Hi list,I had to recover a NTFS partition from a broken drive (I used GNU ddrescue with a domain log file generated by partclone), so I now have a file "recovered_partition.img":
$ file recovered_partition.imgrecovered_partition.img: DOS/MBR boot sector, code offset 0x52+2, OEM-ID "NTFS ", sectors/cluster 8, Media descriptor 0xf8, sectors/track 63, heads 255, hidden sectors 567296, dos < 4.0 BootSector (0x80), FAT (1Y bit by descriptor); NTFS, sectors/track 63, sectors 1917202431, $MFT start cluster 786432, $MFTMirror start cluster 2, bytes/RecordSegment 2^(-1*246), clusters/index block 1, serial number 0606854f86854cf02; contains bootstrap BOOTMGR
If I use `mount -t ntfs`, it fails: $ sudo mount -t ntfs recovered_partition.img /mnt/ Failed to read last sector (1917202430): Argument invalide HINTS: Either the volume is a RAID/LDM but it wasn't setup yet, or it was not setup correctly (e.g. by not using mdadm --build ...), or a wrong device is tried to be mounted, or the partition table is corrupt (partition is smaller than NTFS), or the NTFS boot sector is corrupt (NTFS size is not valid). Failed to mount '/dev/loop0': Argument invalide The device '/dev/loop0' doesn't seem to have a valid NTFS. Maybe the wrong device is used? Or the whole disk instead of a partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around? However, it works perfectly with `mount.ntfs`: $ sudo mount.ntfs recovered_partition.img /mnt/sshfs/ Metadata kept in Windows cache, refused to mount. Falling back to read-only mount because the NTFS partition is in an unsafe state. Please resume and shutdown Windows fully (no hibernation or fast restarting.) Could not mount read-write, trying read-onlyCould it be because `mount` uses kernel driver and `mount.ntfs` uses ntfs-3g, and that the latter has better "quality" even for read-only? (Note that this sentence is a complete guess)
Regards, Yvan
Attachment:
OpenPGP_signature
Description: OpenPGP digital signature