Hi there,
I have a broken NTFS drive that i am trying to rescue using ddrescue.
In order for ddrescue to work i need to mount the drive as 'read only'

The drive has 1 partition and is /dev/sdg/
and i have created a mount point /mnt/windows

Could somebody tell me the syntax to remount this drive as read only?

Thanks for your help

Chris

Depends on whats wrong. It may not be possible to mount one read/write safely - it may require mounting and repair from a windows system.

If a windows system isn't available then your best bet may be to do a dd copy of the partition into a file, then mount the file by a loopback.

Hi there jpollard,
That dd copy idea sounds good to me
How would I do that?

The simple way is "dd if=<device partition> of=<file on a disk large enough to hold the data> bs=<any reasonable size, even 1M is useful>"

Once the file is created you can try to mount it with "mount -t ntfs-ng <partition image file> /mnt". current mount versions should automatically create a loopback mount for the file.

The reason I put <device partition> and <partition image file> is that if you get an entire disk (rather than just the partition the filesystem is on), and that includes the partition table. At that point mounts get harder because you have to specify offsets into the file to get to the beginning of the filesystem (and that is a pain to figure out).

Once the partition image is mounted (or even before) you can work on it. I know the linux native filesystems mostly have a "fsck" that will work on image files - I'm not sure of them for NTFS, there is one, but I don't know how well it works. The nice thing about working with the file is that even if something goes badly wrong, you still have the original to work with. And if things go well and the filesystem gets repaired - you can do the same repair on the real parition.

It is just a way of CYA when things get nasty. It does mean that you have to have a filesystem that is large enough to hold the damaged data. This is the major downside- If you are trying to repair a 2 TB partition, you need one that is slightly larger than 2TB to hold all the data (reason is that copying a partition requires the data space the same size as the partition + any metadata needed for the filesystem containing the copy).

Thanks jpollard,
Firstly i must tell you that i dont fully understand what you've written.. i'm sorry.
From what i gather is it this:

1. We're going to copy the whole partition on to a drive that is bigger.
2. Then we're going to try to access the copied file and recover from that

My broken drive is 1tb and is /dev/sdg
My folder to put the copied partition is on a 2tb drive and is /media/MOVIES/recover

So for your first paragraph i would enter the syntax?:

sudo dd if=/dev/sdg 0f=/media/MOVIES/recover bs=1M

Is this correct ?

Thanks for again for the help..

That looks right.

1TB is awfully large for a good NTFS filesystem. Does a windows boot ever access it?

Just noticed - you have a "0f" for the output file instead of "of".

The drive is an external that was preformatted to NTFS, i just plugged it in started putting stuff there..

Now when you plug it in it recognises that the drive is there and gives you the first few folders.. but when you go in to the folders theres nothing in there. Where previously (before it broke) there was.

OK ive put that syntax in:
sudo dd if=/dev/sdg 0f=/media/MOVIES/recover bs=1M

and it sais:'/media/MOVIES/recover': Is a directory

i dont think its done it as there isnt a file in the recover folder

changed the syntax to of instead of 0f

now reads:
sudo dd if=/dev/sdg of=/media/MOVIES/recover bs=1M

still sais: '/media/MOVIES/recover': Is a directory

Do i need to put the file name that it is recovering to or will it do that automatically?

I've now added the rec.img to the syntax

sudo dd if=/dev/sdg of=/media/MOVIES/recover/rec.img bs=1M

on doing this i got

'/dev/sdg' : Input/output error

Thanks again for your help on this. These forums are fantastic for getting info to us newbies

That looks like a dead drive.

Sorry about that.

Your original approach with using ddrescue was the better way for a broken disk. But you don't need to mount the partition at all for ddrescue, it will, like dd, work on the device descriptor.

Try it with

Hi there TobiSGD,
Just tried
ddrescue /dev/sdg1 of=/media/MOVIES/recover/rec.img

and it said Cant open output file "no such file or directory"

Then i removed the "of=" and now its doing stuff... (what does "of=" tell it to do?)

i'd best leave that for a few hours

Sorry, the of= was a mistake when copying/pasting your filenames, it does not work with ddrescue, only with dd.