Find the answer to your Linux question:
Page 1 of 2 1 2 LastLast
Results 1 to 10 of 12
Good day. Recently, some sort of evil trojans got on my PC and infected it to the point that the operating system no longer boots appropriately. (Curse you Hector -Black ...
Enjoy an ad free experience by logging in. Not a member yet? Register.
  1. #1
    Just Joined!
    Join Date
    Nov 2010
    Location
    Wilmington, NC
    Posts
    5

    [SOLVED] Rescue Windows Files With Knoppix?


    Good day. Recently, some sort of evil trojans got on my PC and infected it to the point that the operating system no longer boots appropriately. (Curse you Hector -Black Screen after the Compaq logo... *Sigh). Unfortanatly, before I reformat the hard drive, I have several important files that I Need to recover. Which is why I took to google and ended up finding out how Knoppix is a fabulous canidate for the job.

    So, I took a CD from my friend that was burned some time ago with Knoppix 5.01, and booted it up. Everything loaded fine, no problem there. But when I decided to try to mount my hard drive, I got this error message:

    Could not mount device.

    The reported error was:

    The device /dev/sda1, is mounted.

    Forced to continue.

    Couldn't mount device '/dev/sda1' : Operation not supported

    Windows did not shut down properly. Try to mount volume in windows, shut down and try again.

    Mount failed.


    Well, silly little computer, I cannot get on my windows without reformatting my drive - which would kinda' defeat the purpose of me trying to access data from my C:\ drive, don't ya think? (By the way, the error message was correct, windows did not shut down appropriatly, it turned off after I caught a glimpse of some rogue security software opened across my desktop)

    I then went to the command console - or whatever the proper name for it is - and typed in: "sudo mount.ntfs /dev/sda1 /mnt/ -o force" to see if that would turn my luck, but sadly it did not. (*Tear)

    So, being the know-nothing-about-linux newbie (Seriously, I know very little about these branches of zesty OS') that I am, I thought it would be nice to go to these spectacular forums and ask for help. So, any ideas? Come on... I'll give you a cookie...

  2. #2
    Just Joined!
    Join Date
    Dec 2009
    Location
    Maryland, USA
    Posts
    82
    Knoppix may be the winning tool, but I suggest you explore the other rescue disk options, some of which may be more suited to your particular task. Start by Googling "rescue disk."

  3. #3
    Administrator MikeTbob's Avatar
    Join Date
    Apr 2006
    Location
    Texas
    Posts
    7,864
    I think this problem is related to the "no longer boots appropriately" problem. You need to get Windows up and running, in safe mode if need be, but you need to run the Windows disk checker on it. Isn't there a way to boot Windows to a command prompt only and run disk check from there? After that, I think Knoppix will work right.
    In other news, I can't remember if Knoppix 5.01 had NTFS support. Check and see if it does with the lsmod command.
    Open a terminal window (command prompt) in Knoppix and type:
    Code:
    sudo lsmod |grep -i ntfs
    Post your results please.
    I do not respond to private messages asking for Linux help, Please keep it on the forums only.
    All new users please read this.** Forum FAQS. ** Adopt an unanswered post.

    I'd rather be lost at the lake than found at home.

  4. $spacer_open
    $spacer_close
  5. #4
    Just Joined!
    Join Date
    Nov 2010
    Location
    Wilmington, NC
    Posts
    5
    Thanks for the prompt reply. I cannot boot windows in safe mode, (Holding down F8 does nothing) that was actually the first thing I tried. Also, I already ran the checkdisk command from my windows installation CD earlier to see if that could fix it, but seeing it is malware that is holding my OS hostage, it did nothing beneficial - saying my hard drive is fine.

    As for the Linux Command. I opened terminal and typed in "sudo lsmod |grip -i ntfs" and the results were: ...nothing. When I pressed enter in terminal after typing the command line, it just took me down to another line where I could enter another command.

  6. #5
    Linux Guru
    Join Date
    Oct 2007
    Location
    Tucson AZ
    Posts
    3,190
    If you need to recover data, you will probably be better off using TestDisk which I believe you can download. It is also on the SystemRescueCD which you can download here:

    Download - SystemRescueCd

    You can download TestDisk at the site below, scroll down to Documentation for the downlaod link. I would suggest reading how to use it first:

    TestDisk - CGSecurity

  7. #6
    Administrator MikeTbob's Avatar
    Join Date
    Apr 2006
    Location
    Texas
    Posts
    7,864
    Right, when it produces no output like that, it means it didn't find anything related to ntfs. It may be that Knoppix doesn't have NTFS support, that could be why the above command produced no output, although it did not seem to give that error in your first post. Any way you could try a newer distro or version of Knoppix. Knoppix is currently up to 6.2 now.
    Download Knoppix Live CD or DVD, Get Documentation and Help
    I do not respond to private messages asking for Linux help, Please keep it on the forums only.
    All new users please read this.** Forum FAQS. ** Adopt an unanswered post.

    I'd rather be lost at the lake than found at home.

  8. #7
    Just Joined!
    Join Date
    Nov 2010
    Location
    Wilmington, NC
    Posts
    5
    Thank you once again. I'll be sure to try the updated version of Knoppix.

    I'll be sure to post in this thread what my results were on the morrow.

  9. #8
    Linux Guru reed9's Avatar
    Join Date
    Feb 2009
    Location
    Boston, MA
    Posts
    4,651
    Try mounting the ntfs partition as so (as root)
    Code:
    mkdir /mnt/ntfs
    mount -t ntfs-3g /dev/sda1 /mnt/ntfs -o force
    Note that you will need to replace /dev/sda1 with the appropriate /dev listing for your partition. If you need help finding that, post the output of (also as root)
    Code:
    fdisk -l
    And obviously whichever distro you're using needs ntfs-3g installed. Most if not all current recovery type distros will have it installed by default.

    Failing that, part of the ntfsprogs package has a utility called ntfsfix which may work.
    Code:
    ntfsfix /dev/sda1

  10. #9
    Just Joined!
    Join Date
    Nov 2010
    Location
    Wilmington, NC
    Posts
    5
    Thank you for all the replies - however, none of your kind advice seems to be working.

    I burned a CD with the updated version of Knoppix (6.21), but when I went to try to veiw the files I got yet another degregrading error message:

    Error <i>org.freedesktop.Hal.Device.Volume.UnknownFailur e</i>

    So, I tried the first terminal command reed6 suggested, and got this:

    root@Microknoppix:~# mount -t ntfs-3g /dev/sda1 /mnt/ntfs -o force
    ntfs_mst_post_read_fixup: magic: 0x00000000 size: 4096 usa_ofs: 0 usa_count: 65535: Invalid argument
    Actual VCN (0x0) of index buffer is different from expected VCN (0x1).
    Failed to mount '/dev/sda1': Input/output error
    NTFS is either inconsistent, or there is a hardware fault, or it's a
    SoftRAID/FakeRAID hardware. In the first case run chkdsk /f on Windows
    then reboot into Windows twice. The usage of the /f parameter is very
    important! If the device is a SoftRAID/FakeRAID then first activate
    it and mount a different device under the /dev/mapper/ directory, (e.g.
    /dev/mapper/nvidia_eahaabcc1). Please see the 'dmraid' documentation
    for more details.


    Finally, I used the ntfsfix command but also to no avail:

    root@Microknoppix:~# ntfsfix /dev/sda1
    Mounting volume... FAILED
    Attempting to correct errors...
    Processing $MFT and $MFTMirr...
    Reading $MFT... OK
    Reading $MFTMirr... OK
    Comparing $MFTMirr to $MFT... OK
    Processing of $MFT and $MFTMirr completed successfully.
    Setting required flags on partition... OK
    Going to empty the journal ($LogFile)... OK
    Remount failed: Input/output error.


    And... The drive is still not mounted, and thus I still cannot veiw all of those files that I am attempting to retreive.

    All of these heart breaking results are making me wonder if it is even possible to rescue these files. Any ideas? Did the hard drive somehow get damaged?

  11. #10
    Administrator MikeTbob's Avatar
    Join Date
    Apr 2006
    Location
    Texas
    Posts
    7,864
    Quote Originally Posted by Doublet View Post
    Thank you for all the replies - however, none of your kind advice seems to be working.

    I burned a CD with the updated version of Knoppix (6.21), but when I went to try to veiw the files I got yet another degregrading error message:

    Error <i>org.freedesktop.Hal.Device.Volume.UnknownFailur e</i>

    So, I tried the first terminal command reed6 suggested, and got this:

    root@Microknoppix:~# mount -t ntfs-3g /dev/sda1 /mnt/ntfs -o force
    ntfs_mst_post_read_fixup: magic: 0x00000000 size: 4096 usa_ofs: 0 usa_count: 65535: Invalid argument
    Actual VCN (0x0) of index buffer is different from expected VCN (0x1).
    Failed to mount '/dev/sda1': Input/output error
    NTFS is either inconsistent, or there is a hardware fault, or it's a
    SoftRAID/FakeRAID hardware. In the first case run chkdsk /f on Windows
    then reboot into Windows twice. The usage of the /f parameter is very
    important! If the device is a SoftRAID/FakeRAID then first activate
    it and mount a different device under the /dev/mapper/ directory, (e.g.
    /dev/mapper/nvidia_eahaabcc1). Please see the 'dmraid' documentation
    for more details.


    Finally, I used the ntfsfix command but also to no avail:

    root@Microknoppix:~# ntfsfix /dev/sda1
    Mounting volume... FAILED
    Attempting to correct errors...
    Processing $MFT and $MFTMirr...
    Reading $MFT... OK
    Reading $MFTMirr... OK
    Comparing $MFTMirr to $MFT... OK
    Processing of $MFT and $MFTMirr completed successfully.
    Setting required flags on partition... OK
    Going to empty the journal ($LogFile)... OK
    Remount failed: Input/output error.


    And... The drive is still not mounted, and thus I still cannot veiw all of those files that I am attempting to retreive.

    All of these heart breaking results are making me wonder if it is even possible to rescue these files. Any ideas? Did the hard drive somehow get damaged?
    That's about as good as I can guess. You might try downloading the newest version of Parted Magic, it has Testdisk and Photorec, which are awesome tools to have in your arsenal. Who knows, it might actually work.
    Last edited by MikeTbob; 11-25-2010 at 03:01 AM.
    I do not respond to private messages asking for Linux help, Please keep it on the forums only.
    All new users please read this.** Forum FAQS. ** Adopt an unanswered post.

    I'd rather be lost at the lake than found at home.

Page 1 of 2 1 2 LastLast

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •