NTFS (Direct) Reader for Linux

Question

I managed to damage my NTFS partition pretty well (Details*; I don't think its extremely relevant but it might be.) and was wondering if there is any linux tool that can read an invalidly partitioned harddrive. In particular, Active@ NTFS Reader does exactly what I need; it seems to trust less of what the file system is telling it and from it I can view all the files on the HD.

However, I need somewhere to copy them to and DOS is not so good about handling my USB drive. Ubuntu is; and thus the linux tool question.

Things I've tried: - I can plain mount the partition, but only a portion of the FS that Active Reader shows appears. - TestDisk only finds that same portion. - Ditto with ntfsundelete and ntfsls

I might ddrescue and pull off the entire 180 gb partition to store it somewhere (I believe this to be possible?) but that isn't a long term solution.

*What happened:

I was in the middle of resizing the partition when fluxbox crashed. I let the computer keep going till it stopped doing work, and then restarted. I figured maybe the GUI went down but gparted did its job. I restarted, and windows booted. Still said I had 180 gb partition though. Then I ran chkdsk. Even without /f, it started deleting invalid things, and then told me I needed to restart to fix errors. The partition would not boot after that. I'd be curious why chkdsk made it impossible to restart; but I guess it deleted info on important boot files?

Answer 1

One possibility: Use Active@ to identify the "real" boundaries of the partition, and then use ddrescue or similar to extract that region to a file. Mount the file as loopback, and see if you can see everything then...

Answer 2

You're going to need some tools: TestDisk PhotoRec ddrescue

Imo, these are all available via aptitude install

Consult https://help.ubuntu.com/community/DataRecovery for more information and step by step sort of things..

Answer 3

Firstly: reiterating Eddie's comment, make a cloned image of the entire disk first, then attempt recovery from copies of that image. I'll say it again: don't modify the original disk, and if the disk is failing (which it doesn't sound like from your description, but just in case) don't read it more than necessary.

The TestDisk/PhotoRec tools look quite user-friendly, but have limited set of functionality. Luckily I haven't needed to use them, but a number of years ago (before TestDisk and PhotoRec existed, I believe)...

I used The Sleuth Kit to successfully recover files off of a NTFS partition on a partially crashed disk. Well, first I had to read up on the PC BIOS partition format to rewrite the corrupted MBR and partition table, and then read up on NTFS internals to locate the backup $MFT (because the original was corrupted)... all done manually, with dd and xxd, and then I had to script TSK's fls/icat to iterate over the files in the filesystem and save them off. It's doable, just time-consuming.

Answer 4

Try StrongRecovery for NTFS/FAT/FAT32 file recovery, it's really fast and reliable and works fine either for Windows 2000/XP/Vista/7

http://www.strongrecovery.com