headers
Brian | 10 Apr 2012 14:11
Picon

ntfs filesystem will mount but not open with ntfsundelete

I have an NTFS partition -- probably created with Win2k which I can mount with
no problems on linux using the ntfs-3g tools however when I try to run
ntfsundelete on it:

# ntfsundelete -s /dev/sdc1
NTFS signature is missing.
Failed to mount '/dev/sdc1': Invalid argument
The device '/dev/sdc1' doesn't have a valid NTFS.
Maybe you selected the wrong device? Or the whole disk instead of a
partition (e.g. /dev/hda, not /dev/hda1)? Or the other way around?

It does mount fine:

# mount -r /dev/sdc1 /mnt
# ls /mnt
4d275a43cb65bc484b083111c98d  FOUND.000         My Documents
$AVG                          Google            old
bin                           Google Earth      Recycled
DrWatson                      Google Earth.lnk  System Volume Information

Any ideas why mount is working with it fine and ntfsundelete is not?

I am using ntfs-3g version 2012.1.15AR.1 on Ubuntu Precise.

------------------------------------------------------------------------------
Better than sec? Nothing is better than sec when it comes to
monitoring Big Data applications. Try Boundary one-second 
resolution app monitoring today. Free.
http://p.sf.net/sfu/Boundary-dev2dev
(Continue reading)

Permalink | Reply | 1 comment |
headers
Jean-Pierre André | 10 Apr 2012 16:07
Picon

Re: ntfs filesystem will mount but not open with ntfsundelete

Hi,

Brian wrote:
> I have an NTFS partition -- probably created with Win2k which I can mount with
> no problems on linux using the ntfs-3g tools however when I try to run
> ntfsundelete on it:
>
> # ntfsundelete -s /dev/sdc1
> NTFS signature is missing.
> Failed to mount '/dev/sdc1': Invalid argument
> The device '/dev/sdc1' doesn't have a valid NTFS.
> Maybe you selected the wrong device? Or the whole disk instead of a
> partition (e.g. /dev/hda, not /dev/hda1)? Or the other way around?
>
> It does mount fine:
>
> # mount -r /dev/sdc1 /mnt
> # ls /mnt
> 4d275a43cb65bc484b083111c98d  FOUND.000         My Documents
> $AVG                          Google            old
> bin                           Google Earth      Recycled
> DrWatson                      Google Earth.lnk  System Volume Information
>
> Any ideas why mount is working with it fine and ntfsundelete is not?
>
> I am using ntfs-3g version 2012.1.15AR.1 on Ubuntu Precise.

The error you get results from a check done in a
library which is supposed to be common to both
situations. Maybe you check the libraries used :
(Continue reading)

Permalink | Reply | 0 comments |
headers
Georg Bege | 16 Apr 2012 16:32
Picon

Theoretical NTFS Question / Data recovery after single overwrite

Hello guys

I've a simple theoretical question,
let's say I've got an 1TB HDD with an factory default set
of NTFS Partitions.
So a part for recovery and another part for data, the harddisk
wont be occupied a lot just a single windows 7 inst. + few programs
(and their data as well as some user data).

Now someone accidently executes the recovery program which is found on
many end-customer PCs (to renew the whole installation), so it comes
that all that data is overwritten... maybe also user data...

How high would be the chance (%) that one is able to recover a single
file from it?
Would such single-overwrite with an recovery installation render this
quite impossible?

cheers
Georg

------------------------------------------------------------------------------
For Developers, A Lot Can Happen In A Second.
Boundary is the first to Know...and Tell You.
Monitor Your Applications in Ultra-Fine Resolution. Try it FREE!
http://p.sf.net/sfu/Boundary-d2dvs2
Permalink | Reply | 1 comment |
headers
Jean-Pierre André | 16 Apr 2012 21:12
Picon

Re: Theoretical NTFS Question / Data recovery after single overwrite

Hi,

Georg Bege wrote:
> Hello guys
>
> I've a simple theoretical question,
> let's say I've got an 1TB HDD with an factory default set
> of NTFS Partitions.
> So a part for recovery and another part for data, the harddisk
> wont be occupied a lot just a single windows 7 inst. + few programs
> (and their data as well as some user data).
>
> Now someone accidently executes the recovery program which is found on
> many end-customer PCs (to renew the whole installation), so it comes
> that all that data is overwritten... maybe also user data...
>
> How high would be the chance (%) that one is able to recover a single
> file from it?
> Would such single-overwrite with an recovery installation render this
> quite impossible?

Windows only uses a few percent of a 1TB drive,
hence most of your data will still present after the
setting to factory default, though uneasy to recover.

You might prefer /dev/random before giving away
your old computer.

Jean-Pierre
(Continue reading)

Permalink | Reply | 0 comments |

Gmane