[SOLVED] Rescue Windows Files With Knoppix?

[Doublet]

Good day. Recently, some sort of evil trojans got on my PC and infected it to the point that the operating system no longer boots appropriately. (Curse you Hector -Black Screen after the Compaq logo... *Sigh). Unfortanatly, before I reformat the hard drive, I have several important files that I Need to recover. Which is why I took to google and ended up finding out how Knoppix is a fabulous canidate for the job.

So, I took a CD from my friend that was burned some time ago with Knoppix 5.01, and booted it up. Everything loaded fine, no problem there. But when I decided to try to mount my hard drive, I got this error message:

Could not mount device.

The reported error was:

The device /dev/sda1, is mounted.

Forced to continue.

Couldn't mount device '/dev/sda1' : Operation not supported

Windows did not shut down properly. Try to mount volume in windows, shut down and try again.

Mount failed.

Well, silly little computer, I cannot get on my windows without reformatting my drive - which would kinda' defeat the purpose of me trying to access data from my C:\ drive, don't ya think? (By the way, the error message was correct, windows did not shut down appropriatly, it turned off after I caught a glimpse of some rogue security software opened across my desktop)

I then went to the command console - or whatever the proper name for it is - and typed in: "sudo mount.ntfs /dev/sda1 /mnt/ -o force" to see if that would turn my luck, but sadly it did not. (*Tear)

So, being the know-nothing-about-linux newbie (Seriously, I know very little about these branches of zesty OS') that I am, I thought it would be nice to go to these spectacular forums and ask for help. So, any ideas? Come on... I'll give you a cookie...

[GregBrannon]

Knoppix may be the winning tool, but I suggest you explore the other rescue disk options, some of which may be more suited to your particular task. Start by Googling "rescue disk."

[MikeTbob]

I think this problem is related to the "no longer boots appropriately" problem. You need to get Windows up and running, in safe mode if need be, but you need to run the Windows disk checker on it. Isn't there a way to boot Windows to a command prompt only and run disk check from there? After that, I think Knoppix will work right.
In other news, I can't remember if Knoppix 5.01 had NTFS support. Check and see if it does with the lsmod command.
Open a terminal window (command prompt) in Knoppix and type:

sudo lsmod |grep -i ntfs

Post your results please.

[Doublet]

Thanks for the prompt reply. I cannot boot windows in safe mode, (Holding down F8 does nothing) that was actually the first thing I tried. Also, I already ran the checkdisk command from my windows installation CD earlier to see if that could fix it, but seeing it is malware that is holding my OS hostage, it did nothing beneficial - saying my hard drive is fine.

As for the Linux Command. I opened terminal and typed in "sudo lsmod |grip -i ntfs" and the results were: ...nothing. When I pressed enter in terminal after typing the command line, it just took me down to another line where I could enter another command.

[yancek]

If you need to recover data, you will probably be better off using TestDisk which I believe you can download. It is also on the SystemRescueCD which you can download here:

Download - SystemRescueCd

You can download TestDisk at the site below, scroll down to Documentation for the downlaod link. I would suggest reading how to use it first:

TestDisk - CGSecurity

[MikeTbob]

Right, when it produces no output like that, it means it didn't find anything related to ntfs. It may be that Knoppix doesn't have NTFS support, that could be why the above command produced no output, although it did not seem to give that error in your first post. Any way you could try a newer distro or version of Knoppix. Knoppix is currently up to 6.2 now.
Download Knoppix Live CD or DVD, Get Documentation and Help

[Doublet]

Thank you once again. I'll be sure to try the updated version of Knoppix.

I'll be sure to post in this thread what my results were on the morrow.

[reed9]

Try mounting the ntfs partition as so (as root)

mkdir /mnt/ntfs
mount -t ntfs-3g /dev/sda1 /mnt/ntfs -o force

Note that you will need to replace /dev/sda1 with the appropriate /dev listing for your partition. If you need help finding that, post the output of (also as root)

fdisk -l

And obviously whichever distro you're using needs ntfs-3g installed. Most if not all current recovery type distros will have it installed by default.

Failing that, part of the ntfsprogs package has a utility called ntfsfix which may work.

ntfsfix /dev/sda1

[Doublet]

Thank you for all the replies - however, none of your kind advice seems to be working.

I burned a CD with the updated version of Knoppix (6.21), but when I went to try to veiw the files I got yet another degregrading error message:

Error <i>org.freedesktop.Hal.Device.Volume.UnknownFailur e</i>

So, I tried the first terminal command reed6 suggested, and got this:

root@Microknoppix:~# mount -t ntfs-3g /dev/sda1 /mnt/ntfs -o force
ntfs_mst_post_read_fixup: magic: 0x00000000 size: 4096 usa_ofs: 0 usa_count: 65535: Invalid argument
Actual VCN (0x0) of index buffer is different from expected VCN (0x1).
Failed to mount '/dev/sda1': Input/output error
NTFS is either inconsistent, or there is a hardware fault, or it's a
SoftRAID/FakeRAID hardware. In the first case run chkdsk /f on Windows
then reboot into Windows twice. The usage of the /f parameter is very
important! If the device is a SoftRAID/FakeRAID then first activate
it and mount a different device under the /dev/mapper/ directory, (e.g.
/dev/mapper/nvidia_eahaabcc1). Please see the 'dmraid' documentation
for more details.

Finally, I used the ntfsfix command but also to no avail:

root@Microknoppix:~# ntfsfix /dev/sda1
Mounting volume... FAILED
Attempting to correct errors...
Processing $MFT and $MFTMirr...
Reading $MFT... OK
Reading $MFTMirr... OK
Comparing $MFTMirr to $MFT... OK
Processing of $MFT and $MFTMirr completed successfully.
Setting required flags on partition... OK
Going to empty the journal ($LogFile)... OK
Remount failed: Input/output error.

And... The drive is still not mounted, and thus I still cannot veiw all of those files that I am attempting to retreive.

All of these heart breaking results are making me wonder if it is even possible to rescue these files. Any ideas? Did the hard drive somehow get damaged?

[MikeTbob]

Thank you for all the replies - however, none of your kind advice seems to be working.

I burned a CD with the updated version of Knoppix (6.21), but when I went to try to veiw the files I got yet another degregrading error message:

Error <i>org.freedesktop.Hal.Device.Volume.UnknownFailur e</i>

So, I tried the first terminal command reed6 suggested, and got this:

root@Microknoppix:~# mount -t ntfs-3g /dev/sda1 /mnt/ntfs -o force
ntfs_mst_post_read_fixup: magic: 0x00000000 size: 4096 usa_ofs: 0 usa_count: 65535: Invalid argument
Actual VCN (0x0) of index buffer is different from expected VCN (0x1).
Failed to mount '/dev/sda1': Input/output error
NTFS is either inconsistent, or there is a hardware fault, or it's a
SoftRAID/FakeRAID hardware. In the first case run chkdsk /f on Windows
then reboot into Windows twice. The usage of the /f parameter is very
important! If the device is a SoftRAID/FakeRAID then first activate
it and mount a different device under the /dev/mapper/ directory, (e.g.
/dev/mapper/nvidia_eahaabcc1). Please see the 'dmraid' documentation
for more details.

Finally, I used the ntfsfix command but also to no avail:

root@Microknoppix:~# ntfsfix /dev/sda1
Mounting volume... FAILED
Attempting to correct errors...
Processing $MFT and $MFTMirr...
Reading $MFT... OK
Reading $MFTMirr... OK
Comparing $MFTMirr to $MFT... OK
Processing of $MFT and $MFTMirr completed successfully.
Setting required flags on partition... OK
Going to empty the journal ($LogFile)... OK
Remount failed: Input/output error.

And... The drive is still not mounted, and thus I still cannot veiw all of those files that I am attempting to retreive.

All of these heart breaking results are making me wonder if it is even possible to rescue these files. Any ideas? Did the hard drive somehow get damaged?

That's about as good as I can guess. You might try downloading the newest version of Parted Magic, it has Testdisk and Photorec, which are awesome tools to have in your arsenal. Who knows, it might actually work.