Hi guys
Im a long time Linux/BSD/UNIX user, I've a question to an NTFS issue at
this moment.
I dont expect any fixups or wonders, I'd just like to know what the
debugging messages exacly mean or if they can be put in a specific area.
My situation is that I've an HDD at hand which has 3 partitions.
However only the first one is interesting.
Neither can I access the file system via MS Windows nor can I perform a
chkdsk.
I've checked the bootcode so far, thats all well - the error lies
somewhere within the MFT itself.
But what I dont understand is why I cannot access the volume by the MFT
mirror (testdisk just crashes if I want to retrieve a file list).
== START OF INFORMATION SECTION ===
Model Family: Western Digital Caviar SE Serial ATA family
Device Model: WDC WD2500JD-22HBB0
Serial Number: WD-WCAL72726703
Firmware Version: 08.02D08
User Capacity: 250.059.350.016 bytes
Device is: In smartctl database [for details use: -P show]
ATA Version is: 6
ATA Standard is: Exact ATA specification draft version not indicated
Local Time is: Tue Aug 30 01:53:36 2011 CEST
SMART support is: Available - device has SMART capability.
SMART support is: Enabled
The hdd is absolutly ok, no badblocks or any kind of corruption (though
already a bit older).
I've tested it twice, I also grab a whole copy of the first partition
already.
I'll attach the mount.ntfs-3g debugging log.
kali ~ # ntfs-3g --version
ntfs-3g 2011.4.12 external FUSE 28
Eventually I'll recover some files by RAW scanning, however I still
would like to know if its possible to fix this (or not).
cheers
--
Georg Bege <[email protected]>
!DSPAM:4e5c273d994911767613724!
kali ~ # ntfs-3g -o ro,debug /dev/sdg1 /mnt
ntfs_pread(): pos 0, count 512
Beginning bootsector check.
Checking OEMid, NTFS signature.
Checking bytes per sector.
Checking sectors per cluster.
Checking cluster size.
Checking reserved fields are zero.
Checking clusters per mft record.
Checking clusters per index block.
Bootsector check completed successfully.
SectorSize = 0x200
SectorSizeBits = 9
SectorsPerCluster = 0x8
NumberOfSectors = 248814656
MFT LCN = 786432
MFTMirr LCN = 16
ClusterSize = 0x1000
ClusterSizeBits = 12
ClustersPerMftRecord = 0xfffffff6
MftRecordSize = 0x400
MftRecordSizeBits = 10
ClustersPerINDXRecord = 0x1
INDXRecordSize = 0x1000
INDXRecordSizeBits = 12
Used BLKBSZSET to set block size to 512 bytes.
mft_zone_pos = 0xc0000
mft_zone_start = 0xc0000
mft_zone_end = 0x475271
data1_zone_pos = 4674161
data2_zone_pos = 0
ntfs_pread(): pos 3221225472, count 1024
ntfs_mst_post_read_fixup(): Entering
ntfs_attr_lookup(): Entering for attribute type 0x20
ntfs_attr_find(): attribute type 0x20.
ntfs_attr_readall(): Entering
ntfs_attr_open(): Entering for inode 0, attr 0x10.
ntfs_attr_lookup(): Entering for attribute type 0x10
ntfs_attr_find(): attribute type 0x10.
ntfs_attr_pread(): Entering for inode 0 attr 0x10 pos 0 count 72
ntfs_attr_lookup(): Entering for attribute type 0x10
ntfs_attr_find(): attribute type 0x10.
ntfs_attr_open(): Entering for inode 0, attr 0x80.
ntfs_attr_lookup(): Entering for attribute type 0x80
ntfs_attr_find(): attribute type 0x80.
ntfs_attr_lookup(): Entering for attribute type 0x80
ntfs_attr_find(): attribute type 0x80.
ntfs_mapping_pairs_decompress(): Entering
ntfs_mapping_pairs_decompress_i(): Entering for attr 0x80.
Mapping pairs array successfully decompressed:
NTFS-fs DEBUG: Dumping runlist (values in hex):
VCN LCN Run length
0 786432 43008
43008 LCN_ENOENT 0 (runlist end)
ntfs_attr_lookup(): Entering for attribute type 0x80
ntfs_attr_find(): attribute type 0x80.
ntfs_attr_open(): Entering for inode 0, attr 0xb0.
ntfs_attr_lookup(): Entering for attribute type 0xb0
ntfs_attr_find(): attribute type 0xb0.
ntfs_inode_real_open(): Entering for inode 1
ntfs_mft_record_read(): Entering for inode 1
ntfs_mft_records_read(): inode 1
ntfs_attr_mst_pread(): Entering for inode 0x0, attr type 0x80, pos 0x400.
ntfs_attr_pread(): Entering for inode 0 attr 0x80 pos 1024 count 1024
ntfs_attr_find_vcn(): Entering for inode 0x0, attr 0x80, vcn 0
ntfs_attr_pread_i(): Reading 1024 bytes from vcn 0, lcn 786432, ofs 1024.
ntfs_pread(): pos 3221226496, count 1024
ntfs_mst_post_read_fixup(): Entering
Incomplete multi-sector transfer: magic: 0x44414142 size: 1024 usa_ofs: 48 usa_count: 1 data: 4347 usn: 4331: Eingabe-/Ausgabefehler
Record 1 has no FILE magic (0x44414142)
Failed to open inode $MFTMirr: Eingabe-/Ausgabefehler
Failed to load $MFTMirr: Eingabe-/Ausgabefehler
ntfs_inode_real_close(): Entering for inode 0
Failed to mount '/dev/sdg1': Eingabe-/Ausgabefehler
NTFS is either inconsistent, or there is a hardware fault, or it's a
SoftRAID/FakeRAID hardware. In the first case run chkdsk /f on Windows
then reboot into Windows twice. The usage of the /f parameter is very
important! If the device is a SoftRAID/FakeRAID then first activate
it and mount a different device under the /dev/mapper/ directory, (e.g.
/dev/mapper/nvidia_eahaabcc1). Please see the 'dmraid' documentation
for more details.
------------------------------------------------------------------------------
Special Offer -- Download ArcSight Logger for FREE!
Finally, a world-class log management solution at an even better
price-free! And you'll get a free "Love Thy Logs" t-shirt when you
download Logger. Secure your free ArcSight Logger TODAY!
http://p.sf.net/sfu/arcsisghtdev2dev
_______________________________________________
ntfs-3g-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/ntfs-3g-devel
