recover files from bad NTFS drive
 

I'm trying to recover documents from a bad WinXP (NTFS) drive. No Windows solutions work (can't even browse it). It was automatically mounted and accessible with OphCrack Live CD (1.1.3), so I popped in a USB flash drive (FAT) and it appeared to have automatically mounted as /mnt/sda1_removable and proceeded to copy the files over to the USB drive, but when I popped the USB drive in my WinXP box nothing copied, none of the files were there.

I then tried the Ubuntu 6.10 Desktop/Live disc and that automatically mounts the USB drive but not the bad NTFS hard drive. So I mounted the NTFS drive with <sudo mkdir /media/hda1> then <mount -t ntfs /dev/hda1 /media/hda1> (gave no errors), but when I browse to /media/hda1 I get a 'you don't have permission' error message.

Linux surprisingly accesses this bad drive and I just wanna snatch some docs off there. Any ideas?

TIA

Did you unmount the drive before popping it out?
You may have stranded the files or an update to the directories in cache.

nope it wasn't that, i actually figured it all out. I figured out how to get 'r done with either distro. in case there's others with this kind of issue...:

basically I had to make sure both drives mounted as their correct filesystem (<mount -t ntfs /dev/hda1 /mnt/hda1> for the WinXP/NTFS drive and <mount -t vfat /dev/sda1 /mnt/sda1> for the USB [FAT/FAT16] drive). this was the problem with the OphCrack Live CD, it was basically copy files into thin air. I went with the Ubuntu Live CD because I could copy & paste/drag & drop stuff with the GUI file browser, plus I was able to mount my network shares and continue copying to there after the 128 MB USB drive got filled up.

u do have to be root (not the default user 'ubuntu' and simply continuosly using sudo when browsing the NTFS drive won't do it either) because NTFS is read only and only root has read and execute privileges (i couldn't get groups and others rx access and i didn't try changing the owner to ubuntu). to do this, i changed root's password (typed <sudo passwd root> at the command prompt, changed it to something simple), enabled administrator to login (i forgot the name of the applet/panel that controls that), logged out (got an error, i ignored it), logged in as root with the new password and fired the file manager (Nautilus) and started recovering files to the USB and the network shares

so yeah, Linux can sometimes recover files better than Windows... weird

there's most likely an easier method, but i just figured this out so it's dope to me

hope i was helpful