[tjwhite]

Hi,

Firstly, let me say that I am a newbie to Linux so excuse me if I sound a little ignorant. I was referred here by joeten on the Windows forum. Please go here, http://forums.techguy.org/windows-vi...ml#post6966906 for my original post.

Here's the story, I have been having a lot of trouble with my girlfriend's computer after it crashed while I was attempting to remove a virus. Now, after starting the computer, Windows fails to load and I get a blue screen with error code STOP: c000021a.Joeten recommended that I use Ubuntu to attempt to recover some important files from the harddrive before I refomatted the drive. He sent me detailed instructions, however I am having difficulty on one step.

Here is what I wrote on the other thread:

I've been following the instructions you linked me to and unfortunately, I have a problem. When I go to the computer window in Ubuntu there is no reference to the computer's hard drive. The only choices are:
-Cd Drive
-MEDIADIRECT
-OS
-Filesystem

From there I went to the terminal and attempted to mount the drive. I used the "fdisk -l" command to show the list of drives. I believe it is telling me that /dev/sda3 is my drive as it is the one with the most data on it. When I run the command to mount the drive I get the following message:

"ntfs attr pread i: ntfs pread failed: input/output error. Failed to read NTFS Bitmap: Input/output error. SoftRAID/FakeRAID hardware. In the first case run chkdsk /f on Windows then reboot into Windows twice. The usage of the /f parameter is very important! If the device is a SoftRAID/FakeRAID then first activate it and mount a different device under the /dev/mapper/ directory. Please see the "dmraid" documentation."

One thing I forgot to mention before is that I am somehow able to mount a 5th drive which I believe is the Windows recovery drive. However, there doesn't seem to be any of the files I need on this drive. Sorry if this is a little vague.
So, because of this error, does this mean that I am stuck with a dead hard drive. Is it at all possible to get any of the files off the drive? I would really appreciate any help you can offer.

Thanks a lot.

[prunejuice]

I've always found Ubuntu too complicated (although, in fact, It's my main OS) to mount Windows drives OOTB.

Puppy Linux (which is a relatively small download) has never given me problems identifying and mounting Windows drives. I would try that.

http://www.puppylinux.com/

[lotuseclat79]

Hi tjwhite,

Welcome to TSG!

First, give us some context for this problem. As I understand it, you have Windows Vista installed. Is Ubuntu also installed, and if so, is it a dual-boot scheme, or is Ubuntu installed in a folder inside of Windows Vista?

If you can download an Ubuntu Live CD from either http://shipit.ubuntu.com or http://shipit.kubuntu.org and burn it to a CD, then boot from it (assuming you have booting from CD before booting from hard drive in the boot order of your BIOS) - then I would try the command:
$ sudo fdisk -l
from the default ubuntu user account, or if from the root account:
$ sudo -i
# fdisk -l

If you can post the full output of the fdisk -l command here, we can then tell you how to properly mount the Windows hard drive.

-- Tom

[tjwhite]

Hi Tom,

Thanks for getting back to me. A little about the computer first. It is a windows vista computer that fails to boot after I was attempting to run a virus scan. I now get a blue screen no matter how I attempt to boot the computer.

No, Ubuntu is not installed on the computer. As per the advice on the previous thread I downloaded it and burnt it to a boot cd. I can easily get into Ubuntu by hitting F12 while the computer is booting up. While I am confident using Windows, I am a complete newbie with Linux.

I ran the $ sudo fdisk -l command in the terminal and got this read out. Not sure what exactly you need so I will type it all out.

Disk /dev/sda: 250.0 GB 250059330016
255 heads, 63 sectors/track, 30401 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Disk identifier: 0x00000080

Device Boot Start End Blocks Id System
/dev/sda1 1 5 40131 de Dell Utility
/dev/sda2 6 1280 10240000 7 HPFS/NTFS
/dev/sda3 * 1280 30075 231295156 7 HPFS/NTFS
/dev/sda4 30075 30402 2620416 f W95 Ext'd(LBA)
/dev/sda5 30076 30402 2619392 dd Unknown


Ok so hopefully that helps. So you know, in my previous attempts to mount the drive, I was able to get it to mount one other drive (I believe sda2). I believe from looking at the files contained on this new drive that it may be the Windows recovery drive (on the computer I am using now there is a C: drive and a recovery drive D. However, there doesn't seem to be any of the files I am looking to recover on here. Not sure if that means anything.

Sorry about the long post and please let me know if you need any other information. Thank you again for your help.

[saikee]

The partition table look encouraging to me because the Linux OS did not complain.

I would do everything in the terminal.

You can look at the files inside sda3 by commands

mkdir /mnt/sda3
mount /dev/sda3 /mnt/sda3
ls /mnt/sda3

If the above is successful then plug a USB pen drive. It would be called sdb1 and most probably in Fa32 format if bigger than 2 Gb. You can try to copy the folder across.

[saikee]

A sample run

saikee@saikee-desktop-1:~$ sudo su

first get root privilege (equivalent to becoming an admin in MS Windows). Then list all the partitions of all the disks.
My Xp is in sda1 as it is a NTFS partition and the "*" means it is bootable (MS Windows calls it active)

root@saikee-desktop-1:/home/saikee# fdisk -l

Disk /dev/sda: 500.1 GB, 500107862016 bytes
255 heads, 63 sectors/track, 60801 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Disk identifier: 0xbe153241

   Device Boot      Start         End      Blocks   Id  System
/dev/sda1   *           1        4936    39648388+   7  HPFS/NTFS
/dev/sda2           12159       24316    97659135   17  Hidden HPFS/NTFS
/dev/sda3           24317       36598    98655165    5  Extended
/dev/sda4           36599       60801   194410597+  83  Linux
/dev/sda5           24317       24438      979933+  82  Linux swap / Solaris
/dev/sda6           24439       25654     9767488+  83  Linux
/dev/sda7           25655       26870     9767488+  83  Linux
/dev/sda8           26871       28086     9767488+  83  Linux
/dev/sda9           28087       29302     9767488+  83  Linux
/dev/sda10          29303       30518     9767488+  83  Linux
/dev/sda11          30519       31734     9767488+  83  Linux
/dev/sda12          31735       32950     9767488+  83  Linux
/dev/sda13          32951       34166     9767488+  83  Linux
/dev/sda14          34167       35382     9767488+  83  Linux
/dev/sda15          35383       36598     9767488+  83  Linux

Disk /dev/sdb: 1500.3 GB, 1500301910016 bytes
255 heads, 63 sectors/track, 182401 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Disk identifier: 0x18e26979

   Device Boot      Start         End      Blocks   Id  System
/dev/sdb1   *           1      182401  1465136001    7  HPFS/NTFS

I decide to copy folder c:\Document and settings\saikee to the partition sdb1. So I first mount sda1 and then list its content out.

root@saikee-desktop-1:/home/saikee# mkdir /mnt/sda1
mkdir: cannot create directory `/mnt/sda1': File exists
root@saikee-desktop-1:/home/saikee# mount /dev/sda1 /mnt/sda1
root@saikee-desktop-1:/home/saikee# ls /mnt/sda1
AUTOEXEC.BAT            sda9.bin           sqmdata15.sqm
bin1.dat                sdb10.bin          sqmdata16.sqm
Boot.BAK                sdb11.bin          sqmdata17.sqm
boot.ini                sdb12.bin          sqmdata18.sqm
boot.ini~               sdb12_LG3D.bin     sqmdata19.sqm
BOOTSECT.BAK            sdb13.bin          sqmnoopt00.sqm
CONFIG.SYS              sdb14.bin          sqmnoopt01.sqm
Documents and Settings  sdb14_Sabayon.bin  sqmnoopt02.sqm
drawing1.scr            sdb15.bin          sqmnoopt03.sqm
Inetpub                 sdb5.bin           sqmnoopt04.sqm
IO.SYS                  sdb6.bin           sqmnoopt05.sqm
LogiSetup.log           sdb7.bin           sqmnoopt06.sqm
logs                    sdb8.bin           sqmnoopt07.sqm
menu.lst~               sdb9.bin           sqmnoopt08.sqm
MSDOS.SYS               sqmdata00.sqm      sqmnoopt09.sqm
NTDETECT.COM            sqmdata01.sqm      sqmnoopt10.sqm
ntldr                   sqmdata02.sqm      sqmnoopt11.sqm
pagefile.sys            sqmdata03.sqm      sqmnoopt12.sqm
Program Files           sqmdata04.sqm      sqmnoopt13.sqm
$RECYCLE.BIN            sqmdata05.sqm      sqmnoopt14.sqm
RECYCLER                sqmdata06.sqm      sqmnoopt15.sqm
sda10.bin               sqmdata07.sqm      sqmnoopt16.sqm
sda11.bin               sqmdata08.sqm      sqmnoopt17.sqm
sda12.bin               sqmdata09.sqm      sqmnoopt18.sqm
sda13.bin               sqmdata10.sqm      sqmnoopt19.sqm
sda15.bin               sqmdata11.sqm      System Volume Information
sda6.bin                sqmdata12.sqm      uniTvTv.log
sda7.bin                sqmdata13.sqm      WINDOWS
sda8.bin                sqmdata14.sqm      xBoot

The above confirms it is a MS Windows partition. The boot.ini and NTLDR indicate that it can only be either a W2k or Xp. I then list the internal content. I did this by typing

ls /mnt/sda1/Do

and then hit the "tap" key to let Linux find the matching file name. Linux return this to me

 ls /mnt/sda1/Documents\ and\ Settings/

so I just hit enter to see the directory listing inside

 
root@saikee-desktop-1:/home/saikee# ls /mnt/sda1/Documents\ and\ Settings/
All Users  Default User  LocalService  NetworkService  saikee 

I have found the folder "saikee" I want. So I mount sdb1 for copying the folder saikee

root@saikee-desktop-1:/home/saikee# mkdir /mnt/sdb1
mkdir: cannot create directory `/mnt/sdb1': File exists
root@saikee-desktop-1:/home/saikee# mount /dev/sdb1 /mnt/sdb1
root@saikee-desktop-1:/home/saikee# cp -R /mnt/sda1/Documents\ and\ Settings/saikee/*  /mnt/sdb1/

Now the Ubuntu is duplicating my c:\Documents and Settings\saikee folder to sdb1. A over 14Gb was transferred.

Remember in Linux the separator used is "/" which is exactly opposite to MS Windows' "\".

[TerryNet]

After booting the live CD you clicked on Places and then on Computer, right?

You have two partitions on your hard drive; the one you want is either MEDIADIRECT or OS. Double click on one of those; if it's the one where Windows is installed you should see the same folders and files you'd see in C: with Windows.

I'm using Ubuntu 9.04; you may have 9.10 Beta, but it should be the same.

I have confidence that saikee's instructions will work, but try the above if you prefer GUI.

[tjwhite]

Hi everyone,

Thanks for all the replies. I tried your suggestions and I'm having a couple problems. First, Terrynet, I did try going to Computer then Places. I get both of the drives you mentioned MEDIADIRECT and OS. I can access the MediaDirect file just fine. It has files in there such as "Documents and Settings", "Program Files" and "Windows", however, it does not seem to be the C: Drive.

For instance, if I go to Documents and Settings > Administrator > My Documents, then there are none of the documents that I would normally find in this folder here. This applies to all files on this drive.

I cannot access the OS Drive at all. When I click on it it tells me that it cannot mount the volume. The details show this message:

"ntfs attr pread i: ntfs pread failed: input/output error. Failed to read NTFS Bitmap: Input/output error NTFS is either inconsistent, or there is a hardware fault, or it's a SoftRAID/FakeRAID hardware. In the first case run chkdsk /f on Windows then reboot into Windows twice. The usage of the /f parameter is very important! If the device is a SoftRAID/FakeRAID then first activate it and mount a different device under the /dev/mapper/ directory, (e.g. /dev/mapper/ nvidia_eahaabcc1). Please see the "dmraid" documentation."


Ok then I tried Saikee's idea. This gave me essentially the same result. In the terminal, after typing "/dev/sda3 /mnt/sda3" I get the same message as above.

I'm beginning to think the harddrive is fried. Is there anyway to get this data back?

Thank you all again for your help and patience with this.

Tom

[saikee]

If the data is valuable I would clone the drive and conduct my salvage work on the cloned copy which has no corruption. To do that you need a hard disk exactly equal to the bad disk or just larger.

You do it with any Linux and Ubuntu Live CD will be fine with just one line of command

dd if=/dev/sda of=/dev/sdb bs=32256

.
The hard disk to be cloned is sdb which has to have more sectors than the bad disk. It can be either 2.5" or 3.5" size, external or internal, IDE or Sata, eSata or USB.

Here is the thread describing it.

A MS Windows can become unbootable if anyone of it major system files has been corrupted. A hard disk hardware failure can also cause similar problem and will getting progressively worst every time the hard disk is put on spin. When it is cloned the corrupted data become holes in the new disk but the rest of the filing system should be sound and healthy.

[tjwhite]

Ok great, I will look into picking up a external hard drive tonight. Been meaning to do that for ages anyway. Just to be sure, will I be able to use the external for other things (such as my own computer) after I recover the files I need from the corrupted disk? I just want to make sure it won't corrupt the new drive as you mentioned before that it would create holes in the drive.

Also, in your opinion is the harddrive in the computer now shot? I was wondering if it would be possible to wipe and completely reformat the drive once I recover the important files. I have done this before on another computer and it helped it a lot. Thanks for the continued assistance with this.

[lotuseclat79]

Hi tjwhite,

I don't know if saikee already mentioned this, but its always a good idea to separate any Windows system installation in a separate partition independent from the data (e.g. Documents and Settings, etc.) when you divide up the partitions on your new external hard drive.

-- Tom

[saikee]

On a hardware if the OS does not complains about the partition table and able to read most of the content then the disk may be still good. If there is a hardware corruption in a spot within the hard disk, say a dust particle trapped in the read/write head and scrach the platter, then every OS will try to read it repeated and only stops after many attempts. To cater for such eventuality it is recommend to instruct command "dd" to ignore errors and continue. This can be done by adding the parameter conv=noerror like

dd if=/dev/sda of=/dev/sdb bs=32256 conv=noerror

In many case if there is no hardware fault the owner can replace the hard disk with the cloned copy and restore the original operating system.

The original disk if corrupted hardware wise will not be reliable in a long run and should be used with caution. It can be used for normal storage. Just member when it takes longer and longer to retrieve the files then the days for it to remain operational are numbered.

When you clone an internal hard disk to an external hard disk it will not boot if it is a MS Windows (the only exception is by eSata connection) and so you can use it only as a storage unit. With a healthy disk the corruption will not be copied over if the parts of the files could not be read and transferred. In any case you need to run the original operating system to spread the corruption/infection. Therefore using it as a storage unit and operating it with a Linux you are nearly bomb proof.

The corrupted files in the new disk are just files with missing bits. In my experience I would be surprised if you can't recover 99.99% of what you got as long as the Linux does not complain about the partition table and able to read the hard disk.

-------------------------------------------

The earlier link I provided is to clone the whole disk. It takes a bit longer but is a lot easier because the user needs not bother with partition table, filing systems, partition sizes, locations, types, boot loader, etc ...... I highly recommend it for the MS Windows users because they will not be as knowledgeable on hard disks and partitions as the Linux users. So the strategy is why bother with the details, just clone the whole disk.

Also if one wishes to use the clone in place of the original hard disk just buy a new raw hard disk (larger in size), put it in an enclosure, hook up to a USB port and carry out the cloning with the above command in the post without need to do anything on the new hard disk. Once cloned remove the existing hard disk and put in its place the cloned copy. It will work exactly like the original. Cast iron guarantee!

The beauty of this approach is one can take the cloned system to pieces to repair it or make a mess to experiement with it and it is still alright because the original is ready for a 2nd , 3rd, 4th.... cloning.

In cloning one cannot reproduce anything other than a 100% mirror image of the original disk. The first sector to be written on the new disk is the MBR of the original hard disk. In it there is the partition table. Therefore a raw hard disk can be used without the need of being partitioned.

[TerryNet]

It has files in there such as "Documents and Settings", "Program Files" and "Windows", however, it does not seem to be the C: Drive.

It is the partition that Windows would call the C: drive if you booted into the Windows that was installed on it. Not surprising that saikee's method gives the same results.

For instance, if I go to Documents and Settings > Administrator > My Documents, then there are none of the documents that I would normally find in this folder here.

I wouldn't expect somebody to use the special Administrator account. Far better to use a regular User account (whether administrative or restricted type) and save Administrator for emergencies.

I hope those other ideas that have been suggested help you recover the data.

[tjwhite]

Wow, getting a lot of good help on this one. Ok, I picked up a external hard drive and I have been trying to copy over the data. Here is what I get when I input "dd if=/dev/sda of=/sdb bs32256"...

dd: writing '/sdb': No space left on device
48226+0 records in
48225+0 records out
1555558400 bytes (1.6 GB) copied, 26.8519 s, 57.9 MB/s

This is very strange as it only took a few seconds for that to come up and I'm almost positive nothing was copied. I have checked the external drive for any new files and nothing was copied.

I think I'm missing something...

[saikee]

Post here the output of

sudo fdisk -l