I cant mount NTFS file system... please help..

anoop40 · 09-07-2009, 12:55 PM

I am trying to mount my NTFS drives in Linux using NTFS-3g. But an error message is displayed when mounting starts.""[FATAL: Module fuse not found.
NTFS signature is missing.
Failed to mount '/dev/sda1': Invalid argument
The device '/dev/sda1' doesn't seem to have a valid NTFS.
Maybe the wrong device is used? Or the whole disk instead of a
partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?]"" anybody help me....

Wim Sturkenboom · 09-07-2009, 01:07 PM

Please provide exact command used. Also useful to know is the distro that you're using.

colucix · 09-07-2009, 01:11 PM

We need some additional information to solve this issue. First tell us which linux distribution are you running on (you can also add this information in your LQ profile, so that it will be displayed in the left panel of every post). Then can you post the output of the following command (as root):

Code:

fdisk -l

this is to see your current partition set-up. Moreover, is the NTFS drive an external disk or a partition of your current hard drive? In the first case, be sure to issue fdisk -l when the drive is connected.

The problem is that you miss the fuse module loaded into your running kernel - as the error message clearly states. However, without knowing which distro are you running it's quite difficult to give further help.

mikepeters76 · 12-10-2009, 06:27 AM

Hi guys, running 9.10 Ubuntu, I am mounting a dd image of an entire HDD

Code:

sudo fdisk -l tbg1.img
[sudo] password for mrp: 
You must set cylinders.
You can do this from the extra functions menu.

Disk tbg1.img: 0 MB, 0 bytes
255 heads, 63 sectors/track, 0 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Disk identifier: 0x73c373c3

   Device Boot      Start         End      Blocks   Id  System
tbg1.img1   *           1       14588   117178078+   7  HPFS/NTFS
Partition 1 has different physical/logical endings:
     phys=(1023, 254, 63) logical=(14587, 254, 63)

This is what I have already tried:

Code:

sudo mount ./tbg1.img /media/test/
mount: /media/usb/My Documents/2009/Work/vm/tbg1.img is not a block device (maybe try `-o loop'?)

sudo mount -o loop ./tbg1.img /media/test
mount: you must specify the filesystem type


sudo mount -o loop -t ntfs ./tbg1.img /media/test
NTFS signature is missing.
Failed to mount '/dev/loop0': Invalid argument
The device '/dev/loop0' doesn't seem to have a valid NTFS.
Maybe the wrong device is used? Or the whole disk instead of a
partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?

linuxlover.chaitanya · 12-10-2009, 06:29 AM

If it is an image that you are mounting then you should consider dropping -t ntfs option from the command. You are not mounting any file system. You should use this option when you are mounting a partition that has been formatted as NTFS.

mikepeters76 · 12-10-2009, 06:41 AM

am... yes I did that, and:

Code:

sudo mount -o loop ./tbg1.img /media/test
mount: you must specify the filesystem type

so you can see I tried that already. Is there another option I can use with mount?

The disk is a win 2000K disk which was bootable and I ddied to the image file. This is shown when I do the fdisk -l command.

Web31337 · 12-10-2009, 07:32 AM

ntfs-3g is a good solution for NTFS. i mean i used that one long time ago without problems, only problem is a CPU load when reading/writing on that drives(i run rtorrent which seeds at 10mbit/s, so CPU usage at time i used ntfs was around 10% by ntfs-3g driver). but i don't think something may fix that(re-writing perhaps or removing ntfs

)
to mount NTFS partition after installation, run mount with option -t ntfs-3g it shall work.
ubuntu users can use apt-get install ntfs-3g ntfsprogs and do the same.
vol_id util is a useful thing too to get information about partition, ex:

Code:

root@srvr:~# vol_id /dev/sdb1
ID_FS_USAGE=filesystem
ID_FS_TYPE=reiserfs
ID_FS_VERSION=3.6
ID_FS_UUID=45e3b3b8-938f-4ccf-966a-c70ef70b808b
ID_FS_UUID_ENC=45e3b3b8-938f-4ccf-966a-c70ef70b808b
ID_FS_LABEL=300G
ID_FS_LABEL_ENC=300G
ID_FS_LABEL_SAFE=300G

hope it helps.

mikepeters76 · 12-10-2009, 07:42 AM

thanks but no.

I have tried ntfs-3g, and one more try:

Code:

 rp@mrp-desktop:/media/usb/My Documents/2009/Work/vm$ sudo mount -o loop -t ntfs-3g ./tbg1.img /media/test
NTFS signature is missing.
Failed to mount '/dev/loop0': Invalid argument
The device '/dev/loop0' doesn't seem to have a valid NTFS.
Maybe the wrong device is used? Or the whole disk instead of a
partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?
mrp@mrp-desktop:/media/usb/My Documents/2009/Work/vm$ sudo mount  -t ntfs-3g ./tbg1.img /media/test
NTFS signature is missing.
Failed to mount '/media/usb/My Documents/2009/Work/vm/tbg1.img': Invalid argument
The device '/media/usb/My Documents/2009/Work/vm/tbg1.img' doesn't seem to have a valid NTFS.
Maybe the wrong device is used? Or the whole disk instead of a
partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?
mrp@mrp-desktop:/media/usb/My Documents/2009/Work/vm$ sudo mount -t ntfs-3g ./tbg1.img /media/test
NTFS signature is missing.
Failed to mount '/media/usb/My Documents/2009/Work/vm/tbg1.img': Invalid argument
The device '/media/usb/My Documents/2009/Work/vm/tbg1.img' doesn't seem to have a valid NTFS.
Maybe the wrong device is used? Or the whole disk instead of a
partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?

and as suggested I installed ntfsprogs and ran ntfs3g.probe and got the same NTFS signature is missing.

I just want to analyse the image it is for forensic purposes so CPU cycles are not an issue, just image integrity but I am working on a copy anyhow.

Web31337 · 12-10-2009, 07:51 AM

i believe .img is your previous NTFS partition image. it should first be placed onto HDD then mounted as partition... written or mounted. not really sure how to do it, didn't work with dd-created disk images(only backuped/restored USB that way once). correct me if i'm wrong.

mikepeters76 · 12-10-2009, 08:13 AM

web you silly russian... LOL sorry, it is late. No it is not a previous partition image. It is a hdd image yes. I could have called it anything, it is just a bit by bit copy of the entire HDD into a file. What you say makes sense, I could copy it back to a drive using dd, but I don't want to do that, I just want to mount the image file and do some analysis on it, in particular grokevt and reglookup.

Does anybody know how if I can copy the image onto a bigger drive? ie the image is 110GB and the smallest drive I have is 500GB?

Any further ideas on mounting the .img file as a drive? And why am I getting the NTFS signature missing when I try to mount even though it is identified as NTFS by fdisk. Is it something to do with:

Quote:

Partition 1 has different physical/logical endings:
phys=(1023, 254, 63) logical=(14587, 254, 63)

Do I have to do some offseting to mount it and if so why?

fpmurphy · 12-10-2009, 12:59 PM

First you have to carve your disk image into partition images i.e. extract the partitons from the image. If you know your partition start and ending sections you can use dd to do it. For example if the partition you are interested in starts at block 163 and ends at block 264, the following will carve out that partition

Code:

dd if=disk.img bs=512 skip=163 count=101 of=partition.img

If you do not know the details of your partitions, you can figure it out by examining the MBR using a hex editor or a tool like xxd. Assuming no extended partitions, the first partition is at offet 0x1BE, the second partition is at offset 0x1CE and so on. Each partition entry is 16 bytes long. End of MBR marker is 0x55AA. In each partition entry, offset 8 of length 4 gives you the starting section and offset 12 of length 4 gives you the number of sectors in the partition. If this is too much to handle, do a web search for a free forensics tool called mmls which will list the partition information from a disk image.

mikepeters76 · 12-10-2009, 07:21 PM

thx. I did

Code:

dd if=./tbg1.img |hexdump -C|less

but found the hex output too much too handle (as you said), how far down is 0x1BE, is that equivalent to 00001BE0??? In any case I had the sleuthkit installed so based on

Code:

rp@mrp-desktop:/media/try$ sudo mmls ./TBG1/tbg1.img
 91 DOS Partition Table
 92 Offset Sector: 0
 93 Units are in 512-byte sectors
 94 
 95      Slot    Start        End          Length       Description
 96 00:  -----   0000000000   0000000000   0000000001   Primary Table (#0)
 97 01:  -----   0000000001   0000000062   0000000062   Unallocated
 98 02:  00:00   0000000063   0234356219   0234356157   NTFS (0x07)
 99 03:  -----   0234356220   0234374999   0000018780   Unallocated

I did:

Code:

sudo dd if=./TBG1/tbg1.img bs=512 skip=63 count=0234356157 of=/media/usb/tbg1_partition.img

I am doing a watch on the directory it is up to 2GB should be 110GB so will post results when finished.

Would love some help understanding the dd | hexdump of the raw image.

jschiwal · 12-10-2009, 07:34 PM

If you run "file <image_file>" it may list start and end of the partitions on the disk. You can also run "fdisk -lu <image_file>" to list the partitions. The -u option uses 512 byte blocks which will prevent rounding errors.

You will probably find that the first partition is on block 63. Knowing the offset, you can use the "losetup" command to create a loop device for a partition inside the image file.

sudo /sbin/losetup -fs <image_file> -o $((512*<starting_block>))

eg.
sudo /sbin/losetup -fs <image_file> -o $((512*63))

The loop device created will be printed, eg:
loop0
Now you can use the "file" command again to verify the last step worked and determine the filesystem:
sudo file -s /dev/loop0

Next you can mount it:
sudo mount -t ntfs /dev/loop0 /mnt

There is no need to cut out the partition, unless your purpose is to restore a partition from a disk image. You can simply copy files after mounting it. You can even make changes now, deleting or adding files.

mikepeters76 · 12-10-2009, 08:37 PM

guess that is why you are a moderator. Exactly what I was looking for and it worked perfectly. I have stopped the "extraction" since the image is 110GB it would have taken for ever and I need to get this report out this afternoon.

All it took in the end was the creation of the loop device with the losetup command.

Thanks!

kingston · 12-11-2009, 03:24 AM

hey....install the following 4 rpms...
dkms-2.0.20.4-1*
dkms-fuse.2.7.4-1*
fuse-2.7.4-1*
fuse-ntfs-3g-2009.4.4-1* rpms

it will be solved