QTParted damaged my ntfs partition!

bl0tt0 · 02-13-2006, 03:29 AM

I have an external usb Hard Drive that I have been using to store movies and musis in Windows on an ntfs partition. I wanted to make a little space on the drive in order to store backups of my linux installation, so I ran QTParted off of Systemrescuecd. Everything seemed to run fine without any errors, but after the process completed, my ntfs partition showed up as an unknown filesystem. When I tried to mount the partition read-only as an ntfs partition, I got an error saying that the superblock is bad. I've tried to find information on the forums and google about how to fix this, but I haven't found anything that works. I haven't touched the drive or written anything to it or formatted it at all, so I assume my files are at least still intact on the drive. Can anyone give me some help in recovering the partition and the data on it?

Thank you

EDIT: I should probably also add that this drive has a few partitions on it already, there's one other NTFS partition for backing up my windows installation, one HFS+ that I have used to store my data from an old Powerbook, and at the end was my NTFS partition for storing movies and music. I can mount both of the other partitions just fine, but I cannot get my other partition to mount. It shows up as an HPFS/NTFS partition when I run fdisk -l on the device however.

pljvaldez · 02-13-2006, 12:47 PM

Since you backed up all the data, you can just delete the last couple of partitions and recreate them, right?

bl0tt0 · 02-13-2006, 01:02 PM

That's the problem. I don't have any backups of the media partition, since it had about 80 GBs of stuff on it, and I am out of drive to backup to. I need to figure out what exactly happened, and what I can do to get the files back. Something like the magicrescue program looks like it could have potential, but I'd need another drive to recover the data to. I wish there was a known way to fix a problem partition, but I haven't found anything useful in my case.

haertig · 02-13-2006, 01:20 PM

How about showing us the output of fdisk -l, and mount, and cat /etc/fstab, the exact mount command you ran to attempt to mount the thing manually, and the specific error messages you received from the failed mount attempt? Like they say, "A picture is worth a thousand words."

bl0tt0 · 02-13-2006, 02:57 PM

Ok, makes sense to me.

output of fdisk -l /dev/sda:

Code:

Disk /dev/sda: 250.0 GB, 250059349504 bytes
4 heads, 32 sectors/track, 3815602 cylinders
Units = cylinders of 128 * 512 = 65536 bytes

   Device Boot      Start         End      Blocks   Id  System
/dev/sda1   *           1      327701    20972826    7  HPFS/NTFS
/dev/sda2          327701     1146891    52428127+  af  Unknown
/dev/sda3         1146892     3747608   166445888    7  HPFS/NTFS

/dev/sda2 is an hfs+ partition, and /dev/sda3 is the problem partition, and there's about 4 GB of free space at the end of the drive that was made by QTParted

and cat /etc/fstab:

Code:

/dev/hda6        swap             swap        defaults         0   0
/dev/hda8        /                reiserfs    defaults         1   1
/dev/hda5        /boot            ext2        defaults         1   2
/dev/cdrom       /mnt/cdrom       auto        noauto,user,ro   0   0
/dev/sda         /mnt/usb         auto        noauto,user      0   0
/dev/fd0         /mnt/floppy      auto        noauto,owner     0   0
devpts           /dev/pts         devpts      gid=5,mode=620   0   0
proc             /proc            proc        defaults         0   0
tmpfs            /dev/shm         tmpfs       defaults         0   0

I don't automatically mount the ntfs partitions on the usb drive, so I enter mount -t ntfs -o ro /dev/sda3 /mnt/usb

the output:

Code:

mount: wrong fs type, bad option, bad superblock on /dev/sda3,
       missing codepage or other error
       In some cases useful info is found in syslog - try
       dmesg | tail  or so

I hope this is helpful.

and just to cover all bases, dmesg | tail:

Code:

[fglrx] total FB  = 0
[fglrx] total AGP = 65536
NET: Registered protocol family 10
Disabled Privacy Extensions on device c03fef00(lo)
IPv6 over IPv4 tunneling driver
eth0: no IPv6 routers present
NTFS driver 2.1.24 [Flags: R/W MODULE].
NTFS-fs error (device sda3): read_ntfs_boot_sector(): Primary boot sector is invalid.
NTFS-fs error (device sda3): read_ntfs_boot_sector(): Mount option errors=recover not used. Aborting without trying to recover.
NTFS-fs error (device sda3): ntfs_fill_super(): Not an NTFS volume.

haertig · 02-13-2006, 04:35 PM

I don't have a usb external drive with multiple partitions on it, so I don't know how these things are typically mounted. But it seems that this:

Quote:

...so I enter mount -t ntfs -o ro /dev/sda3 /mnt/usb

Might conflict with this (in your /etc/fstab):

Quote:

/dev/sda /mnt/usb auto noauto,user 0 0

This may be perfectly legal for what you're doing, and I just don't have the required knowledge regarding external usb drive mounting, but it sure seems that /mnt/usb is doing double duty here. Once as a mountpoint for drive /dev/sda and then shortly thereafter as a mountpoint for partition /dev/sda3. Is this the way external usb partitions are properly mounted? I would try a different mountpoint for the partition myself. Not having an external usb drive personally, obviously I'm just talking off the top of my head. But it sure doesn't "feel right" to me to be using the same mountpoint.

Quote:

NTFS-fs error (device sda3): read_ntfs_boot_sector(): Primary boot sector is invalid.

I don't know what this means, but it doesn't sound too good.

cs-cam · 02-13-2006, 07:08 PM

Owie. Try looking at gpart (_not_ gparted). It got me out of a jam once where Windows thought it recognised a ext3 partition but didn't and ended up breaking it. If you're lucky and it saves you then be stoked but something to remember for future, if you don't have the space to back up the data, at least use somethign to back up the partition table

It's small and could save your ass.

bl0tt0 · 02-13-2006, 10:32 PM

haertig: I actually have the entry in my /etc/fstab in order to quickly mount a flash drive. I have used the mount -i... command several times to mount both the ntfs and hfs+ partitions on the /mnt/usb point, so I don't think that's the origin of the problem. Now, when running QTParted from Knoppix, it has the filesystem of /dev/sda3 marked as unknown. It leads me to think that something went wrong with the ntfs_resize program but I'm not sure what.

cs-cam: Well, I tried using gpart to scan my drive, but it has /dev/sda3 marked as unused space, though it seems to be convinced that my hfs+ partition is NTFS or advanced UNIX. I'm not quite sure what to do know. At least some of the data should be salvagable using forensics tools, right?

pljvaldez · 02-15-2006, 06:46 PM

Try this link: http://www.redhat.com/archives/fedor.../msg00908.html

Another thread exists where somehow the partition table of the drive got screwed up and the thread starter managed to fix it by following this article...

bl0tt0 · 03-07-2006, 06:26 PM

Ok, sorry for taking so long to post a reply, but I have been busy. I've finally managed to get my hands on an identical HD from Tigerdirect and made a clone of the broken drive with dd (that does make an exact copy, right?),

pljvaldez, I read the message you linked to, and also managed to find a thread on here that looks to be nearly the exact same problem here that I have had with QTParted, and from both of these I surmise that the problem is indeed something wrong in the partition table itself.

Here's the problem:

I try the sfdisk command:

Code:

 sfdisk -d /dev/sda | sfdisk -H254 /dev/sda

but I get the following error:

Code:

Checking that no-one is using this disk right now ...
OK

Disk /dev/sda: 30401 cylinders, 16 heads, 63 sectors/track
Old situation:
Warning: The partition table looks like it was made
  for C/H/S=*/4/32 (instead of 30401/16/63).
For this listing I'll assume that geometry.
Units = cylinders of 65536 bytes, blocks of 1024 bytes, counting from 0

   Device Boot Start     End   #cyls    #blocks   Id  System
/dev/sda1   *      0+ 327700- 327701-  20972826    7  HPFS/NTFS
/dev/sda2     327700+ 1146890- 819190-  52428127+  af  Unknown
/dev/sda3     1146891  3747607  2600717  166445888    7  HPFS/NTFS
/dev/sda4          0       -       0          0    0  Empty
Warning: given size (41945652) exceeds max allowable size (30644145)

sfdisk: bad input

Ok, I should have looked at the geometry myself before even jumping into this. Checking out the Seagate site (forgot to mention that the drive is a Seagate Barracuda 7200.8) I found that the C/H/S is 16383/16/63. A quick check with sfdisk -g and sfdisk -G shows that the kernel and the partition table have this entirely wrong:

Code:

 bash-3.1# sfdisk -g /dev/sda
/dev/sda: 30401 cylinders, 255 heads, 63 sectors/track

Code:

bash-3.1# sfdisk -G /dev/sda
/dev/sda: 3815602 cylinders, 4 heads, 32 sectors/track

I have tried entering the correct disk geometry through sfdisk by entering

Code:

bash-3.1# sfdisk -d /dev/sda | sfdisk -H16 -C16383 /dev/sda
Checking that no-one is using this disk right now ...
OK

Disk /dev/sda: 16383 cylinders, 16 heads, 63 sectors/track
Old situation:
Warning: The partition table looks like it was made
  for C/H/S=*/4/32 (instead of 16383/16/63).
For this listing I'll assume that geometry.
Units = cylinders of 65536 bytes, blocks of 1024 bytes, counting from 0

   Device Boot Start     End   #cyls    #blocks   Id  System
/dev/sda1   *      0+ 327700- 327701-  20972826    7  HPFS/NTFS
/dev/sda2     327700+ 1146890- 819190-  52428127+  af  Unknown
/dev/sda3     1146891  3747607  2600717  166445888    7  HPFS/NTFS
/dev/sda4          0       -       0          0    0  Empty
Warning: given size (41945652) exceeds max allowable size (16514001)

sfdisk: bad input

Obviously, it didn't work that easy. What should I do now that I know where exactly the problem lies?

Thank you

bl0tt0 · 03-11-2006, 12:31 AM

I just want to let people know that the issue has been resolved. For anyone who faces a similar issue, I recommend the first thing you do is look into testdisk. It is absolutely amazing! It worked so fast that I can't believe it took me this long to fix this.

Thanks everyone for the help

Resolved

igu · 04-04-2006, 11:33 PM

QtParted can indeed corrupt the partition table, independently of the filesystem, if the partition doesn't start at cylinder boundary. Fix is to restore the partition table (not the filesystem!!!) or let TestDisk to do it.

GParted shouldn't have this problem.