Le 28/01/2022 à 17:51, David Wright a écrit :
Thanks for the links, I missed that NTF3 was already included in the kernel I use (from Debian testing). So in my case ntfs3g is able to mount a rescued partition, while NTFS3 is not (thanks Andrei for confirming what I supposed): this means that in some cases, NTFS3 is not as mature as ntfs3g.On Fri 28 Jan 2022 at 11:34:44 (+0100), Yvan Masson wrote:I had to recover a NTFS partition from a broken drive (I used GNU ddrescue with a domain log file generated by partclone), so I now have a file "recovered_partition.img": $ file recovered_partition.img recovered_partition.img: DOS/MBR boot sector, code offset 0x52+2, OEM-ID "NTFS ", sectors/cluster 8, Media descriptor 0xf8, sectors/track 63, heads 255, hidden sectors 567296, dos < 4.0 BootSector (0x80), FAT (1Y bit by descriptor); NTFS, sectors/track 63, sectors 1917202431, $MFT start cluster 786432, $MFTMirror start cluster 2, bytes/RecordSegment 2^(-1*246), clusters/index block 1, serial number 0606854f86854cf02; contains bootstrap BOOTMGR If I use `mount -t ntfs`, it fails: $ sudo mount -t ntfs recovered_partition.img /mnt/ Failed to read last sector (1917202430): Argument invalide HINTS: Either the volume is a RAID/LDM but it wasn't setup yet, or it was not setup correctly (e.g. by not using mdadm --build ...), or a wrong device is tried to be mounted, or the partition table is corrupt (partition is smaller than NTFS), or the NTFS boot sector is corrupt (NTFS size is not valid). Failed to mount '/dev/loop0': Argument invalide The device '/dev/loop0' doesn't seem to have a valid NTFS. Maybe the wrong device is used? Or the whole disk instead of a partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around? However, it works perfectly with `mount.ntfs`: $ sudo mount.ntfs recovered_partition.img /mnt/sshfs/ Metadata kept in Windows cache, refused to mount. Falling back to read-only mount because the NTFS partition is in an unsafe state. Please resume and shutdown Windows fully (no hibernation or fast restarting.) Could not mount read-write, trying read-only Could it be because `mount` uses kernel driver and `mount.ntfs` uses ntfs-3g, and that the latter has better "quality" even for read-only? (Note that this sentence is a complete guess)Perhaps it's worth perusing: https://superuser.com/questions/139452/kernel-ntfs-driver-vs-ntfs-3g https://www.paragon-software.com/us/home/ntfs3-driver-faq/ I'm not sure what "quality" means here. One would hope that files would yield the same contents regardless of which driver is used, allowing for whatever your "broken" means, and for the failure to shutdown Windows cleanly. Cheers, David.
Regards, Yvan
Attachment:
OpenPGP_signature
Description: OpenPGP digital signature