LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Software
User Name
Password
Linux - Software This forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.

Notices

Reply
 
Search this Thread
Old 10-20-2008, 02:18 PM   #1
shakezilla
Member
 
Registered: Jun 2005
Location: U.S.
Distribution: xubuntu 8.10, linux 2.6.27-11-generic
Posts: 78

Rep: Reputation: 16
Recovery of partition within file


I have a ~250GB file on an ext2 installation of Ubuntu. Within this file is a partition of an ntfs win install. I believe I know the offsets for the partition, I just need to get at it somehow.

So one of two things. I either need a way to split the file into arbitrary sections in place, or I need a way I can use mount on a particular segment of that file.

Any help would be appreciated. Didn't know where to ask this, so if any admin thinks it needs to be somewhere else, please move it.

Besides Ubuntu, I can use whatever you recommend, Knoppix, Slack, etc. Thanks
 
Old 10-20-2008, 03:56 PM   #2
pixellany
LQ Veteran
 
Registered: Nov 2005
Location: Annapolis, MD
Distribution: Arch/XFCE
Posts: 17,802

Rep: Reputation: 728Reputation: 728Reputation: 728Reputation: 728Reputation: 728Reputation: 728Reputation: 728
I don't know what it means to have a partition within a file---unless you mean a partition image. To help us understand the total picture, please post the results of:
fdisk -l
df
 
Old 10-20-2008, 04:19 PM   #3
shakezilla
Member
 
Registered: Jun 2005
Location: U.S.
Distribution: xubuntu 8.10, linux 2.6.27-11-generic
Posts: 78

Original Poster
Rep: Reputation: 16
I have a regular file on a 320GB disk. This particular file is itself a straight disk image of a 250GB disk, complete with MBR (corrupted) and 2 partitions.

The thing is I need to mount one of those partitions and retrieve data, but since MBR is corrupt, it isn't as simple as just plugging in and using mount as usual.

I got the MBR off of another machine of the same model, so theoretically, I should know exactly where the desired partition is within this image file. I just need to know how to access that middle chunk of the file.

Thanks and I'll give any more info you need, though I'm not at the machine in question right now.

Last edited by shakezilla; 10-20-2008 at 04:28 PM. Reason: clarity
 
Old 10-20-2008, 04:33 PM   #4
i92guboj
Gentoo support team
 
Registered: May 2008
Location: Lucena, Córdoba (Spain)
Distribution: Gentoo
Posts: 4,043

Rep: Reputation: 375Reputation: 375Reputation: 375Reputation: 375
If you really know the offsets, I guess you should be able to use dd to dump a image of the partition into a new file, that file should be mountable using a loop device I think.
 
Old 10-20-2008, 05:02 PM   #5
shakezilla
Member
 
Registered: Jun 2005
Location: U.S.
Distribution: xubuntu 8.10, linux 2.6.27-11-generic
Posts: 78

Original Poster
Rep: Reputation: 16
Yeah, but I don't have enough scratch space on that drive to write out to a completely new file.

This was my mom's Compaq, and of course they have the dumb "recovery partition" at the end, which should be a bare install of a few gigs. So the target partition is likely around 240 some odd GB. I'd give you exact numbers if I had the data handy.

Maybe I'm not explaining well, but here's a picture:
Code:
  mom's disk (vista, 250GB)              my disk (ubuntu, 320GB)
+------------------------+  ----+      +------------------------+
|     MBR                |      |      |     MBR                |
|------------------------|      |      |------------------------|
|                        |      |      |                        |
|     Main Partition     |      |      |     Main Partition     |
|       (ntfs)           |      |      |       (ext2)           |
|                        |      |      |                        |
|                        |      |      |    Image file(250GB)   |
|                        |      +--->> |   +---------------+    |
|                        |             |   |    MBR        |    |
|                        |  -------->> |   |---------------|    |
|                        |             |   | Main Part     |    |
|                        |  -------->> |   |               |    |
|                        |             |   |               |    |
|                        |  -------->> |   |---------------|    |
|                        |             |   | Recovery Part |    |
|------------------------|    +----->> |   +---------------+    |
|     Recovery Partition |    |        |                        |
|                        |    |        |                        |
+------------------------+  --+        +------------------------+
I need to somehow mount that middle section of the image file, preferably without having to write it out to a new file.

So is there any way to do this without having a >500GB drive to use as scratch space? I have a 640GB, but it's not really convenient to use it, and I really don't wanna have to if there's an easier way.

Thanks


btw, for those who have to deal with vista, beware of the service packs, that's how my mom got into this mess in the first place. That and not backing up. But hey, it's mom, what are you gonna do?
 
Old 02-27-2009, 03:38 AM   #6
shakezilla
Member
 
Registered: Jun 2005
Location: U.S.
Distribution: xubuntu 8.10, linux 2.6.27-11-generic
Posts: 78

Original Poster
Rep: Reputation: 16
Replying to let everyone know what I figured out.

I never got mount to get at just a section of the file. So I ended up having to just copy the whole file to the beginning of my other HD. (And there was much backing up to be done. And lo, many dvds were burned.)

As a side note, I ended up having to use getDataBack ntfs to recover. How well did it work?

Well, first, the program must be installed onto a windows install, but it is perfectly capable of running from ubcd4win. Runtime even has a plugin for it, but I just installed it to the B: ramdisk, and it worked fine.

It found a ton of files. And LOTS were dupes, so you have to be careful when restoring. I'd say only around 10% of the files were not corrupted. I can't say if the image in question was just super p0wned, or if this is a deficiency in getDataBack. If all those files really were that corrupted, that means that vista sp1 seriously b0rked my mom's drive.

The software is $80 USD, so if you're considering buying it, I would download their trial first. The trial will let you see what files it finds, you just won't be able to back them up. But if you have to stop and exit your windows live, you can save the found file list so that you don't have to scan the HD over again. Alternatively, you can just buy a license from another machine, then take it to the machine being recovered, as you can register the software at any point during the restore process.
 
Old 02-27-2009, 04:15 AM   #7
unSpawn
Moderator
 
Registered: May 2001
Posts: 27,543
Blog Entries: 54

Rep: Reputation: 2924Reputation: 2924Reputation: 2924Reputation: 2924Reputation: 2924Reputation: 2924Reputation: 2924Reputation: 2924Reputation: 2924Reputation: 2924Reputation: 2924
I don't think you would have needed to buy software. You could have loopmounted the file. If you knew the offsets then you could have loopmounted the partitions because 'losetup' allows you to specify offsets. Without MBR and PT data you could have used 'testdisk' to find out. And while making filesystem contents visible mounting it with ntfs-3g is preferable, even in place carving with 'photorec' or 'foremost' (or pyFLAG or TCT) should work.
 
Old 02-27-2009, 05:35 AM   #8
shakezilla
Member
 
Registered: Jun 2005
Location: U.S.
Distribution: xubuntu 8.10, linux 2.6.27-11-generic
Posts: 78

Original Poster
Rep: Reputation: 16
Wish you were here earlier

I'll be looking into testdisk, thanks for the info.
 
Old 02-27-2009, 07:51 PM   #9
okos
Member
 
Registered: May 2007
Location: California
Distribution: Slackware/Ubuntu
Posts: 609

Rep: Reputation: 37
If I understand you correctly, you made an image of your mom's hdd and copied it on to your hdd. Then tried to access the image on your computer.

The mbr was corrupted on your moms computer so it would no longer boot.

Couldn't you access the files on your mom's computer using a live cd such as knoppix? I believe it has ntfs-3g.

Also, if the mbr is corrupted mounting it as a loop probably would not work either.

Testdisk works rather well to recover files and it is FREE. I used it in the past.
 
Old 02-27-2009, 07:59 PM   #10
shakezilla
Member
 
Registered: Jun 2005
Location: U.S.
Distribution: xubuntu 8.10, linux 2.6.27-11-generic
Posts: 78

Original Poster
Rep: Reputation: 16
I originally tried using both knoppix and slax on my mom's machine, but neither could mount the partition, even after restoring the known good MBR. Which I guess means that the file system was too corrupted for mount to handle.

But you're correct, if I had known about testdisk at the time, I could have used it.
 
Old 02-27-2009, 10:52 PM   #11
okos
Member
 
Registered: May 2007
Location: California
Distribution: Slackware/Ubuntu
Posts: 609

Rep: Reputation: 37
Quote:
Originally Posted by shakezilla View Post
I originally tried using both knoppix and slax on my mom's machine, but neither could mount the partition, even after restoring the known good MBR. Which I guess means that the file system was too corrupted for mount to handle.

But you're correct, if I had known about testdisk at the time, I could have used it.
You probably did not mount it properly.
Did you try the following to mount her drive.
Quote:
fdisk -l #to find the type of device the hdd is
mkdir /vista
#Place the device name found from the fdisk -l results into <moms hdd>
mount /dev/<moms hdd> /vista -t ntfs -r
cd /vista
 
Old 03-01-2009, 01:48 AM   #12
shakezilla
Member
 
Registered: Jun 2005
Location: U.S.
Distribution: xubuntu 8.10, linux 2.6.27-11-generic
Posts: 78

Original Poster
Rep: Reputation: 16
Yes, I did:

Code:
mount -t ntfs /dev/sda1 (or whatever number it was) /mnt/mom
Guess it's possible I could have screwed it up, but I'm pretty comfortable with mount.
 
Old 03-01-2009, 05:07 AM   #13
JulianTosh
Member
 
Registered: Sep 2007
Location: Las Vegas, NV
Distribution: Fedora / CentOS
Posts: 674
Blog Entries: 3

Rep: Reputation: 90
testdisk and several other nifty recovery utilities are included in the "Recovery Is Possible" Linux distro. I've had good results with this iso.
 
  


Reply

Tags
data recovery, mount


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
File Recovery from linux formatted partition ullasvm Linux - Software 2 11-21-2006 01:54 AM
Partition and recovery paulsiu Linux - General 1 06-13-2006 01:19 PM
partition recovery cgetty Linux - Software 3 04-18-2005 11:03 PM
File recovery after partition table damage - XFS file system gracecourt Linux - General 2 01-13-2004 04:53 PM
Partition recovery julien.r Linux - Hardware 2 11-19-2003 09:00 AM


All times are GMT -5. The time now is 12:47 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration