[SOLVED] USB drive fails to mount – “Mount denied…..”, also deletes data on unmount

ronells2000 · 10-19-2016, 07:15 PM

I’ve been through forums all over the internet and nothing works.

I will give as detailed information as I can because like I said I’ve tried it all, that I’ve read.

I’m using the CAINE 7.0 Live CD

My HDD crashed and I’ve been trying to recover it with ddrescue and keep losing the data acquired to the drive on each unmount. Now, ddrescue takes over 5hrs to run each time on a 1TB HD. Copying it to a 2nd USB drive for backup also takes hours. I hope you see the frustration.

Started this whole process with mounting the USB drive, /media/sdb1 and creating the image to it. I then mount the 2nd USB hard drive as /media/sdc1 and backup the image to it.

I unmounted sdb1

Code:

umount /media/sdb1

all indications said it was successful. Take it to my other PC and the image file, log file and other documents are gone. I thought maybe they’re just not visible because they’re Linux documents. So I remounted /media/sdc1 and no files. To verify the loss of data I created a test doc to sdb1 and unmounted and mounted immediately (no disconnecting) and doc is gone. I performed the same on sdc1 with same results. I inserted a thumb drive as sdc1 with same results. I read somewhere to use the “-d” option to unmount the attached loop devices also.

Code:

umount -d /media/sdxX

It worked, now all devices, so far, mounted as /media/sdc1 will unmount and save the data. Finally able to save a 1TB image backup file. Except, it does not work on /media/sdb1.

Out of nowhere it starts failing mount with “Mount is denied because the NTFS volume is already exclusively opened. The volume may be already mounted, or another software may use it which could be identified for example by the help of the 'fuser' command.”

Searched all over the forums for a week with no luck. I decided to try a recommendation, by almost everyone,

Code:

Mount /dev/sdbX /mnt (or any folder)

Followed directions and created a folder, changed permissions and mounted as follows:

Code:

mkdir /media/USB_sdb1
chmod 777 /media/USB_sdb1
mount -t ntfs-3g /dev/sdb1 /media/USB_sdb1

Mounted successfully, was able to read, write, unmount and remount.

Decided to go back to the “Mount denied because the NTFS volume is already exclusively opened….” Problem.
Eventually found many suggestions to kill the processes on /media/sdb1. So I checked for processes on “the unmounted” /media/sdb1 and found:

Code:

fuser -cu /media/sdb1
/media/sdb1:             1rce(root)     2rc(root)     3rc(root)     4rc(root)     5rc(root)     7rc(root)     8rc(root)     9rc(root)    10rc(root)    11rc(root)    12rc(root)    13rc(root)    14rc(root)    15rc(root)    16rc(root)    17rc(root)    18rc(root)    19rc(root)    20rc(root)    21rc(root)    22rc(root)    23rc(root)    24rc(root)    25rc(root)    26rc(root)    27rc(root)    28rc(root)    29rc(root)    30rc(root)    31rc(root)    32rc(root)    33rc(root)    34rc(root)    36rc(root)    37rc(root)    38rc(root)    39rc(root)    41rc(root)    42rc(root)    43rc(root)    44rc(root)    46rc(root) ……………..

So I ran suggestions, such as:

Code:

fuse -v -k /media/sdb1
kill -9 process

even check for processes running on chroot:

Code:

ls -l /proc/*/root | grep chroot location (I found one located at /usr/bin/chroot)
no processes

I tried several kill processes on sdb1 with no luck. Eventually tried:

Code:

Kill -9 -1 /media/sdb1

REBOOTED my system! So, starting all over.

Now /media/sdb1 mounts and unmounts but still loses data on unmount.

So I tried mounting /dev/sdb1 to /media/USB_sdb1 again. It fails:

Code:

mkdir /media/USB_sdb1
chmod 777 /media/USB_sdb1
mount -t ntfs-3g /dev/sdb1 /media/USB_sdb1
fuse: mount failed: Permission denied
also tried
mkdir /media/USB_sdb1
chmod 777 /media/USB_sdb1
mount -rw /dev/sdb1 /media/USB_sdb1
fuse: mount failed: Permission denied

even tried force mount

Code:

mount -t ntfs-3g /dev/sdb1 /media/USB_sdb1 -o force

and also deletes the USB_sdb1 folder.

So, why am I losing my data on unmount?

Should I be using “mount /dev/sdb1 /folder” or “mount /media/sdb1” and why?

It’s both ways on the net.

rtmistler · 10-20-2016, 07:55 AM

You should be using the mount command with sudo, or as root. So first, are you doing that?

ronells2000 · 10-20-2016, 08:42 AM

Yes. I'm using CAINES's root terminal:

Code:

root@caine:/home/caine# mount -rw /media/sdb1

and

root@caine:/home/caine# mount -t ntfs-3g /dev/sdb1 /media/USB_sdb1

It works, then stops working. Reboot starts all over again.
I have just been hesitant about removing the drives because of data loss, but when the system rebooted I was able to play with it more.

By the way, Galaxy Quest, one of my favorite movies

rtmistler · 10-20-2016, 09:42 AM

It is baffling, however there are a couple of points and things I'd have tried. Not saying that these would make the best sense here given that you've written data to both drives, or so that appears.

First, mount/umount are always done as root or using sudo. - Check, you're doing that.
Next, your mount commands appear to be fine, "sudo mount -t <type> /dev/<drive-letter> /media/<path>", I'm assuming you have made sure that /media/<path> is owned by root.

At this point, for your former drive which crashed, you either can successfully mount, successfully see some files, versus not.

If that drive "crashed" then what's that mean? Linux/Windows would no longer boot, but data still appears to be there?

Copy that data off the drive, I'm assuming to create your back up used dd?

To copy an entire drive image as a back up so I could tinker with a recovery software, I'd do the following:

1. Bad drive installed, say it is /dev/sdb1
2. Empty - new backup drive installed, say it is /dev/sdc1
3. Make sure /dev/sdb1 and /dev/sdc1 are un-mounted
4. sudo dd if=/dev/sdb of=/dev/sdc - this makes the backup
5. Remove both drives
6. Do my tinkering with that new backup drive, tools to try:
ddrescue - I've never used
PhotoRec - pretty good, but makes a lot of files
fdisk - check what is up with the partitions
gparted - similar to fdisk, just more UI related, use whichever you prefer
7. If you can or can't see files on the failed disk image - that's about my limit
8. Overall, I'd not try to recover a failed drive to make it boot-able. I'd try to recover the data only and use an entirely new drive for my newly installed system, keep the old drive, and drive image, and take data from there over time as I detected that I needed it, and given the possibility that I could find that needed data.

ronells2000 · 10-20-2016, 10:49 AM

Yes, I’m at root using “root terminal”: root@caine:/home/caine#
I have not made sure /media/<path> is owned by root. How would I do that?
The original drive will no longer boot. I am hoping the data is still there.
1. The Bad drive is connected as “/dev/sda”, sda1-sda7
2. Backup drive “mounted” as /media/sdb1
3. /dev/sda not mounted, media/sdb1 mounted
4. Many different opinions on dd vs dd_rescue vs ddrescue, went with ddrescue
Running ddrescue (at root) to a folder on sdb1

Code:

#ddrescue -n /dev/sda5 /media/sdb1/Backup_image/091616.img

5. Perform umount on media/sdb1, I lose all data created during that session! Continues to this day. Did however get /media/sdc1 to save data on umount, using umount -d option, so finally got a backup of the image saved. Real frustrating, took close to 6hrs to run ddrescue each time I unmounted sdb1. Still takes hrs to copy from sdc1 to sdb1.
6. Thought of using PhotRec, does not save file names,
7. All online suggestions say stay away from mounting or trying to correct the Bad drive, so running ddrescue. I think it’s probably shot anyway, so I ordered a larger 2TB drive to replace it.
I have run partx on it to look at the image structure:

Code:

#partx –show image_091616.img
partx: image_101616.img: failed to read partition table

I found kpartx while searching for mounting disk images. To mount all the partitions in a raw disk image (mounts as a loop device with partitions):

Code:

#kpartx -av /media/sdb1/Backup_image/image_101416.img
Alternate GPT is invalid, using primary GPT.

I've been told the partition table has been restructured and is seeing the entire drive and not just sda5. Kpartx mounts (/dev/loop3) partitions 1-4 (/dev/mapper/loop3p1 – loop3p4) but partitions 5-7 fail with “Invalid Argument”. Partition 5 is the c: drive, the partition I’m trying to recover.

I’m hoping I can restructure the image partition table to mount correctly without having to touch the physical drive.

rtmistler · 10-20-2016, 11:50 AM

Quote:

Originally Posted by ronells2000

I have not made sure /media/<path> is owned by root. How would I do that?

If a partitioning program such as what you've tried or fdisk does not recognize partitions, then there are few options I know of. PhotoRec is the best option I've seen, yes it does not save filenames, however it does get you some files back where you can rename those that you wish to keep.

Quote:

Originally Posted by ronells2000

I've been told the partition table has been restructured and is seeing the entire drive and not just sda5. Kpartx mounts (/dev/loop3) partitions 1-4 (/dev/mapper/loop3p1 – loop3p4) but partitions 5-7 fail with “Invalid Argument”. Partition 5 is the c: drive, the partition I’m trying to recover.

I’m hoping I can restructure the image partition table to mount correctly without having to touch the physical drive.

Once the partition table is rewritten, as it seems to have been done, the file system has been invalidated. The only recovery options are things like forensic recovery programs, such as the one already cited. That's just my humble opinion, perhaps others have different ideas.

smallpond · 10-20-2016, 12:17 PM

Code:

ddrescue -n /dev/sda5 /media/sdb1/Backup_image/091616.img

You are reading a single partition, so there is no partition table in your resulting image. It should be just an image of the filesystem that was on /dev/sda5. To mount it, do something like:

Code:

mkdir /mnt/rescue
mount -o loop /media/sdb1/Backup_image/091616.img /mnt/rescue

Check under /mnt/rescue/ for your files.

Also, why are you formatting the backup drive as NTFS and not using a native Linux filesystem? This could be causing problems.

ronells2000 · 10-20-2016, 01:08 PM

Code:

You are reading a single partition, so there is no partition table in your resulting image. It should be just an image of the filesystem that was on /dev/sda5.

I've been told that the partition table has been restructured because I am running ddrescue on sda5 but when I mount the image file the entire drive has been copied. This is what I get:

Code:

root@caine:/# kpartx -av /media/sdb1/Backup_image/image_091616.img
Alternate GPT is invalid, using primary GPT.
add map loop3p1 (252:0): 0 2048000 linear /dev/loop3 2048
add map loop3p2 (252:1): 0 532480 linear /dev/loop3 2050048
add map loop3p3 (252:2): 0 1024000 linear /dev/loop3 2582528
add map loop3p4 (252:3): 0 262144 linear /dev/loop3 3606528
device-mapper: resume ioctl on loop3p5 failed: Invalid argument
create/reload failed on loop3p5
add map loop3p5 (0:0): 0 1897738240 linear /dev/loop3 3868672
device-mapper: resume ioctl on loop3p6 failed: Invalid argument
create/reload failed on loop3p6
add map loop3p6 (0:0): 0 716800 linear /dev/loop3 1901606912
device-mapper: resume ioctl on loop3p7 failed: Invalid argument
create/reload failed on loop3p7
add map loop3p7 (0:0): 0 51200000 linear /dev/loop3 1902323712
root@caine:/

sda1, sda2, sda3 and sda4 mount and sda5 - sda7 fail to mount.

when run lsblk I get the same results in loop3p1-p4 as sda1-sda4:

Code:

#lsblk -o name,label,size,fstype,model
NAME             LABEL         SIZE FSTYPE   MODEL
sda                          931,5G          HGST HTS541010A9
├─sda1           WINRE_DRV    1000M ntfs     
├─sda2           SYSTEM_DRV    260M vfat     
├─sda3           LRS_ESP       500M vfat     
├─sda4                         128M          
├─sda5           Windows8_OS 904,9G ntfs     
├─sda6                         350M ntfs     
└─sda7           PBR_DRV      24,4G ntfs    

loop3                        904,9G          
├─loop3p1 (dm-0) WINRE_DRV    1000M ntfs     
├─loop3p2 (dm-1) SYSTEM_DRV    260M vfat     
├─loop3p3 (dm-2) LRS_ESP       500M vfat     
└─loop3p4 (dm-3)               128M

Code:

 To mount it, do something like:
mkdir /mnt/rescue
mount -o loop /media/sdb1/Backup_image/091616.img /mnt/rescue

I mounted it once using:

Code:

mount /media/sdb1/Backup_image/091616.img /media/MyBackup -o loop

this is what showed up in /media/MyBackup

Code:

 boot (folder)
 efi (folder)
 sources (folder)
 support (folder)
 autorun.inf
 bootmgr
 bootmgr.efi
 MediaMeta.xml
 setup.exe

Code:

Also, why are you formatting the backup drive as NTFS and not using a native Linux filesystem?

Because when I run lsblk and parted they show sda5 as a ntfs File system

Code:

# parted –list
Model: ATA HGST HTS541010A9 (scsi)
Disk /dev/sda: 1000GB
Sector size (logical/physical): 512B/4096B
Partition Table: gpt

Number  Start   End     Size    File system  	Name                          	Flags
 1      1049kB  1050MB  1049MB  ntfs                                       		hidden, diag
 2      1050MB  1322MB  273MB   fat32        EFI system partition         	boot
 3      1322MB  1847MB  524MB   fat32                                      		hidden
 4      1847MB  1981MB  134MB                Microsoft reserved partition  	msftres
 5      1981MB  974GB   972GB   ntfs         Basic data partition         	 msftdata
 6      974GB   974GB   367MB   ntfs                                       		hidden, diag
 7      974GB   1000GB  26,2GB  ntfs                                       		hidden, diag
#

ronells2000 · 10-20-2016, 01:25 PM

rtmistler,

Code:

Once the partition table is rewritten, as it seems to have been done, the file system has been invalidated.

I've found some websites where they describe how to recover a lost partition and "How to Fix a Mangled Partition Table". Both of which I'm lost on. But everything I've read say's you can do to an image as you can do to a drive, so I'm hopeful.

I believe I found the original partition table in the /proc folder by running:

Code:

grep sda /proc/partitions

If this is the correct table it may be possible.

If I can restructure it partitions 5-7 will hopefully mount.

rtmistler · 10-20-2016, 01:35 PM

Best of luck. I know, no better methods than I've suggested.

Yes, being as well versed as a person who writes the actual file systems and their structure and then taking the time to reverse study the bits and bytes to reconstruct a possible partition scheme using some experienced trial and error are always possible. It becomes a matter of how much proficiency you wish to put into reconstruction. If for academic/self learning reasons I fully understand, as said, beyond my personal limits. If it was critical, non-replaceable data, then it probably should've been backed up in advance and that is a learning point for many of us. I hope it's more the former and you just wish to explore further if this is possible.

ronells2000 · 10-20-2016, 04:54 PM

Well, like I said I'm lost on them so it's further than I'm sure I'll go. Thanks for all your info.

There is PhotoRec and some other software out there I can tinker around with on the image file. I did have Acronis True Image running on it once a week, Sat night, so I didn't loose much. I was hoping to recover things done in between backups. Enough that I wanted to recover it.

I have a new HDD coming in soon, so I'll be busy reinstalling the software.

I still have the question out there for anyone that can give me an answer:

So, why am I losing my data on unmount?

Should I be using “mount /dev/sdb1 /folder” or “mount /media/sdb1” and why?

rtmistler · 10-20-2016, 05:37 PM

If you have a clean disk running a Linux file system and were losing data, I'd agree. Given the state of that disk, I'd like to see what happens once you're all set and you use the backup with a clean file system and non-damaged partition table. Right now the master and the copy are bad because the partition table is corrupt. How can the system resolve the file system if there are errors in the partition table? Note that the copy has the same corrupt partition table.

ronells2000 · 10-20-2016, 07:04 PM

That's what I was thinking also, both partition tables are wrong so ddrescue didn't know where to actually start and copied the entire drive. The data's still there, is that right? If they can recover data from a formatted drive I should still be able to recover the data from a misaligned partition. I have given up on the partition recovery, maybe somewhere down the road I might learn about partitions and file systems, but it's over my head for now.

I will look into PhotoRec and the other software I found. Once I resolve my mount and unmount problem. I'm tired of waiting for 2 or so hours each time I have to copy the backup image from the other drive each time it get's deleted on an unmount of sdb1.

So the original problems still aren't solved.

Code:

I'm assuming you have made sure that /media/<path> is owned by root.

Mounting /media/USB_sdb1 mounts and unmounts for a while just fine, then out of nowhere, I do nothing different, it starts failing for "fuse: mount failed: Permission denied". Would ownership suddenly change?

Same thing with mounting /media/sdb1. Works fine for a while, then fails for

Code:

“Mount denied because the NTFS volume is already exclusively opened….”.

Windows talks about a "dirty" bit.

Code:

"Windows will check the dirty bit to determine if a volume can contain corrupted files due to hard resetting your Windows computer with files that are still opened or when you unplug a USB flash drive that is in the midst of copying a file.
"

Is it possible this bit was not changed on an unmount and Linux works this way also? Everything else I've read and tried doesn't work.

You had asked why I mount /media/USB_sdb1 as ntfs and not Linux. Since the lsblk shows it as ntfs would it mount as a Linux File system? Does it make it more manageable?

The last question: why is my data created on sdb1 while sdb1 is mounted deleted when it is unmounted?

ronells2000 · 10-23-2016, 09:51 AM

I've decided to go the way of the consensus, mount sdb1 to a folder on the desktop. I was still having the data deleted on umount. So, I did some research and found someone who edited the fstab file to make mounting to (the same parameters as the system is defaulting it to) a directory on the Desktop. So far NO lost data on unmount.

First I create a directory/mount point on the desktop and give it full permissions:

Code:

root@caine:/home/caine/# cd Desktop
root@caine:/home/caine/Desktop# mkdir USB1
root@caine:/home/caine/Desktop# chmod 777 USB1
root@caine:/home/caine/Desktop# mkdir Flash
root@caine:/home/caine/Desktop# chmod 777 Flash
root@caine:/home/caine/Desktop#

In place of the device path I'm using the drives UUID so I don't have to worry about the devices getting shuffled during unmount, and I use the New directory path as the mount point (yes, I created a fstab.bak backup file) and saved it as fstab_mount for quick copy, you'll see why in just a little bit:

Code:

UUID=A6B01E5FB01E35F1  /home/caine/Desktop/USB1  ntfs-3g  rw,loop,noauto,noexec,nodev,noatime,umask=000,show_sys_files,streams_interface=windows,allow_other 0 0 # by rbfstab
UUID=E2FB-5843 /home/caine/Desktop/Flash vfat rw,loop,noauto,noexec,nodev,noatime,umask=000,shortname=mixed,quiet 0 0 # by rbfstab

As I said, the Type and Option are all copy and paste from the systems original fstab.

Next all I need to do is mount the mount point: USB1 and Flash. Unfortunately I have to be on the Desktop to do this, is there a script I can write that I can click on and do it without being on the desktop in the terminal?

Code:

/Desktop# 
/Desktop# mount USB1
/Desktop# mount Flash
mount: can't find Flash in /etc/fstab or /etc/mtab
/Desktop#

As you can see it fails to mount the thumb drive "Flash" because it can not be found in fstab." This is because after every mount the fstab is automatically overwritten.
I edit fstab in "nano /etc/fstab", I've even used sudo nano, but it keeps getting overwritten.

So I copy fstab_mount to /etc/fstab and mount the falsh drive. And again fstab is overwritten.

Help is very sparse on the web, and all they talk about is being overwritten on Boot, not mount. I'm using a Live CD, so no booting.

So I got to thinking, it could be the end of each line calling the file: "# by rbfstab".
Searched for the rbfstab file:

Code:

root@caine:/# find / -iname rbfstab
/usr/sbin/rbfstab
/rofs/usr/sbin/rbfstab
root@caine:/#

opened /usr/sbin/rbfstab and found below:

Code:

root@caine:/# nano /usr/sbin/rbfstab

  GNU nano 2.2.6           File: /usr/sbin/rbfstab
                              
#!/bin/bash

## Variables
PATH="/bin:/sbin:/usr/bin:/usr/sbin"
TMP="/tmp/fstab.$$.tmp"
ADDEDBY="# by rbfstab"
WRITE_LABEL="RBFSTAB"
SCRIPT=/usr/sbin/${0##*/}
RULE=/etc/udev/rules.d/fstab.rules

## Functions
install_script()
{
    echo "$0 first time run:"
    echo "* Copying $0 to $SCRIPT"
    cp $0 /usr/sbin/
    echo "* Creating udev rule $RULE"
    cat << EOF > $RULE
# Force fstab options for devices
RUN+="/usr/sbin/rbfstab"
EOF
    echo "* Restarting udev service"
    sudo service udev restart
    echo "Installation of $0 complete."
    rbfstab
    exit 0
}

remove_script()
{
    rm -vf $RULE

I opened /rofs/usr/sbin/rbfstab and both rbfstab's have the same code.

I removed “ # by rbfstab” from end of each line entry. On mount, boot defaults are added to the end of fstab, on the first mount ONLY. Why only the first mount???

Code:

root@caine:/home/caine/Desktop# nano /etc/fstab

    GNU nano 2.2.6           File: /etc/fstab

overlayfs / overlayfs rw 0 0
tmpfs /tmp tmpfs nosuid,nodev 0 0
/dev/sr0        /media/sr0      iso9660  ro,loop,noauto,noexec,nodev,noatime 0 0
/dev/sda1       /media/sda1     ntfs-3g  ro,loop,noauto,noexec,nodev,noatime,umask=000,show_sys_files,streams_interface=windows,allow_other 0 0
/dev/sda2       /media/sda2     vfat     ro,loop,noauto,noexec,nodev,noatime,umask=000,shortname=mixed,quiet 0 0
/dev/sda3       /media/sda3     vfat     ro,loop,noauto,noexec,nodev,noatime,umask=000,shortname=mixed,quiet 0 0
/dev/sda5       /media/sda5     ntfs-3g  ro,loop,noauto,noexec,nodev,noatime,umask=000,show_sys_files,streams_interface=windows,allow_other 0 0
/dev/sda6       /media/sda6     ntfs-3g  ro,loop,noauto,noexec,nodev,noatime,umask=000,show_sys_files,streams_interface=windows,allow_other 0 0
/dev/sda7       /media/sda7     ntfs-3g  ro,loop,noauto,noexec,nodev,noatime,umask=000,show_sys_files,streams_interface=windows,allow_other 0 0
UUID=A6B01E5FB01E35F1       /home/caine/Desktop/USB1     ntfs-3g  rw,loop,noauto,noexec,nodev,noatime,umask=000,show_sys_files,streams_interface=windows,allow_other 0 0
UUID=4E26CC1026CBF74D       /home/caine/Desktop/USB2     ntfs-3g  rw,loop,noauto,noexec,nodev,noatime,umask=000,show_sys_files,streams_interface=windows,allow_other 0 0
UUID=E2FB-5843       /home/caine/Desktop/Flash     vfat  rw,loop,noauto,noexec,nodev,noatime,umask=000,shortname=mixed,quiet 0 0

########## Below are the lines added after a mount is issued ##############

/dev/sr0        /media/sr0      iso9660  ro,loop,noauto,noexec,nodev,noatime 0 0 # by rbfstab
/dev/sda1       /media/sda1     ntfs-3g  ro,loop,noauto,noexec,nodev,noatime,umask=000,show_sys_files,streams_interface=windows,allow_other 0 0 # by rbfstab
/dev/sda2       /media/sda2     vfat     ro,loop,noauto,noexec,nodev,noatime,umask=000,shortname=mixed,quiet 0 0 # by rbfstab
/dev/sda3       /media/sda3     vfat     ro,loop,noauto,noexec,nodev,noatime,umask=000,shortname=mixed,quiet 0 0 # by rbfstab
/dev/sda5       /media/sda5     ntfs-3g  ro,loop,noauto,noexec,nodev,noatime,umask=000,show_sys_files,streams_interface=windows,allow_other 0 0 # by rbfstab
/dev/sda6       /media/sda6     ntfs-3g  ro,loop,noauto,noexec,nodev,noatime,umask=000,show_sys_files,streams_interface=windows,allow_other 0 0 # by rbfstab
/dev/sda7       /media/sda7     ntfs-3g  ro,loop,noauto,noexec,nodev,noatime,umask=000,show_sys_files,streams_interface=windows,allow_other 0 0 # by rbfstab

root@caine:/home/caine/Desktop#

This will allow multiple mounts of the same device.

Below is the fstab from "/lib/init/fstab"

Code:

/Desktop# nano /lib/init/fstab

GNU nano 2.2.6                       File: /lib/init/fstab 

# /lib/init/fstab: static file system information.
#
# These are the filesystems that are always mounted on boot, you can
# override any of these by copying the appropriate line from this file into
# /etc/fstab and tweaking it as you see fit.  See fstab(5).
#
# <file system> <mount point>            <type>          <options>                               <dump> <pass>
/dev/root       /                         	   rootfs          	defaults                                     0 1
none            /proc                     	   proc            	nodev,noexec,nosuid                          0 0
none            /proc/sys/fs/binfmt_misc   binfmt_misc     nodev,noexec,nosuid,optional                 0 0
none            /sys                      	   sysfs           	nodev,noexec,nosuid                          0 0
none            /sys/fs/cgroup            	   tmpfs           	optional,uid=0,gid=0,mode=0755,size=1024     0 0
none            /sys/fs/fuse/connections    fusectl          optional                                     0 0
none            /sys/kernel/debug              debugfs        optional                                     0 0
none            /sys/kernel/security           securityfs     optional                                     0 0
none            /sys/firmware/efi/efivars   efivarfs        optional                                     0 0
none            /spu                      	  spufs             gid=spu,optional                       0 0
none            /dev                      	  devtmpfs,tmpfs  mode=0755                          0 0
none            /dev/pts                  	  devpts          noexec,nosuid,gid=tty,mode=0620  0 0
none            /tmp                      	  none            defaults                                       0 0
none            /run                     		  tmpfs           noexec,nosuid,size=10%,mode=0755  0 0
none            /run/lock                 	  tmpfs           nodev,noexec,nosuid,size=5242880     0 0
none            /run/shm                  	  tmpfs           nosuid,nodev                               0 0
none            /run/user                 	  tmpfs           nodev,noexec,nosuid,size=104857600,mode=0755 0 0
none            /sys/fs/pstore            	  pstore          optional                                       0 0

and "/.systemback/etc/fstab"

Code:

 /Desktop# nano /.systemback/etc/fstab

  GNU nano 2.2.6                     File: .systemback/etc/fstab             

/dev/sda1       /media/sda1     ext4     ro,loop,noauto,noexec,nodev,noatime,noload 0 0 # by rbfstab
/dev/sda2       /media/sda2     swap     ro,noauto            0 0 # by rbfstab
/dev/sdb1       /media/sdb1     ntfs-3g  ro,loop,noauto,noexec,nodev,noatime,umask=000,show_sys_files,streams_int$
/dev/sdc1       /media/sdc1     ext4     ro,loop,noauto,noexec,nodev,noatime,noload 0 0 # by rbfstab
/dev/sdc2       /media/sdc2     swap     ro,noauto            0 0 # by rbfstab

From here I lost the trace.

So, why is /etc/fstab being automatically overwritten on a mount, even with rbfstab disabled?
What is the mount process calling?

ronells2000 · 11-15-2016, 11:03 PM

I have been working in Kali on the image with foremost, scalpel and photorec, all are recovering too many useless files (over 4 thousand files). Labeled with the extensions I'm looking for, but will not open. Using hexdump to find the header and footers has been a real learning experience, but very frustrating.

Installing my new HDD and memory upgrade, so will be busy installing everything for a bit. I will readdress the data recovery after my PC is up and running.