, openSUSE, and Vector Lite 6.0
Posts: 46

Rep: Reputation: 16
web you silly russian... LOL sorry, it is late. No it is not a previous partition image. It is a hdd image yes. I could have called it anything, it is just a bit by bit copy of the entire HDD into a file. What you say makes sense, I could copy it back to a drive using dd, but I don't want to do that, I just want to mount the image file and do some analysis on it, in particular grokevt and reglookup.

Does anybody know how if I can copy the image onto a bigger drive? ie the image is 110GB and the smallest drive I have is 500GB?

Any further ideas on mounting the .img file as a drive? And why am I getting the NTFS signature missing when I try to mount even though it is identified as NTFS by fdisk. Is it something to do with:
Quote:
Partition 1 has different physical/logical endings:
phys=(1023, 254, 63) logical=(14587, 254, 63)
Do I have to do some offseting to mount it and if so why?
 
Old 12-10-2009, 12:59 PM   #11
fpmurphy
Member
 
Registered: Jan 2009
Location: /dev/ph
Distribution: Fedora, Ubuntu, Redhat, Centos
Posts: 285

Rep: Reputation: 61
First you have to carve your disk image into partition images i.e. extract the partitons from the image. If you know your partition start and ending sections you can use dd to do it. For example if the partition you are interested in starts at block 163 and ends at block 264, the following will carve out that partition
Code:
dd if=disk.img bs=512 skip=163 count=101 of=partition.img
If you do not know the details of your partitions, you can figure it out by examining the MBR using a hex editor or a tool like xxd. Assuming no extended partitions, the first partition is at offet 0x1BE, the second partition is at offset 0x1CE and so on. Each partition entry is 16 bytes long. End of MBR marker is 0x55AA. In each partition entry, offset 8 of length 4 gives you the starting section and offset 12 of length 4 gives you the number of sectors in the partition. If this is too much to handle, do a web search for a free forensics tool called mmls which will list the partition information from a disk image.
 
Old 12-10-2009, 07:21 PM   #12
mikepeters76
Member
 
Registered: Apr 2009
Location: Sydney, Australia
Distribution: Ubuntus, Fedora, openSUSE, and Vector Lite 6.0
Posts: 46

Rep: Reputation: 16
thx. I did
Code:
dd if=./tbg1.img |hexdump -C|less
but found the hex output too much too handle (as you said), how far down is 0x1BE, is that equivalent to 00001BE0??? In any case I had the sleuthkit installed so based on
Code:
rp@mrp-desktop:/media/try$ sudo mmls ./TBG1/tbg1.img
 91 DOS Partition Table
 92 Offset Sector: 0
 93 Units are in 512-byte sectors
 94 
 95      Slot    Start        End          Length       Description
 96 00:  -----   0000000000   0000000000   0000000001   Primary Table (#0)
 97 01:  -----   0000000001   0000000062   0000000062   Unallocated
 98 02:  00:00   0000000063   0234356219   0234356157   NTFS (0x07)
 99 03:  -----   0234356220   0234374999   0000018780   Unallocated
I did:
Code:
sudo dd if=./TBG1/tbg1.img bs=512 skip=63 count=0234356157 of=/media/usb/tbg1_partition.img
I am doing a watch on the directory it is up to 2GB should be 110GB so will post results when finished.

Would love some help understanding the dd | hexdump of the raw image.
 
Old 12-10-2009, 07:34 PM   #13
jschiwal
Guru
 
Registered: Aug 2001
Location: Fargo, ND
Distribution: SuSE AMD64
Posts: 15,733

Rep: Reputation: 654Reputation: 654Reputation: 654Reputation: 654Reputation: 654Reputation: 654
If you run "file <image_file>" it may list start and end of the partitions on the disk. You can also run "fdisk -lu <image_file>" to list the partitions. The -u option uses 512 byte blocks which will prevent rounding errors.

You will probably find that the first partition is on block 63. Knowing the offset, you can use the "losetup" command to create a loop device for a partition inside the image file.

sudo /sbin/losetup -fs <image_file> -o $((512*<starting_block>))

eg.
sudo /sbin/losetup -fs <image_file> -o $((512*63))

The loop device created will be printed, eg:
loop0
Now you can use the "file" command again to verify the last step worked and determine the filesystem:
sudo file -s /dev/loop0

Next you can mount it:
sudo mount -t ntfs /dev/loop0 /mnt

There is no need to cut out the partition, unless your purpose is to restore a partition from a disk image. You can simply copy files after mounting it. You can even make changes now, deleting or adding files.

Last edited by jschiwal; 12-10-2009 at 08:03 PM.
 
1 members found this post helpful.
Old 12-10-2009, 08:37 PM   #14
mikepeters76
Member
 
Registered: Apr 2009
Location: Sydney, Australia
Distribution: Ubuntus, Fedora, openSUSE, and Vector Lite 6.0
Posts: 46

Rep: Reputation: 16
guess that is why you are a moderator. Exactly what I was looking for and it worked perfectly. I have stopped the "extraction" since the image is 110GB it would have taken for ever and I need to get this report out this afternoon.

All it took in the end was the creation of the loop device with the losetup command.

Thanks!
 
Old 12-11-2009, 03:24 AM   #15
kingston
Member
 
Registered: Mar 2008
Location: Bengaluru, India
Distribution: RHEL 5.5, Solaris 5.10
Posts: 193
Blog Entries: 1

Rep: Reputation: 21
hey....install the following 4 rpms...
dkms-2.0.20.4-1*
dkms-fuse.2.7.4-1*
fuse-2.7.4-1*
fuse-ntfs-3g-2009.4.4-1* rpms

it will be solved
 
  


Reply

Tags
ntfs


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
how can i mount NTFS file system in RHEL5 prasadkumar.p Linux - Newbie 3 05-10-2008 01:35 AM
How to read .chm file in fedora, can't mount ntfs file system ishti_du Linux - Newbie 12 03-06-2007 03:27 AM
Mount ntfs file system tobiasw Linux - General 10 10-22-2006 07:20 PM
How do I Mount a Windows NTFS file system explorer Linux - Networking 15 05-06-2004 08:01 PM
mount the ntfs file system jdevanand Linux - General 3 01-22-2002 01:25 PM


All times are GMT -5. The time now is 12:38 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration