Re: "mount -t ntfs" vs "mount.ntfs" ?
On Fri 28 Jan 2022 at 11:34:44 (+0100), Yvan Masson wrote:
>
> I had to recover a NTFS partition from a broken drive (I used GNU
> ddrescue with a domain log file generated by partclone), so I now have
> a file "recovered_partition.img":
>
> $ file recovered_partition.img
> recovered_partition.img: DOS/MBR boot sector, code offset 0x52+2,
> OEM-ID "NTFS ", sectors/cluster 8, Media descriptor 0xf8,
> sectors/track 63, heads 255, hidden sectors 567296, dos < 4.0
> BootSector (0x80), FAT (1Y bit by descriptor); NTFS, sectors/track 63,
> sectors 1917202431, $MFT start cluster 786432, $MFTMirror start
> cluster 2, bytes/RecordSegment 2^(-1*246), clusters/index block 1,
> serial number 0606854f86854cf02; contains bootstrap BOOTMGR
>
> If I use `mount -t ntfs`, it fails:
>
> $ sudo mount -t ntfs recovered_partition.img /mnt/
> Failed to read last sector (1917202430): Argument invalide
> HINTS: Either the volume is a RAID/LDM but it wasn't setup yet,
> or it was not setup correctly (e.g. by not using mdadm --build ...),
> or a wrong device is tried to be mounted,
> or the partition table is corrupt (partition is smaller than NTFS),
> or the NTFS boot sector is corrupt (NTFS size is not valid).
> Failed to mount '/dev/loop0': Argument invalide
> The device '/dev/loop0' doesn't seem to have a valid NTFS.
> Maybe the wrong device is used? Or the whole disk instead of a
> partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?
>
> However, it works perfectly with `mount.ntfs`:
>
> $ sudo mount.ntfs recovered_partition.img /mnt/sshfs/
> Metadata kept in Windows cache, refused to mount.
> Falling back to read-only mount because the NTFS partition is in an
> unsafe state. Please resume and shutdown Windows fully (no hibernation
> or fast restarting.)
> Could not mount read-write, trying read-only
>
> Could it be because `mount` uses kernel driver and `mount.ntfs` uses
> ntfs-3g, and that the latter has better "quality" even for read-only?
> (Note that this sentence is a complete guess)
Perhaps it's worth perusing:
https://superuser.com/questions/139452/kernel-ntfs-driver-vs-ntfs-3g
https://www.paragon-software.com/us/home/ntfs3-driver-faq/
I'm not sure what "quality" means here. One would hope that files
would yield the same contents regardless of which driver is used,
allowing for whatever your "broken" means, and for the failure to
shutdown Windows cleanly.
Cheers,
David.
Reply to: