Hello Thanks for ya kind response, yeah I tried ntfsfix - no luck however. I performed the steps you suggested (Im working with the local copy of the partition here):
kali Hoda_GmbH # dd if=./wd250_medion.pt1 of=backup-mft.pt1 skip=786432 bs=4096 count=1 1+0 Datensätze ein 1+0 Datensätze aus 4096 Bytes (4,1 kB) kopiert, 0,0529637 s, 77,3 kB/s kali Hoda_GmbH # dd if=./wd250_medion.pt1 of=backup-mirror.pt1 skip=16 bs=4096 count=1 1+0 Datensätze ein 1+0 Datensätze aus 4096 Bytes (4,1 kB) kopiert, 0,01796 s, 228 kB/s kali Hoda_GmbH # ls -l insgesamt 124407344 -rw-r--r-- 1 root root 4096 30. Aug 09:41 backup-mft.pt1 -rw-r--r-- 1 root root 4096 30. Aug 09:41 backup-mirror.pt1 -r--r--r-- 1 therion users 127393104384 29. Aug 19:59 wd250_medion.pt1 kali Hoda_GmbH # diff backup-mft.pt1 backup-mirror.pt1 (no output here, so both are equal) kali Hoda_GmbH # losetup /dev/loop0 wd250_medion.pt1 kali Hoda_GmbH # losetup -a /dev/loop0: [fc00]:2771728469 (/warehouse/cpv/Kd_Backup/Hoda_GmbH/wd250_medion.pt1) As you can see, I still get the same error, what I dont understand is that if just the mirror is corrupted - why cant the volume be mounted. Shouldnt it be fine if either the original mft or its mirror are intact (but its not necessary that both are intact)? kali Hoda_GmbH # dd if=/dev/loop0 of=/dev/loop0 seek=786432 skip=16 bs=4096 count=1 1+0 Datensätze ein 1+0 Datensätze aus 4096 Bytes (4,1 kB) kopiert, 0,000242779 s, 16,9 MB/s kali Hoda_GmbH # mount -t ntfs-3g -o ro /dev/loop0 /mnt ntfs_pread(): pos 0, count 512 Beginning bootsector check. Checking OEMid, NTFS signature. Checking bytes per sector. Checking sectors per cluster. Checking cluster size. Checking reserved fields are zero. Checking clusters per mft record. Checking clusters per index block. Bootsector check completed successfully. SectorSize = 0x200 SectorSizeBits = 9 SectorsPerCluster = 0x8 NumberOfSectors = 248814656 MFT LCN = 786432 MFTMirr LCN = 16 ClusterSize = 0x1000 ClusterSizeBits = 12 ClustersPerMftRecord = 0xfffffff6 MftRecordSize = 0x400 MftRecordSizeBits = 10 ClustersPerINDXRecord = 0x1 INDXRecordSize = 0x1000 INDXRecordSizeBits = 12 Used BLKBSZSET to set block size to 512 bytes. mft_zone_pos = 0xc0000 mft_zone_start = 0xc0000 mft_zone_end = 0x475271 data1_zone_pos = 4674161 data2_zone_pos = 0 ntfs_pread(): pos 3221225472, count 1024 ntfs_mst_post_read_fixup(): Entering ntfs_attr_lookup(): Entering for attribute type 0x20 ntfs_attr_find(): attribute type 0x20. ntfs_attr_readall(): Entering ntfs_attr_open(): Entering for inode 0, attr 0x10. ntfs_attr_lookup(): Entering for attribute type 0x10 ntfs_attr_find(): attribute type 0x10. ntfs_attr_pread(): Entering for inode 0 attr 0x10 pos 0 count 72 ntfs_attr_lookup(): Entering for attribute type 0x10 ntfs_attr_find(): attribute type 0x10. ntfs_attr_open(): Entering for inode 0, attr 0x80. ntfs_attr_lookup(): Entering for attribute type 0x80 ntfs_attr_find(): attribute type 0x80. ntfs_attr_lookup(): Entering for attribute type 0x80 ntfs_attr_find(): attribute type 0x80. ntfs_mapping_pairs_decompress(): Entering ntfs_mapping_pairs_decompress_i(): Entering for attr 0x80. Mapping pairs array successfully decompressed: NTFS-fs DEBUG: Dumping runlist (values in hex): VCN LCN Run length 0 786432 43008 43008 LCN_ENOENT 0 (runlist end) ntfs_attr_lookup(): Entering for attribute type 0x80 ntfs_attr_find(): attribute type 0x80. ntfs_attr_open(): Entering for inode 0, attr 0xb0. ntfs_attr_lookup(): Entering for attribute type 0xb0 ntfs_attr_find(): attribute type 0xb0. ntfs_inode_real_open(): Entering for inode 1 ntfs_mft_record_read(): Entering for inode 1 ntfs_mft_records_read(): inode 1 ntfs_attr_mst_pread(): Entering for inode 0x0, attr type 0x80, pos 0x400. ntfs_attr_pread(): Entering for inode 0 attr 0x80 pos 1024 count 1024 ntfs_attr_find_vcn(): Entering for inode 0x0, attr 0x80, vcn 0 ntfs_attr_pread_i(): Reading 1024 bytes from vcn 0, lcn 786432, ofs 1024. ntfs_pread(): pos 3221226496, count 1024 ntfs_mst_post_read_fixup(): Entering Incomplete multi-sector transfer: magic: 0x44414142 size: 1024 usa_ofs: 48 usa_count: 1 data: 4347 usn: 4331: Eingabe-/Ausgabefehler Record 1 has no FILE magic (0x44414142) Failed to open inode $MFTMirr: Eingabe-/Ausgabefehler Failed to load $MFTMirr: Eingabe-/Ausgabefehler ntfs_inode_real_close(): Entering for inode 0 Failed to mount '/dev/loop0': Eingabe-/Ausgabefehler Am Dienstag, den 30.08.2011, 09:06 +0200 schrieb Jean-Pierre André: > Hi Georg, > > Georg Bege wrote: > > Hi guys > > > > Im a long time Linux/BSD/UNIX user, I've a question to an NTFS issue at > > this moment. > > I dont expect any fixups or wonders, I'd just like to know what the > > debugging messages exacly mean or if they can be put in a specific area. > > > > From your debugging log : > > > ntfs_mst_post_read_fixup(): Entering > > Incomplete multi-sector transfer: magic: 0x44414142 size: 1024 > > usa_ofs: 48 usa_count: 1 data: 4347 usn: 4331: Eingabe-/Ausgabefehler > > Record 1 has no FILE magic (0x44414142) > > Failed to open inode $MFTMirr: Eingabe-/Ausgabefehler > > Failed to load $MFTMirr: Eingabe-/Ausgabefehler > > > > This means that the MFTMirr record failed a consistency > check : the last bytes of a record contain a value intended > to check whether the record was entirely written. It was > 4347 instead of the expected 4331. > > What appears to be wrong is the description of the mirror > within the MFT. The mirror itself could be correct. > > > My situation is that I've an HDD at hand which has 3 partitions. > > However only the first one is interesting. > > Neither can I access the file system via MS Windows nor can I perform a > > chkdsk. > > > > I've checked the bootcode so far, thats all well - the error lies > > somewhere within the MFT itself. > > But what I dont understand is why I cannot access the volume by the MFT > > mirror (testdisk just crashes if I want to retrieve a file list). > > > > The MFT mirror only contains data for four important files, > this is not enough to recover the user files. However it > contains a copy of its own description, so you might try > to copy to the MFT. Assuming the boot sector is correct, > the MFT is at cluster 786432 and the copy at cluster 16 > (do not copy more than one cluster, you would overwrite > the root directory). > > dd if=DEVICE of=DEVICE seek=786432 skip=16 bs=4096 count=1 > (DEVICE being the partition name). > > Of course, you should first save the first cluster of the MFT and > mirror (and compare them). > dd if=DEVICE of=backup-mft skip=786432 bs=4096 count=1 > dd if=DEVICE of=backup-mirror skip=16 bs=4096 count=1 > > The ntfsprogs tool ntfsfix tries to fix any inconsistency preventing > a partition to be mounted. I am not sure it would help in this > specific situation. > > Hope this helps. > > Regards > > Jean-Pierre > > > > > -- Georg Bege <[email protected]> !DSPAM:4e5c967d994911739931128! ------------------------------------------------------------------------------ Special Offer -- Download ArcSight Logger for FREE! Finally, a world-class log management solution at an even better price-free! And you'll get a free "Love Thy Logs" t-shirt when you download Logger. Secure your free ArcSight Logger TODAY! http://p.sf.net/sfu/arcsisghtdev2dev _______________________________________________ ntfs-3g-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/ntfs-3g-devel
