Hi Georg, Georg Bege wrote: > Hi guys > > Im a long time Linux/BSD/UNIX user, I've a question to an NTFS issue at > this moment. > I dont expect any fixups or wonders, I'd just like to know what the > debugging messages exacly mean or if they can be put in a specific area. >
From your debugging log : > ntfs_mst_post_read_fixup(): Entering > Incomplete multi-sector transfer: magic: 0x44414142 size: 1024 usa_ofs: > 48 usa_count: 1 data: 4347 usn: 4331: Eingabe-/Ausgabefehler > Record 1 has no FILE magic (0x44414142) > Failed to open inode $MFTMirr: Eingabe-/Ausgabefehler > Failed to load $MFTMirr: Eingabe-/Ausgabefehler > This means that the MFTMirr record failed a consistency check : the last bytes of a record contain a value intended to check whether the record was entirely written. It was 4347 instead of the expected 4331. What appears to be wrong is the description of the mirror within the MFT. The mirror itself could be correct. > My situation is that I've an HDD at hand which has 3 partitions. > However only the first one is interesting. > Neither can I access the file system via MS Windows nor can I perform a > chkdsk. > > I've checked the bootcode so far, thats all well - the error lies > somewhere within the MFT itself. > But what I dont understand is why I cannot access the volume by the MFT > mirror (testdisk just crashes if I want to retrieve a file list). > The MFT mirror only contains data for four important files, this is not enough to recover the user files. However it contains a copy of its own description, so you might try to copy to the MFT. Assuming the boot sector is correct, the MFT is at cluster 786432 and the copy at cluster 16 (do not copy more than one cluster, you would overwrite the root directory). dd if=DEVICE of=DEVICE seek=786432 skip=16 bs=4096 count=1 (DEVICE being the partition name). Of course, you should first save the first cluster of the MFT and mirror (and compare them). dd if=DEVICE of=backup-mft skip=786432 bs=4096 count=1 dd if=DEVICE of=backup-mirror skip=16 bs=4096 count=1 The ntfsprogs tool ntfsfix tries to fix any inconsistency preventing a partition to be mounted. I am not sure it would help in this specific situation. Hope this helps. Regards Jean-Pierre ------------------------------------------------------------------------------ Special Offer -- Download ArcSight Logger for FREE! Finally, a world-class log management solution at an even better price-free! And you'll get a free "Love Thy Logs" t-shirt when you download Logger. Secure your free ArcSight Logger TODAY! http://p.sf.net/sfu/arcsisghtdev2dev _______________________________________________ ntfs-3g-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/ntfs-3g-devel
