Theoretical NTFS Question / Data recovery after single overwrite

Hello guys

I've a simple theoretical question,
let's say I've got an 1TB HDD with an factory default set
of NTFS Partitions.
So a part for recovery and another part for data, the harddisk
wont be occupied a lot just a single windows 7 inst. + few programs
(and their data as well as some user data).

Now someone accidently executes the recovery program which is found on
many end-customer PCs (to renew the whole installation), so it comes
that all that data is overwritten... maybe also user data...

How high would be the chance (%) that one is able to recover a single
file from it?
Would such single-overwrite with an recovery installation render this
quite impossible?

cheers
Georg

------------------------------------------------------------------------------
For Developers, A Lot Can Happen In A Second.
Boundary is the first to Know...and Tell You.
Monitor Your Applications in Ultra-Fine Resolution. Try it FREE!
http://p.sf.net/sfu/Boundary-d2dvs2

ntfs filesystem will mount but not open with ntfsundelete

I have an NTFS partition -- probably created with Win2k which I can mount with
no problems on linux using the ntfs-3g tools however when I try to run
ntfsundelete on it:

# ntfsundelete -s /dev/sdc1
NTFS signature is missing.
Failed to mount '/dev/sdc1': Invalid argument
The device '/dev/sdc1' doesn't have a valid NTFS.
Maybe you selected the wrong device? Or the whole disk instead of a
partition (e.g. /dev/hda, not /dev/hda1)? Or the other way around?

It does mount fine:

# mount -r /dev/sdc1 /mnt
# ls /mnt
4d275a43cb65bc484b083111c98d  FOUND.000         My Documents
$AVG                          Google            old
bin                           Google Earth      Recycled
DrWatson                      Google Earth.lnk  System Volume Information

Any ideas why mount is working with it fine and ntfsundelete is not?

I am using ntfs-3g version 2012.1.15AR.1 on Ubuntu Precise.

------------------------------------------------------------------------------
Better than sec? Nothing is better than sec when it comes to
monitoring Big Data applications. Try Boundary one-second 
resolution app monitoring today. Free.
http://p.sf.net/sfu/Boundary-dev2dev

Restore access to more areas of a data partition?

Hello!

I get the following information on my openSUSE 12.1 system.

elfring <at> Sonne:~> LANG=C && df -h /dev/sda6 && ls -l /windows/E
Filesystem      Size  Used Avail Use% Mounted on
/dev/sda6       205G  199G  5.9G  98% /windows/E
total 4
drwxr-xr-x 1 root users    0 Jan 13 22:34 $RECYCLE.BIN
drwxr-xr-x 1 root users    0 Feb  6 15:17 31aacd3a-93f7-4085-a2ba-5257e3adc132
drwxr-xr-x 1 root users    0 Feb  6 15:02 7714ab39-6974-4986-a5bc-74f23930bd10
drwxr-xr-x 1 root users    0 Jan 24 16:08 Config.Msi
drwxr-xr-x 1 root users    0 Feb 24  2008 Corel
drwxr-xr-x 1 root users 4096 Jul 27  2010 Dokumente
drwxr-xr-x 1 root users    0 Apr 14  2006 bioscomp
drwxr-xr-x 1 root users    0 Oct  9  2010 builds
drwxr-xr-x 1 root users    0 Feb  6 15:00 c3dc762a-e2fe-4ee7-bb67-89e61f5e83f9

I am missing a few subdirectories in this directory display. They contain bigger 
files which contribute to the shown storage allocation considerably.

I assume that special permission settings prevent a complete directory listing. 
Is the NTFS-3G software capable to make the other data accessible again from 
this partition?

Regards,
Markus

------------------------------------------------------------------------------
Keep Your Developer Skills Current with LearnDevNow!

Windows chkdsk and invalid filenames

Hello!

I just ran Windows 7 SP1's chkdsk on an NTFS partition that I usually work on 
from Linux using NTFS-3G 2011.4.12.

chkdsk decided to delete a lot of filenames because they were "invalid" (that 
seems to mean they contain characters like : or ? which Windows does not 
like). Now I am in a state where I have a few dozen file1234.chk filenames and 
dir1234.chk directories, have to figure out what they contain and properly 
rename them. (At least it did not entirely delete the files...)

The NTFS-3G manual says about this in the "Windows Filename Compatibility" 
section: "[ntfs-3g] always creates new files in the POSIX namespace for 
maximum portability and interoperability reasons. [...] This is perfectly 
legal on Windows, [...]"

Now my questions/ideas to prevent such mess in the future:
* Is it possible to instruct ntfs-3g to create both, a Windows and a POSIX 
filename?
* Can it map "invalid" characters of the POSIX filename to e.g. underscores _ 
in the Windows filename? Does "windows_names" do this?
* Is it possible to put the whole partition into POSIX mode, so that Windows 
and tools like chkdsk would let those filenames alone?
* Is it possible that there are filenames on my disk, which are not in the 
POSIX namespace, but not conforming to the Windows namespace, either? How 
could I fix this?
* Is there a free (preferably FOSS) chkdsk tool that behaves more sane, e.g. 
by renaming the filenames to such with invalid characters replaced by 
underscores _?
* Is there any other way I can prevent the problem in the future?

[PATCH] fix : consider a failure in ntfs_umount as a probe failure as well.

As it happens, even though the device reports itself as accessible in R/W,
it might not be (case in point, a loop device set up with `losetup -r`); in
this case, ntfs_open() wouldn't report any error, while ntfs_umount() would
fail with an I/O error (as sync would fail).

In such a situation, the probe has to be considered a failure.

Signed-off-by: Diego Elio Pettenò <flameeyes <at> flameeyes.eu>
---
 src/ntfs-3g.probe.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/src/ntfs-3g.probe.c b/src/ntfs-3g.probe.c
index 592abd7..ed9e477 100644
--- a/src/ntfs-3g.probe.c
+++ b/src/ntfs-3g.probe.c
@@ -74,7 +74,8 @@ static int ntfs_open(const char *device)
 	if (!vol)
 		ret = ntfs_volume_error(errno);

-	ntfs_umount(vol, FALSE);
+	if ( ret == 0 && ntfs_umount(vol, FALSE) == -1 )
+		ret = ntfs_volume_error(errno);

 	return ret;
 }
--

-- 
1.7.8

------------------------------------------------------------------------------

[PATCH] Add a --quiet option to ntfsclone to suppress progress bars

Hi,

I've recently started using ntfsclone in a couple of scripts. 
Unfortunately, the lack of any way to suppress the progress bars makes 
this very inconvenient, since it produces a huge amount of messy output.

This patch adds a --quiet option that turns off the progress bars.  It 
also turns it off if it detects that the msg_out stream is not connected 
to a tty.  The output is otherwise unchanged.

A fix to the documentation is in the works.

These changes can alternatively be pulled from the quiet_option branch 
at git@...:ligne/ntfs-3g.git

Please do not hesitate to comment if you have any issues.  But hopefully 
this should all be fairly uncontroversial stuff 

Regards,

--Matt

--

-- 
Matthew Boyle, Systems Administrator, CoreFiling Limited
Telephone: +44-1865-203192  Website: http://www.corefiling.com

diff --git a/ntfsprogs/ntfsclone.c b/ntfsprogs/ntfsclone.c
index 7d56cc6..b60120f 100644
--- a/ntfsprogs/ntfsclone.c

NTFS-3G + NTFSPROGS 2011.10.9-RC Release Candidate

Greetings,

We are happy to announce a release candidate which includes minor 
and major bug fixes, and enhancements as follows:

ntfs-3g: fixed device path canonicalization for use by devmapper
ntfs-3g: fixed setting DOS names when defined with lower-case chars
ntfs-3g: fixed attribute flags controlling recursive writes
ntfs-3g: fixed compilation on OpenIndiana
ntfs-3g: fixed options parsing on OSes with no extended attributes
ntfs-3g: fixed relatime as a default mount option
ntfs-3g: fixed endless recursion when MFT extents are described by themselves
ntfs-3g: fixed the description of inherit option
ntfs-3g: fixed overwriting a truncated file
ntfs-3g: fixed truncation of DOS file names (12 ntfschars, not 12 utf8 chars)
ntfs-3g: fixed the setting of attributes by secaudit (index not synced)
ntfs-3g: faster compression
ntfs-3g: new option delay_mtime to delay updates of mtime+ctime
ntfsfix: new option to clear the list of bad sectors
ntfsfix: fixed compilation on Sparc
ntfsfix: fixed a bug causing a segmentation violation
ntfsfix: repair self-located MFT data bug
ntfsresize: implemented expanding runlists
ntfsresize: updated the description of the -f option
ntfsresize: expand an NTFS volume downwards
ntfsclone: backup bootsector not be to accounted for
ntfsclone: creating/restoring a metadata image
ntfsundelete: try to recover the file name when undeleting
ntfsundelete: use inode number to name unnamed files

NTFS debugging question (corrupted MFT)

Hi guys

Im a long time Linux/BSD/UNIX user, I've a question to an NTFS issue at
this moment.
I dont expect any fixups or wonders, I'd just like to know what the
debugging messages exacly mean or if they can be put in a specific area.

My situation is that I've an HDD at hand which has 3 partitions.
However only the first one is interesting.
Neither can I access the file system via MS Windows nor can I perform a
chkdsk.

I've checked the bootcode so far, thats all well - the error lies
somewhere within the MFT itself.
But what I dont understand is why I cannot access the volume by the MFT
mirror (testdisk just crashes if I want to retrieve a file list).

== START OF INFORMATION SECTION ===
Model Family:     Western Digital Caviar SE Serial ATA family
Device Model:     WDC WD2500JD-22HBB0
Serial Number:    WD-WCAL72726703
Firmware Version: 08.02D08
User Capacity:    250.059.350.016 bytes
Device is:        In smartctl database [for details use: -P show]
ATA Version is:   6
ATA Standard is:  Exact ATA specification draft version not indicated
Local Time is:    Tue Aug 30 01:53:36 2011 CEST
SMART support is: Available - device has SMART capability.
SMART support is: Enabled

Re: NTFS3G ported to MorphOS

> Message du 19/08/11 12:47
> De : "Leif Salomonsson" 
> A : ntfs-3g-devel <at> lists.sourceforge.net
> Copie à : 
> Objet : [ntfs-3g-devel] NTFS3G ported to MorphOS
> 
> Hello,
> 
> I have ported NTFS-3G to MorphOS operating sytem, btw.
> Using a reimplementation of FUSE API.
> http://blubbedev.net/filesysbox/

A nice achievement.

Regards

Jean-Pierre

------------------------------------------------------------------------------
Get a FREE DOWNLOAD! and learn more about uberSVN rich system, 
user administration capabilities and model configuration. Take 
the hassle out of deploying and managing Subversion and the 
tools developers use with it. http://p.sf.net/sfu/wandisco-d2d-2
_______________________________________________
ntfs-3g-devel mailing list
ntfs-3g-devel <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/ntfs-3g-devel

Re: ntfs-3g_common.c bug

> Message du 19/08/11 12:46
> De : "Leif Salomonsson" 
> A : ntfs-3g-devel <at> lists.sourceforge.net
> Copie à : 
> Objet : [ntfs-3g-devel] ntfs-3g_common.c bug
> 
> Hello,
> 
> In ntfs3g 2011.04.12 the file ntfs-3g_common.c
> has a preprocessor directive at line 61: #ifdef HAVE_SETXATTR
> which is wrong as it removes the rest of the source if HAVE_SETXATTR
> is not set.
> 
> Regards,
> Leif

Thanks for reporting.

This is a known bug, fixed in recent (advanced) versions.

Regards

Jean-Pierre 

------------------------------------------------------------------------------
Get a FREE DOWNLOAD! and learn more about uberSVN rich system, 
user administration capabilities and model configuration. Take 
the hassle out of deploying and managing Subversion and the 
tools developers use with it. http://p.sf.net/sfu/wandisco-d2d-2
_______________________________________________

NTFS3G ported to MorphOS

Hello,

I have ported NTFS-3G to MorphOS operating sytem, btw.
Using a reimplementation of FUSE API.
http://blubbedev.net/filesysbox/

Regards,
Leif

------------------------------------------------------------------------------
Get a FREE DOWNLOAD! and learn more about uberSVN rich system, 
user administration capabilities and model configuration. Take 
the hassle out of deploying and managing Subversion and the 
tools developers use with it. http://p.sf.net/sfu/wandisco-d2d-2